Blog
iStock-1002439630

As of November 30, 2025 Privacy Policy

as part of the application process for blue-zone.io                                                                                                                                                                                                                                                                                   

  1. Data Controller (Art. 13(1)(a) of the GDPR)

    The data controller responsible for processing your personal data as part of the application process is:

    blue-zone GmbH
    Am Oberfeld 1
    83026 Rosenheim
    Germany

    Phone: +49 8031 61929-00
    Email: info@blue-zone.io
    Website: www.blue-zone.io

    blue-zone GmbH is the entity that, alone or jointly with others, determines the purposes and means of processing personal data and is therefore the “controller” within the meaning of the GDPR.

    2. Data Protection Officer (Art. 13(1)(b) GDPR)

    We have appointed an in-house Data Protection Officer. This person is available to you as a contact for all questions regarding data protection:

    blue-zone GmbH
    Attn: Data Protection Officer
    Am Oberfeld 1
    83026 Rosenheim
    Germany

    Phone: +49 8031 61929-00
    Email: datenschutz@blue-zone.io

    You may contact the Data Protection Officer at any time if you wish to exercise your rights as a data subject or have general questions regarding our processing of your personal data.

    3. General Information on Data Processing

    Your personal data will only be processed to the extent necessary to make a decision regarding the establishment of an employment relationship (Art. 6(1)(b) GDPR), you have consented to the data processing (Art. 6(1)(a) GDPR or Art. 9(2)(a) of the GDPR), there is a legitimate interest in the processing (Art. 6(1)(f) of the GDPR), or other legal obligations or statutory requirements permit the processing (Art. 6(1)(c) of the GDPR).

    Your data is processed in accordance with the General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG), and the Telecommunications and Digital Services Data Protection Act (TDDDG).

    4. Categories of Personal Data

    a) Sources

    We process personal data that we receive from you as part of the application process. In addition, we process personal data that you have made available to us via a profile on a professional social media network (e.g., XING, LinkedIn, StepStone, etc.) or that we have lawfully obtained from other sources you have made publicly available and are permitted to process (e.g., a website containing your application, etc.).

    b) Categories of Personal Data

    As part of the application process, the following personal data related to your application may be collected, processed, and stored:

    Address and contact information (title, first name, last name, address, phone number, email address, other contact details), Personal master data (date and place of birth, gender, nationality, marital status, legal capacity, photo), as well as information regarding professional qualifications, education, and continuing professional development, driver’s licenses and vehicle classes, residency status, and work permit.

    In addition, we process other personal data that you have provided to us (resume, transcripts, employment references, criminal background check, questionnaires, interviews, previous employment) or career-related information that we have obtained from sources you have made publicly available (e.g., professional social media networks, websites containing your application, etc.).

    If you voluntarily provide such information in your cover letter or during the application process, we also process special categories of personal data (such as health data, religious affiliation, and degree of disability).

    Additional personal data is generated, in particular, through personal, telephone, or written contact—whether initiated by you or by the data controller. This includes, for example, information about the contact channel, date, reason, and outcome, as well as (electronic) copies of correspondence and meeting minutes.

    5. Purposes and Legal Bases for Data Processing

    We process the aforementioned categories of personal data for the purpose of your application for employment in accordance with the provisions of the EU General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG).

    We process your personal data to conduct the application process. This includes, in particular:

    • reviewing your application materials
    • communicating with you
    • conducting selection processes (e.g., interviews)
    • deciding whether to establish an employment relationship

    Processing is limited to the data necessary to conduct the application process.

    The processing of your personal data is based on the General Data Protection Regulation (GDPR):

    • Conducting the application process
    • Consent (Art. 6(1)(a) GDPR)
    • Processing of special categories of personal data (Art. 9 GDPR)
    • Compliance with legal obligations
    • Protection of legitimate interests
    • Within the framework of collective bargaining agreements
    • Right to lodge a complaint

    The processing is carried out to conduct the application process and to decide on the establishment of an employment relationship based on Article 6(1)(b) of the GDPR.

