Privacy Policy for Applicants
CDM Smith SE (hereinafter referred to as "we" or "CDM") takes the protection of your personal data very seriously. We therefore wish to inform you, in accordance with the relevant data protection regulations, in particular the General Data Protection Regulation (GDPR), about the collection, processing, and use of your data in connection with your application.
1. Controller
The controller responsible for data processing is
CDM Smith SE
Human Resources
Am Umweltpark 3-5
44793 Bochum
Email: bewerbungen@cdmsmith.com
2. Data Protection Officer
You can contact the external data protection officer at
Scheja & Partners GmbH & Co. KG
Attorney Boris Reibach
Adenauerallee 136
53113 Bonn
Tel.: (+49) 0228-227 226 0
Encrypted contact form:
https://www.scheja-partners.de/kontakt/kontakt.html
3. Purposes of data processing
3.1 Application process
We collect your personal data directly from you via the contact method you have chosen to submit your application. This does not apply to the cooperation with personnel service providers as described in section 3.5.
The following application data is collected and processed as part of the online application process:
Title, first name, last name, email address, cover letter, resume, photo (optional), references and certificates (proof of employment, proof of qualifications etc.).
Your personal application data is collected and processed exclusively for the purpose of recruiting staff for open positions within our company.
Data processing for the purpose of carrying out the application process is based on Art. 6 (1) lit. b) of the General Data Protection Regulation (GDPR). We process special categories of personal data (Art. 9 (1) GDPR) on the basis of § 26 (3) sentence 1 of the Federal Data Protection Act (BDSG), Art. 9 (2) lit. b) GDPR, if applicable.
3.2 Defense in legal disputes
We may also process this data to enable defense in legal disputes. Any such data processing is based on Art. 6 (1) (f) GDPR (balancing of interests). The legitimate interests lie in being able to prove the lawful conduct of the application process in any proceedings. In this context, we may process special categories of personal data on the basis of Art. 9 (2) lit. f) GDPR.
3.3. Consideration of your application for other open positions
If you have given us your consent to do so, we may also process the data you have provided in order to assess your suitability for other open positions with us and to contact you accordingly.
This data processing is carried out on the basis of Art. 6 (1) lit. a) GDPR (consent) in conjunction with § 26 (2) BDSG. If we also process special categories of personal data on the basis of your consent, the data processing is carried out on the basis of Art. 9 (2) lit. a) GDPR in conjunction with § 26 (2), (3) BDSG.
You have the right to withdraw your consent at any time. We will then no longer process your personal data on the basis of your consent. However, the withdrawal does not affect the lawfulness of such processing that has already taken place on the basis of consent prior to the withdrawal. It therefore remains lawful even after the withdrawal. You can withdraw your consent using the contact details of the controller provided above.
We store your consent after withdrawal in order to comply with our legal obligations to provide evidence and to protect our legitimate interest in being able to prove consent in a legal dispute. The legal basis for this processing is Art. 6 (1) lit. c) in conjunction with Art. 5 (1) lit. a), (2), Art. 7 (1) GDPR or Art. 6 (1) lit. f) GDPR. In doing so, we pursue the legitimate interest of being able to prove that consent has been given.
3.4 Talent pool
If your application has not led to employment with us and you have allowed us to include your application data in our talent pool for future job openings, we will also process your personal data so that we can consider you for future jobs and contact you, as well as to be able to prove your consent in this regard. Your personal data will be stored in the talent pool for a maximum of one year.
Data processing for inclusion in the talent pool is based on Art. 6 (1) lit. a) GDPR (consent) in conjunction with § 26 (2) BDSG. If we also process special categories of personal data on the basis of your consent, data processing is carried out on the basis of Art. 9 (2) lit. a) GDPR in conjunction with § 26 (2), (3) BDSG.
You have the right to withdraw your consent at any time. We will then no longer process your personal data on the basis of your consent. However, the withdrawal does not affect the lawfulness of such processing that has already taken place on the basis of consent prior to the withdrawal. It therefore remains lawful even after the withdrawal. You can withdraw your consent using the contact options provided above.
We store your consent after withdrawal in order to comply with our legal obligations to provide evidence and to protect our legitimate interest in being able to prove consent in a legal dispute. The legal basis for this processing is Art. 6 (1) lit. c) in conjunction with Art. 5 (1) (a), (2), Art. 7 (1) GDPR or Art. 6 (1) lit. f) GDPR. In doing so, we pursue the legitimate interest of being able to prove that consent has been given.
3.5 Cooperation with personnel service providers
In some cases, we work with external personnel service providers from whom we receive your data. Data processing includes the purposes and data categories mentioned in section 3.1.
Data processing is carried out on the basis of Art. 6 (1) lit. b) GDPR. We process special categories of personal data (Art. 9 (1) GDPR) on the basis of § 26 (3) sentence 1 BDSG, Art. 9 (2) lit. b) GDPR, if applicable.
If the referral by a personnel service provider leads to an employment relationship with us, we will inform our partner of this, stating your name and the relevant salary information. This is done in order to fulfill our information obligations towards the personnel service provider. The legal basis for the transfer of data is Art. 6 (1) lit. f) GDPR, whereby our legitimate interest is the aforementioned purpose.
If your data is transferred to a partner outside the EEA, the requirements of Art. 49 (1) lit. b) and lit. c) GDPR are met, unless an adequacy decision already exists (Art. 45 GDPR).
3.6 Analysis
In addition, we would like to point out that the data you provide may be used to compile statistics on the (online) application process. These statistics are compiled exclusively for our own purposes and are never personalized, but rather in anonymized form.
