In case you are applying for a position in Germany, the following companies are together joint controllers for the processing of personal data during the application process (including during active search of potential candidates) and are therefore together responsible for fulfilling obligations under the GDPR:

• AutoScout24 GmbH, Tölzer Straße 16, 82031 Grünwald, Germany („AS24-DE“);
• LeasingMarkt.de GmbH, Toulouser Allee 25, 40211 Düsseldorf, Germany („LeasingMarkt-DE”);
• AUTOproff Deutschland GmbH, Aspelohe 27B, 22848 Norderstedt, Germany („AUTOproff-DE“);
• AutoScout24 Engine GmbH, Bothestr. 11-15, 81675 München, Germany („AS24-DE“);
• AutoScout24 Smyle GmbH, Tölzer Str. 16, 82031 Grünwald, Germany („AS24-DE“);
• AutoScout24 Smyle Engine GmbH, Bothestr. 11-15, 81675 München, Germany („AS24-DE“);
• Autoplenum GmbH, Bahnhofstraße 5, 91245 Simmelsdorf, Germany („AS24-DE“).

In addition to companies located in Germany mentioned above, companies of the group that are located in other countries than Germany (see the table below under section “Applications for Other Countries than Germany”) may be involved in an individual application process (including active search). In those cases, these companies are joint controllers together with companies located in Germany mentioned above and are therefore together with the above-mentioned companies responsible for fulfilling obligations under the GDPR.

In the following, all joint controllers are jointly together referred to as „we” or “us”.

Within this data protection information under "Which company in the company group fulfills which obligations?", we inform you about what the joint controllers have agreed on with regard to the distribution of obligations.

In case you are applying for a position in a country other than Germany, the following companies of the company group are joint controllers for the processing of personal data during the application process (including during active search of potential candidates) and are therefore together responsible for fulfilling obligations under the GDPR:

Country	Joint controllers
Austria	AUTOSCOUT 24 AS GmbH (Ungargasse 37, A-1030 Wien, Austria) AutoScout24 Engine GmbH (Bothestr. 11-15, 81675 Munich, Germany) und AutoScout24 GmbH (Tölzer Straße 16, 82031 Grünwald, Germany)
The Netherlands	AutoScout24 Nederland B.V. (Fred. Roeskestraat 115, 1076 EE, Amsterdam, the Netherlands) AutoProff Nederland B.V. (Doktor van Lookeren Campagneweg 5, 8025BX Zwolle, the Netherlands) LeasingMarkt NL B.V. (Fred. Roeskestraat 115, 1076 EE, Amsterdam, the Netherlands) AutoScout24 Engine GmbH (Bothestr. 11-15, 81675 Munich, Germany) and AutoScout24 GmbH (Tölzer Straße 16, 82031 Grünwald, Germany)
Italy	AutoScout24 Italia S.P.A. (Via Battaglia 71/C, 35020 – Albignasego (PD), Italy) AUTOPROFF Italy S.R.L. (Albignasego (PD) Via Battaglia 71/C CAP 35020, Italy) AutoScout24 Engine GmbH (Bothestr. 11-15, 81675 Munich, Germany) and AutoScout24 GmbH (Tölzer Straße 16, 82031 Grünwald, Germany)
Belgium	AutoScout24 Belgium S.A. (Boulevard International 55 – Riverside Business Park, bâtiment G 1070 Bruxelles, Belgium) AUTOproff Belgium B.V. (Internationalelaan 55, 1070 Anderlecht, Belgium) AutoScout24 Engine GmbH (Bothestr. 11-15, 81675 Munich, Germany) and AutoScout24 GmbH (Tölzer Straße 16, 82031 Grünwald, Germany)
Denmark	Auction Group A/S (Ouskær 32, 7100 Vejle, Denmark) AutoScout24 GmbH (Tölzer Straße 16, 82031 Grünwald, Germany)
Norway	AutoProff Norge AS (Haakon VIIs gate 10, 0161 Oslo, Norway) AutoScout24 Engine GmbH (Bothestr. 11-15, 81675 Munich, Germany) and AutoScout24 GmbH (Tölzer Straße 16, 82031 Grünwald, Germany)
Sweden	AutoProff Sweden AB (Ringungsgatan 10B, 216 16 Limhamn, Sweden) AutoScout24 Engine GmbH (Bothestr. 11-15, 81675 Munich, Germany) and AutoScout24 GmbH (Tölzer Straße 16, 82031 Grünwald, Germany)

