I- Introduction

This privacy policy (hereinunder the “Policy”) explains how Oetker Hotels and the Managed Properties (Hotels) process Personal Data of Candidates during the recruitment process through the Career site (the “Career Site”), in accordance with the Data Protection Regulation.

In this privacy policy, we explain how we process your Personal Data if:

1. You visit our Career Site (you being a “Visitor”)

2. You connect with us via our Career Site, to create a profile with us and receive information about current or future vacancies with us (you being a “Connecting Candidate”)

3. You apply for a position with us, via our Career Site or a third party service (you being an ”Applying Candidate”)

4. We collect information about you from other parties, sites and services, since we believe your profile is of interest for our current or future vacancies (you being a “Sourced Candidate”)

5. We receive information about you from our employees or partners, since they believe your profile is of interest for our current or future vacancies (you being a “Referred Candidate”)

6. We receive information about you from a Candidate, who lists you as their reference (you being a “Reference”).

This privacy policy also describes what rights you have when we process your Personal Data, and how you can exercise these rights.

When we use the term “Candidate” in this privacy policy, we are referring to each of Connecting Candidates; Applying Candidates; Sourced Candidates; and Referred Candidates, unless it’s stated otherwise.

II- Data Controller

The legal entity you have applied to, Oetker Hotels or the Managed Properties, is the independent Data Controller responsible for processing your Personal Data under the recruitment process. In certain circumstances, Oetker Hotels and the Managed Properties may operate as Joint Controllers for specific processing activities related to recruitment oversight and strategic decision-making.

III- Types of Personal Data Processed

In accordance with the applicable Data Protection Regulation, the local laws and practices, the following Personal Data may be processed through the Career Site:

All individuals

• Device information - If you visit our Career Site, we will collect information about your device, such as IP address, browser type and version, session behaviour, traffic source, screen resolution, preferred language, geographic location, operating system and device settings/usage.
• Technical and statistical data - If you visit our Career Site, we will collect technical and statistical data about your use of the site, such as information about which URLs you visit, and your activity on the site.
• Communications data - We will collect and store your communication with us, including the information you provided in the communication. This may include the content of emails, video recordings, messages on social media, the information you add to your account with us, surveys, etc.
• Contact details - Such as your name, email address, telephone number and physical address.

Candidates

• Data from interviews, assessments and other information from the recruitment process - Such as notes from interviews with you, assessments and tests made, salary requirements.
• Information in your application - Such as your CV, cover letter, work samples, references, letters of recommendation and education.
• Information in your public profile - Meaning the information we collect about you from public sources related to your professional experience, such as LinkedIn or the website of your current employer.
• Information provided by references - Meaning the information we receive from our employees or partners who refer you to us, or by the persons you have listed as your references. If you provide us with details of a reference or any third party as part of your application, you are responsible of informing the individuals concerned and, if necessary, obtain their consent to communicate their Personal Data to us.
• Any other data voluntarily provided during the recruitment process.

Only data that is adequate, relevant, and limited to what is necessary for recruitment purposes will be collected.

The mandatory information is marked with an asterisk on the forms (*). 

The Personal Data mentioned above may be received from different sources:

All individuals

• From the Career Site. If you visit our Career Site, we collect technical and statistical information about how you use the Career Site, and information from your device.
• Directly from you. Most of the information we process about you, we receive directly from you, for example when you apply for a position with us or connect with us. You can always choose not to provide us with certain information. However, some personal data is necessary in order for us to process your application or provide you the information you request to get from us.
• References. From the person for whom you are a reference. If a Candidate lists you as their reference, we will collect your contact details from the candidate to be able to contact you.

Candidates

• From public sources. We may collect personal data about you from public sources, such as LinkedIn or the website of your current employer.
• From our references. We may receive information about you from our employees or partners (such as recruitment service providers), when they believe your profile is of interest for our current or future vacancies.
• From your references. If you provide us with references, we may collect information about you from them.
• Data we create ourselves or in cooperation with you. Information about your application and profile is usually created by us, or by us in cooperation with you, during the recruitment process. This may for example include notes from interviews with you, assessments and tests made.

IV- Purposes & Legal Basis for Processing

The Candidate’s Personal Data may be processed for the purposes set out below, in accordance with the indicated legal basis.

*Please be advised that, in accordance with relevant local practices and applicable laws, the legal basis indicated in the above table may differ by country.

Virtual Interviews

As part of our recruitment process, Candidates may be invited to participate in virtual interviews. During these sessions, Oetker Hotels and the Managed Properties may collect Personal Data including audio/video recordings, interview notes, and technical metadata (e.g., IP address, device type). This data is processed solely for recruitment purposes, stored securely, and shared only with authorized personnel or service providers under confidentiality agreements. Candidates retain rights over their personal data in accordance with applicable data protection laws.