    If an employment relationship is established between you and us, we will continue to process the personal data collected from you during the application process to the extent necessary for the performance of the employment relationship or to fulfill the rights and obligations arising from a law, collective bargaining agreement, or other regulation.

    This processing is based on Article 6(1)(b) and (c) of the GDPR.

    Your contact information is also processed to communicate with you as part of the application process.

    If you are a minor, consent from your legal guardians may be required in certain cases.

    To the extent that you have given us consent to process personal data as part of the application process for specific purposes (e.g., the transfer of data within our corporate group, inclusion in our applicant database, or contact regarding matters related to the application), the lawfulness of this processing is based on your consent. Consent that has been given may be withdrawn at any time. Please note that the withdrawal takes effect only for the future. Processing that took place prior to the withdrawal is not affected. You may request an overview of the status of the consents you have granted at any time.

    To the extent that you voluntarily provide us with special categories of personal data within the meaning of Article 9(1) of the GDPR (e.g., health data or information regarding severe disability), we process this data on the basis of Article 9(2)(a) of the GDPR.

    To the extent that the processing of special categories of personal data after the establishment of an employment relationship is necessary for the exercise of rights or the fulfillment of legal obligations under labor law, social security law, and social protection law, the processing is carried out on the basis of Article 9(2)(b) of the GDPR.

    To the extent that this is necessary to comply with legal obligations, we process your personal data on the basis of Article 6(1)(c) of the GDPR.

    This applies in particular to statutory retention obligations as well as other legal requirements to which we are subject as a company.

    To the extent that special categories of personal data must be processed, this is done—where necessary—on the basis of Article 9(2)(b) of the GDPR to fulfill legal obligations under labor law, social security law, and social protection law.

    If an employment relationship is established, the processing of certain personal data may also be necessary to fulfill legal obligations, particularly under tax and social security law.

    In addition, statutory retention requirements—particularly under commercial and tax law—may require us to store your data beyond the end of the application process.

    To the extent necessary, we process your personal data on the basis of Article 6(1)(f) of the GDPR to safeguard legitimate interests.

    This includes, in particular, the assertion, exercise, or defense of legal claims in connection with the application process (e.g., under the General Equal Treatment Act).

    In addition, collective bargaining agreements (e.g., works agreements) may also apply to certain processing operations, provided they are in accordance with the GDPR.

    6. Recipients of the Data

    Within our company, only those individuals involved in the application process who need your personal data to carry out the application process will have access to it.

    We are supported by All for One Group SE in the application process. All for One Group SE processes personal data on our behalf and based on a data processing agreement in accordance with Article 28 of the GDPR.

    In addition, we engage service providers who provide us with technical support in conducting the application process (e.g., providers of applicant tracking systems or IT service providers). These providers also process your data exclusively on our behalf and based on corresponding contractual agreements.

    Your personal data will only be disclosed to other companies within the All for One Group if this is necessary to fill a specific position or if you have given your consent to such disclosure.

    Furthermore, we will only disclose your personal data if we are legally required to do so. Other recipients of your data may include those entities to which you have given your consent for data transfer.

    7. Transfer to Third Countries or International Organizations

    Your personal data will only be transferred to countries outside the European Union (EU) or the European Economic Area (EEA) to the extent that this is necessary for the application process, you have given us your consent, or we are legally required to do so.

    If we use service providers in third countries or if data is transferred to third countries, we ensure that appropriate safeguards are in place in accordance with Articles 44 et seq. of the GDPR. This includes, in particular, the use of the Standard Contractual Clauses approved by the European Commission or other permissible mechanisms to ensure an adequate level of data protection.

    8. Duration of Data Storage

    We store your personal data for as long as necessary to make a decision regarding your application. If an employment relationship between you and us is not established, we will delete your personal data 12 months after the conclusion of the application process.

    This does not apply if statutory provisions preclude deletion or if further storage is necessary for the purpose of providing evidence to defend against potential legal claims (statutes of limitations may be up to 30 years pursuant to Sections 195 et seq. of the German Civil Code (BGB) may be up to 30 years, although the standard statute of limitations is three years) or if you have consented to longer-term storage.