3.7 Processing in the context of video and audio conferencing systems
During the course of your application process, we may conduct interviews as "online meetings." We process your data in connection with the use of the Microsoft Teams video and audio conferencing system we use.
Various categories of data are processed when using this service provider. We use the contact details provided to us in your application to send you invitations. These include, in particular, your name and email address. We also process information that you provide when participating in the online meeting. If this data is linked to your person, it is also personal data. This can include, for example, chat data, posts, and content and documents shared by you during the online meetings. In addition, depending on the medium used, further data (so-called metadata) such as your IP address is collected when you participate in the online meeting.
We only process this data to the extent necessary to conduct the online meeting and to enable the online meeting to run smoothly. Online meetings for the purpose of conducting the application process are based on Art. 6 (1) lit. b) GDPR. We process special categories of personal data (Art. 9 (1) GDPR) on the basis of § 26 (3) sentence 1 BDSG, Art. 9 (2) lit. b) GDPR, if applicable. Data processing for the technical implementation of the online meeting is based on Art. 6 (1) lit. f) GDPR.
If you visit the Microsoft Teams website or download the necessary application from the provider's website in order to participate in the online meeting, Microsoft is responsible for data processing. With regard to the processing of personal data by the provider, we refer you to their privacy policy: https://learn.microsoft.com/en-us/microsoftteams/Teams-overview
4. Retention period
If an employment relationship is established between you and us, we will not completely delete the data from your application process, but will add it to your personnel file to the extent necessary. We will then process this data for the purpose of implementing the employment relationship. We will inform you about this in more detail in a separate form.
If your application is not successful, we will either continue to store your application data based on your consent to be included in our talent pool, or delete it no later than six months after the end of your application process.
If you have given us your consent to be included in the talent pool, we will store your data for a maximum of one year after the end of your application process. If you withdraw your consent beforehand, we will delete your data immediately.
We will delete your personal data that we process as proof of your consent 3 years after the end of the year in which you withdraw your consent or it expired.
5. Obligation to provide data and consequences of non-provision
You are not contractually or legally obliged to provide us with personal data for the aforementioned purposes. However, the provision of data, in particular the mandatory information from the online form, is necessary for the application process via this application channel and for the decision on the conclusion of an employment contract. If you do not provide us with all the personal data required for the application process when you apply, we will not be able to consider you in the application process.
However, if you do not allow us to include your application data in our talent pool for future job postings or if you do not wish to be considered for other open positions, we will not be able to process your personal data in order to consider you for future job postings or current comparable positions and to contact you.
6. Data recipients
The following categories of recipients may access your data to the extent necessary in each case:
- Internal recipients; your data will generally only be forwarded to the internal departments and specialist departments of the company that advertised the position and are responsible for the specific application process.
- External recipients, which may include:
- Processors; external service providers that we use to provide services, for example, we use d.vinci for our recruiting tool.
We carefully select and regularly review processors to ensure that your personal data remains protected. Service providers may only use the data for the purposes specified by us. - Public authorities; authorities and state institutions, such as public prosecutors, courts, or tax authorities, to whom we must transfer personal data for legally compelling reasons.
- Non-public bodies; personnel service providers, dealers, or auxiliary persons to whom data is transferred on the basis of consent or a compelling necessity.
7. Data processing in thrid countris
In the context of the data processing in question, your personal data may be transferred to entities whose registered office or place of data processing is not located in a member state of the European Union or in another signatory state to the Agreement on the European Economic Area. In this case, we will ensure prior to the transfer that, except in cases permitted by law, the recipient has an adequate level of data protection (e.g., through an adequacy decision by the European Commission, through appropriate safeguards such as certification of the recipient under the EU-U.S. Data Privacy Framework, or the agreement of so-called EU standard data protection clauses of the European Commission with the recipient) or your express consent.
8. Your rights as a data subject
If the legal requirements are met, you have the following rights:
- to request confirmation as to whether we are processing personal data concerning you; if this is the case, you have the right to access information about this processing (Art. 15 GDPR).
- to request the rectification of inaccurate personal data concerning you and the completion of incomplete personal data concerning you (Art. 16 GDPR).
- to request the erasure of personal data concerning you, including if the processing was unlawful or is no longer necessary (Art. 17 GDPR).
- to request the restriction of the processing of personal data concerning you, including instead of erasure of the data (Art. 18 GDPR).
- to receive personal data concerning you that you have provided in a structured, commonly used and machine-readable format or to transmit it to another controller, provided that the processing is carried out by automated means and is based on your consent or a contract with you (data portability, Art. 20 GDPR).
- to withdraw your consent to the processing of your personal data at any time with effect for the future (withdrawal of consent, Art. 7 GDPR). The lawfulness of the processing of your data until withdrawal remains unaffected.
Right to object in individual cases:
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6 (1) lit. f) GDPR (balancing of interests); this also applies to profiling based on these provisions.
If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves to assert, exercise, or defend legal claims.
Asserting your rights
You can contact us at any time to assert your rights as a data subject. To do so, please use the contact details of the controller listed above in section 1.
If you believe that the processing of your personal data violates data protection law, you can also lodge a complaint with a supervisory authority, in particular in the EU member state or federal state of your habitual residence, place of work, or the place of the alleged infringement.
This also applies to the supervisory authority that is generally responsible for us:
State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia
Kavalleriestr. 2-4
40213 Düsseldorf
Phone: +49 (0)211 38424-0
Fax: +49 (0)211 38424-999
Email: poststelle[at]ldi.nrw.de
9. Changes to this privacy policy
We reserve the right to amend this privacy policy at any time to comply with technical and legal requirements.
As of: December 2025