Privacy policy

Version: 13.02.2026

Information on the collection of personal data of applicants and temporary workers within Trenkwalder Personaldienste GmbH

This privacy policy describes how we collect, use and process your personal data and how we comply with our legal obligations towards you in doing so. Your privacy is important to us and we have made it our mission to protect and safeguard your rights.

1. Controller and Data Protection Officer

The controller within the meaning of the GDPR is:

Trenkwalder Personaldienste GmbH, Werner-Eckert-Strasse 6, 81829 Munich

Email: infogermany@trenkwalder.com

Telephone: 089 991999-0

Data protection officer:

Ms. Helene Yagolnitser

Address: Werner-Eckert-Strasse 6, 81829 Munich

Email: h.yagolnitser@trenkwalder.com

2. Scope

This information applies to applicants for positions advertised by us (internal and with clients) and temporary workers employed by us. It explains how we process personal data in the application and temporary employment relationship, especially in the case of AI-supported evaluation of applicant data.

3. Categories of personal data

Depending on the phase, we process in particular:

• Master data and contact details: name, address, contact details, date of birth, nationality, work permit.

• Application and qualification data: CV, certificates, qualifications, professional experience, language skills, salary expectations and availability.

• Data from the selection process: our interview notes, evaluations, internal communication regarding the application process.

• Data from the temporary employment relationship: contract data, place of work, working hours, remuneration data, holiday and absence data, perfor-mance appraisals.

• Special categories (only if provided by you or required by law): e.g. health da-ta (severe disability, employability), religious affiliation for tax purposes.

• IT/usage data: e.g. IP address when visiting our website or using the applica-tion portal, log data.

We usually receive these data directly from you (application, communication). Addi-tionally, data may be obtained from public sources (e.g., professional networks, job portals) or from third parties (e.g., references, recruitment agencies), insofar as this is permissible for the application process.

4. Purposes and legal basis for data processing

4.1 Application and hiring process

We process your data to make pre-contractual decisions regarding the establishment of an employment or service relationship, in particular for:

• Review and evaluation of your application,

• Communication with you,

• Planning and conducting job interviews,

• Documentation of the decision.

Legal basis: Article 6 para. 1 lit. b GDPR (General Data Protection Regulation) in conjunction with § 26 para. 1 BDSG (Federal Data Protection Act), (initiation of an employment relationship); insofar as special categories of personal data are con-cerned, Article 9 para. 2 lit. b GDPR in conjunction with § 26 para. 3 BDSG.

4.2 Temporary employment

In the context of your existing employment, we process your data for, among other things:

• Implementation and processing of the employment contract (payroll account-ing, deployment planning, working time documentation),

• Fulfilment of legal obligations (e.g. tax and social security reporting obliga-tions),

• Personnel development, training, internal administration.

Legal basis: Article 6 para. 1 lit. b GDPR, § 26 BDSG (employment relationship), Arti-cle 6 para. 1 lit. c GDPR (legal obligations), where applicable, Article 6 para. 1 lit. f GDPR (legitimate interest, e.g., IT security, enforcement of legal claims).

4.3 Processing of applicant data supported by Artificial Intelligence (AI)

In order to make our application process more efficient, we occasionally use the ‘Matching AI’ system. This system automatically evaluates applications based on predefined, objective criteria (e.g. qualifications, certificates) and makes a recom-mendation. The final decision is always made by a recruiter – there is no exclusively automated decision within the meaning of Art. 22 GDPR. Depending on the individual case, processing is carried out on the basis of Art. 6 (1) b GDPR (pre-contractual measures) and/or Art. 6 (1) f GDPR (legitimate interests) and, where applicable, in conjunction with § 26 BDSG. The processes are based on the requirements of the GDPR and, where applicable, the EU AI Regulation. You can exercise your rights un-der Art. 15 ff GDPR at any time, request a human review of the preliminary assess-ment and obtain information on how the recommendation was made.

The AI software is operated exclusively on the IT infrastructure of Trenkwalder Per-sonaldienste GmbH or a bound processor within the European Union. Your applicant data will not be transferred to Google or other external AI providers.

Consent is voluntary. It can be revoked at any time with future effect by contacting Trenkwalder, info@trenkwalder.com. In the event of revocation, your application will continue to be processed without AI support; this will not disadvantage you in the ap-plication process.

Legal basis:

for the use of AI within the framework of the pre-contractual selection process:

• Article 6 para. 1 lit. b GDPR, § 26 para. 1 BDSG (required for the application process),

• Additionally your consent pursuant to Article 6 para. 1 lit. a GDPR (see con-sent text below).

4.4 Talent pool / longer storage

If you consent, we will add your data to our applicant pool after the completion of the specific process in order to contact you later about suitable positions.

Legal basis: Article 6 para. 1 lit. a GDPR, § 26 para. 2 BDSG (consent).

4.5 Advertising / Newsletters / Surveys (optional)

We will only use your contact details to send you information about job offers, promo-tions or surveys with your explicit consent.

Legal basis: Article 6 para. 1 lit. a GDPR.