    If we are unable to offer you a position but, based on your profile, believe that your application might be of interest for future job openings—and you have consented to this procedure—we will store your personal application data in our applicant database for 24 months

    10. Rights of Data Subjects

    As an applicant (m/f/d) with us, you have the following data protection rights, depending on the specific situation, and you may contact us or our Data Protection Officer at any time to exercise these rights:

    • Right of access (Art. 15 GDPR)
    • Right to Rectification (Art. 16 GDPR)

    You have the right to obtain information about your personal data processed by us, as well as to request access to your personal data and/or copies of such data. This includes information regarding the purpose of use, the categories of data processed, the recipients and authorized accessors, and, if possible, the planned duration of data storage or, if this is not possible, the criteria used to determine this duration. The restrictions of Section 34 of the German Federal Data Protection Act (BDSG) apply.

    You have the right to request that we rectify any inaccurate personal data concerning you without delay. Taking into account the purposes of the processing, you have the right to request that incomplete personal data be completed (including by means of a supplementary statement).

    c) Right to erasure (Art. 17 GDPR)

    You have the right to request that we erase personal data concerning you without undue delay. We are then obligated to erase personal data without undue delay if any of the following grounds apply:

    • The personal data is no longer necessary for the purposes for which it was collected or otherwise processed
    • You object to the processing, and there are no overriding legitimate grounds for the processing
    • The personal data has been processed unlawfully
    • The erasure of the personal data is necessary to comply with a legal obligation under Union law or the law of the Member States to which we are subject. This does not apply if the processing is necessary to fulfill a legal obligation that requires processing under Union law or the law of the Member States to which we are subject, or to assert, exercise, or defend legal claims

    The restrictions of Section 35 of the BDSG apply.

    d) Right to restriction of processing (Art. 18 GDPR)

    You have the right to request restriction of processing if one of the following conditions is met:

    • you contest the accuracy of the personal data, for a period enabling us to verify the accuracy of the personal data;
    • the processing is unlawful and you oppose the erasure of the personal data and instead request the restriction of its use
    • we no longer need the personal data for the purposes of processing, but you need it to assert, exercise, or defend legal claims
    • you have objected to the processing, as long as it has not yet been determined whether our legitimate grounds override yours.

    If processing has been restricted, this personal data (apart from its storage) may only be processed with your consent or for the purpose of asserting, exercise, or defense of legal claims, or to protect the rights of another natural or legal person, or for reasons of an important public interest of the Union or a Member State. If you have obtained a restriction on processing, we will notify you before the restriction is lifted.

    e) Right to Data Portability (Art. 20 GDPR)

    You have the right to receive the data you have provided in a structured, commonly used, and machine-readable format.

    f) Right to Object (Art. 21 GDPR)

    To the extent that the processing of personal data concerning you is based on Article 6(1)(e) and (f) of the GDPR, you have the right to object to the processing of this data at any time on grounds relating to your particular situation. We will then no longer process this personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims.

    g) Right to Withdraw Consent (Art. 7(3) GDPR)

    If the processing is based on consent, you have the right to withdraw your consent at any time without affecting the lawfulness of the processing carried out on the basis of your consent prior to its withdrawal. To do so, you may contact us or our Data Protection Officer at any time using the contact information provided above.

    You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates the GDPR.

    You may exercise this right, in particular, with a supervisory authority in the Member State of your residence, your workplace, or the location of the alleged infringement

    11. Obligation to Provide Data

    As part of your application, you must provide the personal data necessary to conduct the application process and assess your suitability. Without this data, we cannot conduct the application process or make a decision regarding the establishment of an employment relationship.

    12. Automated Decision-Making (including Profiling)

    We do not use any fully automated decision-making, including profiling, within the meaning of Article 22 of the GDPR, that would produce legal effects on you or similarly significantly affect you.

    13. Changes to This Privacy Policy

    We reserve the right to amend this Privacy Policy if required due to changes in the legal framework, new or modified processing activities, or the technologies we use.

    The current version of this Privacy Policy is available at any time on our applicant portal. Older versions are not automatically saved; however, upon request, we will provide you with previous versions—to the extent possible.