In addition to the joint controllers named above per country, companies of the group that are located in other countries (see the table above) may be involved in an individual application process (including active search). In those cases, these companies are joint controllers together with the joint controllers named above per country and are therefore together with the joint controllers named above per country responsible for fulfilling obligations under the GDPR.

In the following, all joint controllers are jointly together referred to as „we” or “us”.

Within this data protection information under “Which company in the company group fulfills which obligations?”, we inform you about what the joint controllers have agreed on with regard to the distribution of obligations.

In the following, we are providing the contact details of the data protection officers. In case you apply in Germany, the data protection officers in Germany are relevant. In case you apply in another country, please find the contact details of the data protection officers under “Contact Details of the Data Protection Officers in Other Countries than Germany”.

The german companies (AUTOproff-DE and LeasingMarkt-DE and AS24-DE) of the company group agreed that they independently fulfill all obligations under the GDPR. The German companies of the company group agreed that AutScout24 GmbH will fulfill the following obligations for all AS24-DE companies and that other obligations not mentioned below are fulfilled independently by AS24-DE companies:

• Art. 13 GDPR and Art. 14 GDPR: obligations to inform about the data processing;
• Art. 26 Para. 2 Sentence 2 GDPR: providing the essence of the arrangement of the joint controllers;
• Art. 12 GDPR, Art. 15 GDPR, Art. 16 GDPR, Art. 17 GDPR, Art. 18 GDPR, Art. 19 GDPR, Art. 20 GDPR, Art. 21 GDPR and Art. 22 GDPR: fulfilling data subject’s rights.

For all other countries, the joint controllers agreed that each company indicated in the table under “Names and Contact Details of the Controllers” and there under “Applications for Other Countries than Germany” above is independently fulfilling all obligations under the GDPR.

We mainly process personal data that you provide to us within the application process. We only process your data in the context of the application procedure, especially to find and hire a suitable candidate for an opening. Legal base for the processing is Art. 6 Para. 1 lit. b) GDPR. In countries other than Germany, the legal basis is Art. 6 Para. 1 lit. b) GDPR in conjunction with a legal basis from another law of another country, which allows the processing of data from applications. We may also process information about your person that is not mandatory but still important for the application process based on Art. 6 Para. 1 lit f) GDPR and our legitimate interest in considering all relevant information when evaluating the job application.

If we find your profile on an employment-oriented platform interesting and for example contact you for this reason and list you as a potential candidate with us, the legal basis for such processing is our legitimate interests in accordance with Art. 6 Para. 1 lit. f) GDPR in the use of the data provided by you for external presentation on employment-oriented platforms and in contacting you.

In some cases, we may ask you to conduct a video call with us. While sending you an invite for such a call and while the actual call, there are data referring to you are processed as well. In those cases, the processing is based on our legitimate interests in accordance with Art. 6 Para. 1 lit. f) GDPR in using the data necessary to send you an invite for the call and processing the data needed to execute the actual video call with you.

Within the AutoScout24 company group, we share resources in the area of HR and support each other in carrying out application processes, including the active search for suitable candidates. In addition, we share data on potential candidates and applicants within the company group to check which company within the company group you could work for in the future. These data processing operations are carried out on the basis of our legitimate interests under Art. 6 Para. 1 lit. f) GDPR in sharing resources, providing mutual support and checking in which company you could work.

When someone provides to you a reference for the job application, we use the data provided on you and on the person providing the reference based on our legitimate interest in the meaning of Art. 6 Para. 1 lit. f) GDPR. Our legitimate interest is using data part of references for the application process.