5. Recipients of the data

Depending on the process, we transmit data to:

• Client companies where you are to be/will be deployed,

• Internal specialist departments (recruiting, HR, payroll, IT),

• Data processors (e.g., data centre/hosting service providers, applicant man-agement software providers, AI software, payroll service providers),

• Public bodies and authorities, insofar as required by law (e.g. tax office, social security institutions),

• Consulting service providers (e.g. tax advisors, lawyers), if required.

We conclude contracts with data processors in accordance with Article 28 GDPR.

6. Third-country transfer

We process your data in countries of the European Union or the European Economic Area.

No data are transferred to Google or other non-European AI providers as part of the AI processing.

Should a transfer to a third country be necessary in individual cases (e.g., IT service providers), this will only take place in compliance with Article 44 et seq. GDPR (e.g. adequacy decision or EU standard contractual clauses). In this regard, reference is made to point 11.3, which represents a special regulation for interviews.

7. Storage duration

With your consent to be included in the applicant pool, we will store your data. The purpose of the data processing, namely continuously to process applicant data for future job offers, remains unchanged.

We store data from the employment relationship in accordance with the statutory retention periods (in particular commercial, tax, and social security law usually 6–10 years).

8. Obligation to provide data

You must provide the personal data that are necessary for the decision on establish-ing an employment relationship or the execution of the employment contract, or which we are legally obliged to collect. Without these data, we cannot process your application.

Consent to AI processing, talent pool, advertising or WhatsApp communication is voluntary.

9. Automated decision making

No purely automated decision-making, including profiling within the meaning of Article 22 of the GDPR, takes place that has legal effect or significantly affects you in a simi-lar manner. AI serves solely to support human decision-makers. The final decision always rests with the human.

10. Rights of data subjects

Under the legal conditions, you have the following rights:

• Information (Article 15 GDPR),

• Correction (Article 16 GDPR),

• Deletion (Article 17 GDPR),

• Restriction of processing (Article 18 GDPR),

• Data portability (Article 20 GDPR),

• Objection to data processing based on Article 6 para. 1 lit. f GDPR (Article 21 GDPR),

• Revocation of consents given with effect for the future (Article 7 para. 3 GDPR),

• Right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR).

Please direct your enquiries to the contact details listed above.

11. Online applications / video interviews (optional)

11.1. General information/voluntary participation

In addition to personal interviews at our offices, we offer our applicants the option of conducting an interview online. To do so, we use the Microsoft solutions Skype, Teams, Zoom or WhatsApp.

Participation in online interviews is voluntary. You may discontinue the interview at any time, decline further interviews, and withdraw your consent to participate in the online interview without incurring any disadvantages. Online interviews are not rec-orded or saved.

It should be noted that the Trenkwalder Group also offers you the opportunity to take part in the interview in the form of a personal interview on site or as a telephone call. Should you choose to have a personal interview on site or a telephone interview, this will not have any negative impact on your application.

As part of our application process, we sometimes use an automated initial telephone interview using a computer-generated voice (AI). Your answers will be recorded elec-tronically and forwarded exclusively to our recruiting team for further processing. There is no automated decision-making.

The interview will only be conducted by employees responsible for filling vacancies within the Trenkwalder Group. These employees ensure, within the scope of the in-tended use, that the confidentiality of your personal data is maintained. Ensuring the highest possible protection of your personal data is important to the company. All personal data collected and processed by us as part of an application is protected against unauthorised access and manipulation by technical and organisational measures.

11.2. Processed data/legal basis/revocation

The categories of personal data processed as part of the Teams interview include: name, image transmission (and, therefore, the transmission of your face), transmis-sion of your voice. The online interview will not be recorded or stored.

Furthermore, the following personal data are collected by the system when using Microsoft Teams/Skype: IP addresses, email addresses, names, log files, log data, metadata (e.g. IP address, time of participation, etc.), profile data (e.g. your user name, if you provide this information on a voluntary basis).

Data processing as part of the Teams interview is based on the consent you have given, which can be revoked at any time for the future, Article 6 para. 1 sentence 1 lit. a GDPR.

You have the option at any time to discontinue an interview, decline further inter-views, and withdraw your consent to participate in the Teams or Zoom interview with-out incurring any disadvantages. You can submit your revocation by email.

We also process the data collected by the system on the basis of a legitimate inter-est in accordance with Article 6 para. 1 sentence 1 lit. f GDPR. Our legitimate inter-est for data processing is: conducting online interviews.

11.3. Data transfer

We use Teams to conduct the online interviews. Microsoft Teams is part of Microsoft Office 365. Microsoft Teams is a productivity, collaboration and exchange platform for individual users, teams, communities and networks that is used across company or-ganisations. It includes a video conferencing function.

Microsoft Office 365 is software from Microsoft Ireland Operations Limited, One Mi-crosoft Place, South County Business Park, Leopardstown, Dublin 18 D18 P52, Ire-land.

Microsoft Teams is part of the Office 365 cloud application, for which a user account must be created.