V- Data Sharing

Candidates’ Personal Data may be shared with the following recipients:

• Internally with the HR and hiring managers, and externally with the HR and hiring managers of the Managed Properties (Hotels).
• Third-party service providers acting as Data Processors (e.g., recruitment platform, personality assessment tools, etc.) framed with data protection agreements.
• Companies providing cookies on the Career Site. If you consent to it, cookies are set by other companies than us, who will use the data collected by these cookies in accordance with their own privacy policy. You can find information about which cookies this applies to in our Cookie Policy.
• Legal or regulatory authorities if required. We will share your personal data with authorities and other public actors when we have a legal obligation to do so.
• To parties involved in legal proceedings. If needed to protect or defend our rights, we share your personal data with public authorities or with other parties involved in a potential or existing legal proceeding. This can for example be in case of discrimination claims.

VI- Data Retention

Candidate data will be retained for a maximum of 12 months starting from the date of the creation of the Candidate account on the recruitment platform unless the Candidate requests deletion earlier. If hired, Candidate Personal Data will be transferred to the employee administrative file. The Candidate’s CV will be retained for up to 12 months from the date the Candidate account is created, and only with prior consent. 

The questions and/or complaints from the Candidates will be retained for a maximum of 12 months from the date of the question and/or complaint.

CCTV footage is kept for the period required by local laws, generally 30 days.

The data protection requests relative to the exercise of data protection rights are retained for the period required by local laws and practices, generally 12 months upon the request. As for the right to object, the request may be kept for 3 years.

As for the pre-litigation and litigation purposes, data is kept for the period required by local laws.

VII- Data Transfers Outside the EEA

As Oetker Hotels and the Managed Properties are international companies, Personal Data of Candidates may be transferred to countries outside the European Economic Area (EEA). These transfers will only occur when:

- The recipient country has been recognized by the European Commission as providing an adequate level of data protection.

- Appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission.

- With the explicit consent of the Candidate for the transfer.

Oetker Hotels and the Managed Properties ensure that all data transfers comply with applicable Data Protection Regulation, and that Candidates’ Personal Data remains protected regardless of its location.

VIII- Security Measures

Oetker Hotels and the Managed Properties ensure that Candidates’ Personal Data is secured, and that the appropriate technical and organizational measures are implemented to protect Personal Data against unauthorized access, alteration, or loss.

IX- Candidate Rights

Candidates have the following rights guaranteed by and under the limit of the applicable Data Protection Regulation:

• the right of access by the data subject;
• the right to rectification;
• the right to erasure (“right to be forgotten”)
• the right to object;
• the right to restriction of processing;
• the right to data portability.

* Please note that these rights may be different depending on the Data Protection Law applicable.

*The rights listed above are defined in the “Terminology” Section.

Candidates may exercise these rights either directly through the Carrer Site or by contacting the Data Protection Team at the following address: privacy@oetkerhotels.com.

X- Updates to This Policy

We may update this Policy to reflect changes in legal requirements or recruitment practices.

XI- Terminology

Data Protection Regulation: refers to a set of legal frameworks that govern processing of personal data to ensure individuals' privacy rights are respected and protected. These regulations include but are not limited to the EU General Data Protection Regulation (“GDPR”) and its UK counterpart (“UK GDPR”), the California Consumer Privacy Act (“CCPA”) in United States, the Brazil’s Lei Geral de Proteção de Dados (“LGPD”) in Brazil, etc.

Personal Data: means any information relating to an identified or identifiable natural person (hereinafter referred to as "data subject").

Processing: means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

Right of access: allows a data subject to obtain confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, to have access to said data (in an understandable format) and to know the methods of data processing (purpose, recipients, storage period, etc.)

Right to rectification: allows a data subject to obtain the rectification of personal data concerning him or her that are inaccurate, and also to complete them if they are incomplete.

Right to erasure (“right to be forgotten”): allows a data subject, under certain conditions, to obtain the erasure of personal data concerning him or her. The person will have to indicate precisely what data he or she wishes to erase.

Right to restriction of processing: allows a data subject to obtain the restriction of processing; that means to temporarily "freeze" the use of personal data concerning him or her.

Right to data portability: allows a data subject to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format. This right allows data to be retrieved for personal use, in order to store it on a device or a private cloud, for example. It also allows the data subject to transmit those data from one organization to another. The personal data can thus be transmitted to a new body: either by the person himself or directly by the body holding the data, if this direct transfer is "technically possible".

Right to object: allows a data subject to object at any time to the processing of personal data concerning him or her and necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, or necessary for the purposes of the legitimate interests pursued by the controller.

Right to object to an automated individual decision-making, including profiling: allows a data subject not to be subject to a decision based solely on automated data processing (including profiling) which produces legal effects concerning him or her or similarly significantly affects him or her.

Right to lodge a complaint with a supervisory authority: allows a data subject to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes the data protection regulation.