We also use your personal data relating to your application process to evaluate the performance of our job advertisements and to optimize the application process and do internal HR reporting for the application process. Legal base for the processing is Art. 6 Para. 1 lit f) GDPR and our legitimate interest in optimizing procedures based on evaluations and gaining insides about HR processes part of the application process.

In addition, you may consent in the processing of your personal data for further purposes, e.g. consideration of your application for future openings or extended storage. The legal base for that processing will be Art. 6 Para. 1 a) GDPR.

Insofar as special categories of personal data (e.g. health data, Art. 9 Para. 1 GDPR) are processed, the processing is carried out on the basis of Sec. 26 Para. 3 Sentence 1 BDSG (in conjunction with Art. 9 Para. 2 lit. b) GDPR) for the exercise of rights or for the fulfillment of legal obligations arising from labor law, social security law and social protection law, or on the basis of your consent pursuant to Sec. 26 Para. 2 and 3 BDSG (in conjunction with Art. 9 Para. 2 lit. a) GDPR). In countries other than Germany, the legal basis for the processing of special categories of personal data that applicants provide voluntarily or for which consent is given during the application process applies. Please note that, in particular, resumes, references or the other data you provide for application purposes may also contain data that is particularly worthy of protection (within the meaning of Art. 9 Para. 1 GDPR). We therefore recommend that you do not provide any information that is part of the special categories of data. If you provide us with this type of information, we will use it to retain your documents and process your application in accordance with this information.

In the course of the application process, we ask you to complete a test or different tests within which we would like to learn more about you. For this purpose, you will be asked various questions. We will share tests results with you and discuss them together with you and take the results of your test into account when making a decision about the rest of the application process. The data processing taking place when you complete the test and when the result is used is based on our legitimate interests according to Art. 6 Para. 1 lit. f) GDPR. We have a legitimate interest in learning more about our applicants and using this information in the application process.

In the event of a legal dispute, we will also process your data for the assertion, exercise or defense of legal claims. In this case, the legal basis for the data processing is Art. 6 Para. 1 lit. f) GDPR. We also may be legally obliged to process your data, e.g. in accordance with Sec. 147 of the German Federal Fiscal Code and Sec. 257 of the German Federal Commercial Code. If this is the case, the processing will be based on Art. 6 Para. 1 lit. c) GDPR. For other countries than Germany, the legal basis for retaining data as part of documents that are by law obligatory to be maintained is Art. 6 Para. 1 lit. c) GDPR in conjunction with such a provision in an applicable law of another country where you apply for a position with us.

Which data we collect and process will vary on the position offered. Our job vacancies always include a candidate profile, which includes description of the job requirements. Information that is required within the entry form is marked with an asterisk (*). You are of course welcome to provide us further information about yourself if you consider it relevant for the application process.

Before you apply, please take a good look at the candidate profile so you know exactly which information is required to apply. As a rule, we request the following information:

• Information regarding the position you are applying for;
• Name;
• Email adress;
• Telephone number;
• Place of residence
• Curriculum vitae;
• Education and training;
• URL of LinkedIn profile;
• Information on wether a work permit and visa would be required and/or you would need to relocate;
• Source of the application;
• Salary expectation.

Certain positions might also require you to provide further information in relation to specific skills (e.g. language skills).

If you apply to us by email, we might revert back to you to and ask you for further information to complete your application.

Legal base for the processing of mandatory information is Art. 6 Para. 1 lit. b) GDPR. In countries other than Germany, the legal basis is Art. 6 Para. 1 lit. b) GDPR in conjunction with a legal basis from another law of another country, which allows the processing of data that are necessary for making a decision on whether or not an employer wants to enter into an employment relationship with an applicant. Other information provided by you or collected by us will be processed based on Art. 6 Para. 1 lit f) GDPR and our legitimate interest in considering all relevant information when evaluating the job application. We might consider publicly available data in individual cases. In this case, the data processing is also based on our aforementioned legitimate interests.

If we find your profile on a employment-oriented platform interesting and contact you in this regard, we use information from your profile for the active search for suitable candidates and for contacting you and for the application process that may follow.

