(this English version is a translation from the original German version)

Privacy Policy for the Use of the Cammio Video Recruitment Platform within d.vinci Applicant Tracking System

With this privacy policy, Cammio GmbH, Gehrtsstr. 14, 40235 Düsseldorf (hereinafter also referred to as “Cammio,” “we,” “our“) informs you about the collection, use, and processing of personal data when using the Cammio Video Recruitment Platform within d.vinci Applicant Tracking System (hereinafter also referred to as the “platform”). 

1. Definitions

This privacy policy is based on the definitions provided in Article 4 of the General Data Protection Regulation (GDPR): 

• “Personal data” (Article 4 (1) GDPR) refers to any information relating to an identified or identifiable natural person (“Data Subject”). An individual is considered identifiable if they can be directly or indirectly identified, particularly by reference to an identifier such as a name, an identification number, location data, or other factors specific to their physical, physiological, genetic, mental, economic, cultural, or social identity. Identifiability can also result from the combination of such information or other available knowledge. The form or embodiment of the information is not relevant (including photos, videos, or audio recordings that may contain personal data). 

• “Processing” (Article 4 (2) GDPR) encompasses any operation or set of operations which is performed on personal data, whether or not by automated means. This includes collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment, restriction, erasure, or destruction of personal data, as well as any changes to the purpose or processing methods originally intended. 

• “Controller” (Article 4 (7) GDPR) refers to the natural or legal person, authority, body, or agency that, alone or jointly with others, determines the purposes and means of the processing of personal data. 

• “Third party” (Article 4 (10) GDPR) means any natural or legal person, public authority, agency, or body other than the Data Subject, the Controller, the Processor, and the persons who, under the direct authority of the Controller or the Processor, are authorized to process personal data; this includes other legal entities within the same group. 

• “Processor” (Article 4 (8) GDPR) is a natural or legal person, public authority, agency, or other body that processes personal data on behalf of the Controller, especially in accordance with their instructions (e.g., IT service providers). In data protection terms, a Processor is not considered a Third party. 
  
  

• “Consent” (Article 4 (11) GDPR) given by the Data Subject means any freely given, specific, informed, and unambiguous indication of the Data Subject’s wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them. 

For the sake of readability, this privacy policy refrains from gender-specific differentiation. Corresponding terms apply equally to all genders. 

2. Name and Address of the Controller

The entity responsible for processing your personal data in accordance with Article 4 (7) GDPR is: 

Cammio GmbH, Gehrtsstr. 14, 40235 Düsseldorf,
Telefon: +49 211 934935920,
info@cammio.com

You can find further information about our company in the legal notice on our website: https://cammio.com/de/impressum/. 

3. Contact details of Data Protection Officer

Our Data Protection Officer is available to answer all your questions regarding data protection at any time. You can contact our Data Protection Officer using the following contact details: 

Bas Dirkse
info@cammio.com

4. Legal basis for Data Processing

We process your personal data in accordance with the GDPR regulations and any applicable national laws, including the German federal Data Protection Act (hereinafter referred to as “Data Protection Regulations”). 

In accordance with these data protection regulations, we process your personal data only if at least one of the following legal bases applies to the respective data processing: 

• The data subject has given their consent to the processing of their personal data for one or more specific purposes (Article 6 (1) lit. b GDPR). 

  Where we have obtained your consent for the processing of your personal data for specific purposes, the processing of data is lawful based on your consent. You have the right to withdraw your consent at any time, as described in Section 10.4 below. 
  
  

• Processing is necessary for the performance of a contract to which the data subject is a party or to take steps at the request of the Data Subject prior to entering a contract (Article 6 (1) lit. b GDPR). 

  The processing of personal data, as described in this privacy policy, is carried out to provide the video platform within the framework of the respective usage agreements or to perform pre- contractual measures. 
  
  

• Processing is necessary for compliance with a legal obligation to which the controller is subject to (Article 6 (1) lit. c GDPR). 

  We are subject to various legal obligations that require us to process personal data, including compliance with tax and accounting regulations. 
  
  

• Processing is necessary to protect the vital interests of the data subject or of another natural person (Article 5 (1) s. 1 lit. d GDPR). 
  
  

• Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (Article 6 (1) s. 1 lit. e GDPR). 
  
  

• Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, which require protection of personal data (Article 6 (1) lit. f GDPR). 

In cases where we explicitly state in this privacy policy, we process your personal data to safeguard our legitimate interests or those of a third party, provided that these legitimate interests do not override your rights and the data processing is necessary to fulfill these legitimate interests. In such cases, we have conducted an assessment of the legitimate interests, evaluating the consequences and guarantees.

5. Use of the platform

When using and utilizing the platform within the d.vinci applicant tracking system, we will process your personal data in accordance with this section.

5.1 Access to the platform

For using the platform as an employee of a company that utilizes the video platform within the d.vinci applicant tracking system, creating a user account is not required. Interaction between the d.vinci applicant tracking system and the platform takes place through a technical interface. 

If you, as an applicant, are invited by a recruiting company, using the platform within their recruitment processes, to record an application video (asynchronous interview), the following data about you will be processed: 

• User-ID

An individual link for you is created within the platform, granting you access to your interview. This link is sent to you via an email from the.vinci applicant tracking system. A user account is not created for you. 

The processing of personal data collected as part of accessing the platform is carried out to fulfil the usage contract between Cammio and you. The legal basis for data processing is Article 6 (1) lit. b GDPR).

5.2 Use of the platform

If you use the platform as an employee of a company or a potential employer, you can access submitted applicant videos through your d.vinci applicant tracking system to take them into account for your hiring decisions and to structure your recruitment process.  