The data processing with Office 365 takes place on servers in data centres in the European Union in Ireland and the Netherlands. We have concluded a data pro-cessing agreement with Microsoft in accordance with Article 28 GDPR. Accordingly, we have agreed on extensive technical and organisational measures with Microsoft for Office 365, which comply with the current state of the art in IT security, e.g. with regard to access rights and end-to-end encryption concepts for data lines, databases and servers.

There are EU standard contracts (standard data protection clauses) in place with Microsoft in the event of access by Microsoft from outside the European Union in individual cases authorised by us. We have implemented additional measures as de-scribed above in the form of state-of-the-art technical and organisational measures, such as access authorisation and encryption concepts for data lines, databases and servers, to guarantee an appropriate level of data protection when transferring per-sonal data to a third country, such as the USA, in this specific case.

Microsoft reserves the right to process customer data for its own legitimate business purposes. We have no influence on this data processing by Microsoft. To the extent Microsoft Teams processes personal data in connection with legitimate business pur-poses, Microsoft is an independent controller for these data processing activities and as such is responsible for compliance with all applicable data protection regulations. Please refer to the relevant Microsoft policy if you require information about pro-cessing by Microsoft.

For the technical implementation of the automated initial telephone interview, we use a specialised data processor: Eleven Labs Inc., a company incorporated in Delaware, United States with an address at 169 Madison Ave #2484 New York, NY 10016, Uni-ted States (“ElevenLabs”)

Data processing is carried out exclusively on our behalf and with strict adherence to confidentiality. The data processor is contractually obligated to process the data ex-clusively for the purpose for which they was transmitted to it and not to use them for its own purposes. The data will not be transmitted to unauthorised third parties.

11.4. Application via WhatsApp (PitchYou)

If you use our application-via-WhatsApp function, the legal basis for the communica-tion is your consent, which can be revoked at any time (Article 6 para. 1 a GDPR). The application-via-WhatsApp function is provided to us by the IT service provider PitchYou of SBB Software und Beratung GmbH in Germany, Bahnhofstrasse 7, 95119 Naila, Germany, which may access your data as a data processor for this purpose. A data processing contract has been concluded with PitchYou in accord-ance with Article 28 GDPR.

PitchYou provides multi-stage deletion to protect the rights of data subjects. Never-theless, we would like to point out that we have no influence on data processing by WhatsApp. Data processing is subject to WhatsApp’s privacy policy, which you must agree to in advance. We would hereby like to point out that the information you pro-vide will be stored and processed in the USA. We would also like to point out that data processing by WhatsApp is associated with security risks. The USA is currently regarded as a country with an inadequate level of data protection by EU standards. In particular, there is a risk that your data may be processed by US authorities for control and monitoring purposes without you being informed about this data pro-cessing and without you having the option of a legal remedy against this data pro-cessing by the US authorities.

The legal basis for processing is the voluntary consent given to us within the mean-ing of Article 6 para. 1 sentence 1 lit. a GDPR in conjunction with § 26 BDSG for the purpose of carrying out the application process.

You may revoke the consent expressly given above at any time with effect for the future by sending us a message via WhatsApp. The legality of any processing that takes place before you revoke your consent will not be affected.

Information on WhatsApp’s privacy policy: https://www.whatsapp.com/legal?eea=0#privacy-policy

Further information on PitchYou’s privacy policy can be found at: https://www.pitchyou.de/datenschutz as well as

https://www.pitchyou.de/pitchyou-dsgvo

Information on consenting to the use of WhatsApp can be found at: https://www.pitchyou.de/datenschutz-whatsapp

11.5. Sinch AB

We use a tool from Sinch AB to communicate with you via a messenger service (WhatsApp). Communication only takes place if the person applying to us sends a corresponding opening message and it is voluntary. By sending an opening mes-sage, you agree to the validity of our data protection provisions. In particular, you consent to your personal data (surname and first name, telephone number, messen-ger ID, IP address, profile picture and message history) being stored, processed and used to send messages to you as part of the use of the respective messenger ser-vice (WhatsApp).

We use Sinch AB, Lindhagensgatan 74, 11218 Stockholm, Sweden as a technical service provider and data processor for the provision of this communication service. Further information can be found in the respective privacy policies of the messenger service (WhatsApp, https://www.whatsapp.com/legal/privacy-policy-eea) and Sinch AB (https://www.sinch.com/privacy-notice/).

The legal basis for processing is the voluntary consent given to us within the mean-ing of Article 6 para. 1 sentence 1 lit. a GDPR in conjunction with § 26 BDSG for the purpose of carrying out the application process.

Communication and document exchange via WhatsApp is always voluntary and is only one possible option. It is always possible to communicate via other communica-tion channels (e.g. email). Consent can be revoked at any time with effect for the future directly via the respective WhatsApp chat.

Information on data protection when using Sinch AB and WhatsApp can be found at https://www.whatsapp.com/legal/privacy-policy-eea and https://www.sinch.com/de-de/products/apis/messaging/whatsapp/

The privacy policy of Sinch AB can be found at https://www.sinch.com/privacy-notice/