Within the AutoScout24 company group, we exchange data on applicants and ongoing application processes to share resources in the area of HR and to support each other in the active search for candidates and in application processes. In addition, we share data to check which company you could work for in the future.

If we conduct a video call with you, we use your name and email address to send the invitation to the video call. In addition, we process the data necessary for conducting the call with the video call stool used in each individual case.

To better understand what kind of personality you have, we use the answers you provide within the test. What exactly these are depends on the answers you give in each individual case.

For the application process, we also use personal data contained in recommendations. Which ones these are exactly depends on the recommendation regarding your person.

In some cases, we are subject to statutory retention periods with regard to documents, letters and emails. Part of these are also personal data. We process these to fulfill the applicable respective retention period.

For internal HR reporting and analysis, we use information about your application process. This includes, for example, the channel through which your application reached us, whether you initiated the application yourself, and how your application process went. Where necessary, we pseudonymize and anonymize personal data used for reporting and analyses.

In the event of suspected fraud, we might analyze the log files and information relating to the application process to clarify discrepancies. We also analyze data part of your application process in case we have a reason to believe that it relates to fraudulent activities. The data processing that takes place for this purpose is based on our legitimate interests in the clarification of suspected fraud and inconsistencies in accordance with Art. 6 Para. 1 lit. f) GDPR.

We search job-focused platforms for individuals who may be a potential candidate of interest to us. If we add you to our database of potentially suitable candidates, we will send you an email with the privacy notice also displayed here.

We take data from their profile and use it to manage our database of potentially interesting candidates. In addition, we sometimes contact potentially interesting candidates in order to identify any mutual interest and to exchange information about possible vacancies.

The data processing carried out as part of the steps just described is based on our legitimate interests (Art. 6 Para. 1lit. f) GDPR) in actively searching for candidates of potential interest to us and maintaining a database to manage candidates of potential interest. If you no longer wish to be considered by us as a potentially suitable candidate, please let us know.

LinkedIn is an employment-oriented online social-network provided by the LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. If you like, you can use our website to apply with your existing LinkedIn-Profile. Just click the “Apply with LinkedIn” button on our website. After clicking the button, information from your LinkedIn profile is loaded and inserted into the application form. It is possible for you to adjust and supplement the information loaded from LinkedIn.

If you apply with your LinkedIn profile on our website or on our account on the platform of LinkedIn, you will see which data we ask from you in each individual case. The information marked with an "*" is mandatory. You can provide us with other information as an option.

If you decide to send us your application information in part with the help of LinkedIn, according to information from LinkedIn, this may result in a data transfer from a non-EU country to the EU, as LinkedIn sometimes stores data outside the EU and the EEA or processes it there.

You can change your LinkedIn settings here: https://www.linkedin.com/psettings/permitted-services. Details on how LinkedIn processes your data as well as your rights and further setting options can be found in LinkedIn’s privacy policy, which you can access here: https://www.linkedin.com/legal/privacy-policy.

In individual cases, recruiters support us during the application process. Unless we inform you otherwise, they collect your personal data as independent data controllers (Art. 4 no. 8 GDPR) and pass it on to us. If we should receive data from a recruiter, you will receive additional information from us or the recruiter. If we receive data referring to you from an external recruiter, the recruiter is the “source” of the data provided on you.

In the course of the application process, we may ask you to complete a test or different tests while you are already at a late stage of your application. One test is aimed at understanding the personality of our applicants. Within this test, you are asked to select certain words which, in your opinion, best reflect a situation described in the individual question asked. Based on your answers, our service provider Predictive Index, LLC (101 Station Dr, Westwood, Massachusetts, 02090, USA) will provide us with an analysis of your personality. There are certain personality types and character traits you are assigned to. We will send you your results and explain them to you and discuss them together with you. To a certain extent, your results and the discussion of your results together with you are taken into account when we make a decision on who to hire. However, we will not purely base a decision regarding your application on the test results and rather understand the test as an additional chance to get to know more about our applicants.