If you use the platform within the d.vinci applicant sracking System as an applicant, you can use it to record application videos to introduce yourself or answer questions from your potential employer. You can also use the video platform to send your application videos to your potential employer. We process the following personal data to provide the functions of the video platform  

• User-ID

• Uploaded video file(s), if applicable

• Browser used

The processing of the content uploaded by the respective users and the other personal data is carried out for the execution of the user contract between you and Cammio. The legal basis for data processing is Art. 6 (1) lit. b GDPR. 

6. Use of Cookies

The platform uses cookies. Cookies are small text files that are stored on your end device. These text files can be read by the platform and help to identify you when you visit a website again. Some cookies are used to store preferences and are deleted after the end of the browser session, i.e. after closing the browser, so-called session cookies. Other cookies are used to better adapt the website to user needs and remain on the end device, so-called permanent or persistent cookies. Below we explain which cookies we use.

We only use the following cookies, which are absolutely necessary to make our platform available to you:

The legal basis for the use of these cookies is Art. 6 (1) sentence 1 lit. f GDPR. 

7. Data deletion and Data storage duration

In principle, we only process and store your personal data for as long as is necessary for the fulfilment of our contractual and legal obligations. This means that if the data is no longer required for the fulfilment of contractual or legal obligations, it will be deleted.

This does not apply if further processing and storage is necessary for the following purposes: 

• Compliance with retention periods under commercial and tax law, which result in particular from the following laws and supplementary regulations: German Commercial Code and the German Fiscal Code. The retention and documentation periods specified there are two to ten years. The respective legal basis is Art. 17 (3) lit. b GDPR in conjunction with Art. 6 (1) lit.  

• Preservation of evidence within the framework of the statute of limitations. According to the provisions of the German Civil Code (BGB), these limitation periods can be up to 30 years, whereby the regular limitation period is three years. The respective legal basis for this is Art. 17 (3) lit. e GDPR in conjunction with Art. 6 (1) lit. f GDPR. 

• For applicant videos provided by the Cammio video recruiting platform in the d.vinci applicant tracking system, a data retention period of 180 days applies. At the end of this data retention period, the video files are automatically and irrevocably destroyed. During this period, the video file can be used for recruitment processes by the recruiting company using the platform within the d.vinci applicant tracking system. 

8. Data Security

We use appropriate Technical and Organizational Measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or against unauthorized access by third parties (e.g. TLS encryption for communication with the platform), taking into account the state of the art, the implementation costs and the nature, scope, context and purpose of the processing as well as the existing risks of a data breach (including its probability and impact) for the data subject. Our security measures are continuously improved in line with technological developments. We will be happy to provide you with more detailed information on request. Please contact our data protection officer (info@cammio.com). 

9. Cooperation with processors and disclosure to third parties

Some of our data processing may be carried out by a third party on behalf of Cammio. If the processing of personal data is carried out on our behalf, we conclude a separate contract with the respective processor in accordance with Art. 28 GDPR. In detail, we use the following processors. 

9.1 Hosting

For the purposes of hosting the platform, we use processors so that personal data stored via our Platform is transmitted to these processors. This processor is Cammio B.V., Spui 1, 2511 BL The Hague, Netherlands (EU). (Personal) data is stored exclusively in a German data centre in “Frankfurt am Main”. 

9.2 Disclosure to third parties

Unless otherwise stated in this privacy policy, we will only transfer your personal data to third parties if the transfer is necessary to fulfill our contractual obligations to you and this is clearly done with or together with another provider, if we are otherwise legally entitled or obliged to pass it on, or if you have given us your consent to do so. 

10. Your rights as Data Subject

You, as a Data Subject, have the following rights in regard to your personal data: 

10.1 Information and rectification (Art. 15 and 16 GDPR) 

You can obtain information from us at any time and free of charge as to whether personal data relating to you is being processed by us and specifically which data about you is being stored and request a copy of the stored data. You can also have incorrect data corrected and completed. 

10.2 Deletion, Restriction and the Right to be Forgotten (Art. 17 GDPR) 

You can request the erasure and restriction of your personal data. If deletion of your personal data conflicts with statutory retention obligations, your data will be marked with the aim of restricting its future processing.

10.3 Data Portability (Art. 20 GDPR) 

Where applicable, you also have the right to have the personal data concerning you transmitted to you or to another controller in a structured, commonly used and machine-readable format, provided that the processing is based on consent or on a contract and is carried out by automated means. However, this does not apply if the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. You also have the right to have the personal data transmitted directly from one controller to another, where technically feasible and if this does not adversely affect the rights and freedoms of others. 

10.4 Withdrawal and Objection (Art. 21 GDPR) 

You can revoke your consent at any time with effect for the future at the above contact address. 

You also have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on a legitimate interest. This also applies to profiling based on these provisions. In the event of an objection, we will no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims. 

If we process personal data for the purpose of direct marketing, you have the right to object at any time to the processing of personal data for the purpose of such marketing by contacting us at the above address. This also applies to profiling insofar as it is associated with such direct advertising. You also have the right to object, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out by us for scientific or historical research purposes or for statistical purposes, unless such processing is necessary for the performance of a task carried out in the public interest. 

#### 10.5 Right of Complaint (Art. 77 DSGVO)

You also have the right to lodge a complaint with the competent supervisory authority and to seek legal remedies. The supervisory authority to which the complaint has been submitted will inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy. The competent supervisory authority for us is the Berlin Commissioner for Data Protection and Freedom of Information, https://www.datenschutz-berlin.de/.  

11. Adjustments to this Data Privacy Policy

We reserve the right to amend this privacy policy in accordance with updates to our platform or regulatory developments. We will inform you about changes to this privacy policy in accordance with the statutory provisions. This privacy policy was last updated on 11.01.2024.