We may also send you an invitation to participate in another kind of test which aims to find out how fast you react and how fast you can solve problems (cognitive skills). The result of this test is shown on a graph. We will share the graph with you in case you are asked to participate in such a test.

Participation in the tests is always voluntary and you may also decide to not want to participate in a certain test. The data processing taking place when you complete the test and when the result is used is based on our legitimate interests according to Art. 6 Para. 1 lit. f) GDPR. We have a legitimate interest in learning more about the personality of our applicants and using this information in the application process. We also have a legitimate interest in testing cognitive skills of our applicants in case this is relevant and appropriate for a certain position.

Different service providers support us during the processing of your application data. The technical platform for managing applications is operated by Greenhouse (Greenhouse Software, Inc.,18 West 18th Street, 11th Floor New York, NY 10011, USA). Furthermore, it is also possible that you apply to us with your LinkedIn profile and that LinkedIn thereby receives information about your application. We also work with Predictive Index, LLC (101 Station Dr, Westwood, Massachusetts, 02090, USA) to provide the test to better understand your personality.

Additionally, we share data within the company group and the companies of the same country are recipients of the data. In case it becomes relevant for your application, we also share data with companies of the group located in other countries. This could, for example, be the case when you first applied in Germany but then decide that you would like to work from Austria.

Furthermore, disclosure may occur in connection with official inquiries, court orders and legal proceedings if it is necessary for legal prosecution or enforcement.

Greenhouse is certified under the EU-US Data Privacy Framework. The certification is available at the following URL: https://www.dataprivacyframework.gov/s/participant-search/participant-detail?id=a2zt00000004U1KAAU&status=Active. The legal basis for data transfers to Greenhouse in the USA is therefore the adequacy decision for the USA in conjunction with the certification.

LinkedIn provides information on how data is transferred by LinkedIn from the EU, the EEA, Switzerland and the UK at the following URL: https://www.linkedin.com/help/linkedin/answer/62533?trk=microsites-frontend_legal_privacy-policy&lang=en. LinkedIn is certified in accordance with the Data Privacy Framework (https://www.linkedin.com/help/linkedin/answer/a1343190?trk=microsites-frontend_legal_privacy-policy&lang=en-us&intendedLocale=de). Data transfers to the USA are based on the adequacy decision and LinkedIn's certification under the Data Privacy Framework.

We have signed standard data protection clauses with Predictive Index, LLC (101 Station Dr, Westwood, Massachusetts, 02090, USA). On request, we will provide you with a copy of the standard contractual clauses concluded with Predictive Index, LLC. Please contact us to receive a copy and mention that you wish to receive the standard contractual clauses entered into with Predictive Index, LLC.

We will store the information you provide for the duration of the application process.

If the application process is successful, your data will become part of the personnel file, as far as this is necessary and permissible, and stored during your employment with us.

If your application is unfortunately unsuccessful, your data will usually be stored for a maximum of 6 months after completion of the procedure. This serves, among other things, to enable us to defend ourselves against the rejection of your application in the event of a lawsuit. After this period, your information and documents will be deleted or returned to you.

If you have given us your consent to retain data after the application process has been completed, we will delete the data if we do not have a suitable opening for you in the foreseeable future or if you should withdraw your consent or after we request renewal of consent and you did not react.

In some cases, we may find a person's profile on a job-oriented platform interesting and store that person's profile in our recruiting tool. In such cases, we store your information for as long as you could potentially be of interest to us as a candidate and have not notified us that you no longer want us to consider you for upcoming open positions.

In addition, we also retain your data after the application process if

• we have reason to expect that further retention of your data might be necessary because of a future legal dispute with you,
• a legal dispute with you is certainly imminent, or
• a legal dispute is already taking place.

Your data will be stored until the conclusion of the related legal dispute and the expiry of any applicable retention periods.

Please see details on different data protection rights below.

We keep our privacy notice under regular review to make sure it is up to date and accurate.

Please check the data protection information before you apply in order to be up to date with possible changes or updates.