We are very pleased that you are interested in working for the Horváth & Partners Group (hereinafter referred to as "Horváth & Partners" or "we") and would like to send us your application. We take the protection of your personal data very seriously during processing in accordance with the statutory data protection regulations. Personal data will only be processed within the scope of the application procedure to the extent necessary in each individual case. The following information will give you an overview of how we guarantee this protection and what kind of data is collected for what purpose.

I. Name and address of the person responsible
The persons responsible within the meaning of the EU General Data Protection Regulation (hereinafter "GDPR") and other national data protection laws (in Germany: Federal Data Protection Act (hereinafter referred to as "BDSG") of the member states and other data protection regulations are the:

Horváth AG

Phoenixbau

Königstraße 5

70173 Stuttgart

Phone: +49 711 66919-0

Fax: +49 711 66919-1075

Email: datenschutz@horvath-partners.com

Horváth 4G Beteiligungs GmbH

Horváth & Partner Ltd

Horvath & Partners Management Consulting Corporation

Horváth & Partner Management Consulting GmbH

Horváth & Partners AG

Horváth Academy GmbH

CONSULT ING Horváth Engineers GmbH

Horváth & Partners Middle East GmbH

Horváth Saudi Arabia LLC

Horváth & Partners Management Consulting SRL

IFUA Horváth & Partners Kft

Should you have any questions or suggestions regarding data protection for the respective data controller, please feel free to contact datenschutz@horvath-partners.com.

II. Contact details of the data protection officer

Warth & Klein Grant Thornton AG

Audit firm

Sebastian Barg

Johannstraße 39

40476 Düsseldorf

Phone: +49 211 95248548

You can reach our data protection officer at datenschutz@horvath-partners.com or at our postal address (see I.) with the subject line "Data protection officer".

III. Processing of personal data in the application procedure

1. Description and scope of data processing and categories of data

When providing application documents via our online application tool, by e-mail or post, by recruiting agencies and headhunters or by any other communication channel, personal data and, if applicable, special personal data are processed for the purpose of carrying out the application procedure. As part of the application process, we process your contact and personal data as well as all data that you provide us with during the application process - this includes the following personal data:

• First name, surname and date of birth
• Address, email address and telephone number
• Nationality, sex, age
• Resume and cover letter
• Certificates, qualifications and references
• Bank details for possible travel expenses reimbursement

Furthermore, the information you provide may be special personal data in accordance with Art. 9 GDPR, which is subject to special protection. If you are employed by the company, all personal data you have provided us with will be transferred as employee data and will continue to be stored for the duration of the employment relationship.

2. Purpose of the data processing and its legal basis

We process your personal data in order to decide whether to establish an employment relationship with you. At the same time, the personal data serve as a basis for the performance of any employment relationship that may be established (Section 26 (1) sentence 1 BDSG, Art. 6 (1) lit. b GDPR). In cases where the processing of your personal data goes beyond the purpose of carrying out the application process, it must be legitimised by individual consent. Therefore, if you have given us your consent to process your personal data, the respective consent is the legal basis for the processing mentioned there (Section 26 para. 2 BDSG, Art. 6 para. 1 lit. a DSGO). This applies in particular to your consent to be included in the talent pool.

You can revoke your consent at any time with effect for the future (see also IV. 7.) As far as the specific purpose allows, we process your personal data anonymously.

3. Recipient of your personal data

Your personal data will only be passed on in confidence and only to the extent permitted by the legal basis. With your application, you provide your personal data to the responsible specialist department and the responsible HR department within the Horváth & Partners Group. Your application documents can be viewed and examined from the persons involved in the selection process at Horváth & Partners for the filling of a vacancy.

4. Storage duration and data deletion

Your personal data will be stored for the duration of the application process.  In the event of being hired, the information provided will be transferred as employee data and will continue to be stored, processed or used for the duration of the employment relationship.

If you are not employed by the company, your personal data will be stored for six months after the end of the application procedure in accordance with Art. 6 Para. 1 letter f GDPR and in compliance with the provisions of the General Equal Treatment Act (AGG). Afterwards we process your personal data for statistical evaluations only in anonymised form. If you have given us your consent, we will store your personal data from the application process for the period of time specified in the respective declaration of consent.

5. Obligation to provide your personal data

As part of the application process, we have to process certain personal data in order to be able to check the professional and personal suitability of an applicant for a specific position and to ensure a fair application process with regard to other applicants. If this data is not provided, Horváth & Partners will generally not be able to carry out the application process. This does not apply to data which we process from you within the scope of a consent.

IV. Your rights

You have the right to receive information about your personal stored data free of charge at any time. In addition, you have the right to demand the correction or deletion of your data at any time, provided that this does not conflict with any legal regulations or retention periods. You can demand the restriction of the processing of your data and object to the processing of your data. You also have the right to data portability. Furthermore, you can complain to the responsible data protection supervisory authority about the processing of your personal data by us.

If personal data are processed, the respective data subject must be informed about the following rights:

1. Right to information (Art. 15 GDPR)

You can request confirmation from the person responsible as to whether personal data concerning you is being processed by us.

2. Right to rectification (Art. 16 GDPR)

You have the right to ask the data controller to correct and/or complete the data if the personal data processed concerning you is incorrect or incomplete. The person responsible shall make the correction without delay.

3. Right to erasure (right to be forgotten) (Art. 17 GDPR)

You can demand from the data controller that the data relating to you is immediately deleted, and the data controller is obliged to delete this data immediately, unless one of the exceptions regulated in the GDPR applies or other legal storage obligations oblige us to store the data in question.

4. Right to restriction of processing (Art. 18 GDPR)

Under the conditions laid down in the GDPR, you may request that the processing of personal data relating to you is restricted.

5. Right to data portability (Art. 20 GDPR)

You have the right to obtain, in a structured, common and machine-readable format, the personal data concerning you which you have provided to the data controller and the processing of which is based on consent or on a contract with you. In addition, you have the right, under the conditions laid down in the GDPR, to transfer this data to another responsible party without hindrance from the responsible party to whom the personal data has been made available.

In exercising this right, you also have the right to obtain that the personal data concerning you are transferred directly from one person responsible to another, as far as this is technically feasible. The freedoms and rights of other persons may not be impaired thereby.

6. Right to object (Art. 21 GDPR)

You have the right to object at any time, for reasons arising from your particular situation, to the processing of personal data relating to you that is carried out pursuant to Article 6 paragraph 1 e or f of the GDPR; this also applies to profiling based on these provisions.

If the personal data concerning you are processed for the purpose of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing, including profiling, insofar as it relates to such direct marketing. In the event of an objection, the personal data concerning you will no longer be processed for these purposes.

7. Right to withdraw consent (Art. 7 para. 3 GDPR)

You have the right to revoke your declaration of consent to data processing at any time. Revocation of consent shall not affect the lawfulness of the processing carried out on the basis of the consent until revocation. This also applies to the revocation of declarations of consent that were issued to us prior to the applicability of the GDPR, i.e. before 25 May 2018. In this case, all personal data stored on the basis of the consent granted in each case will be deleted, unless the law provides another legal basis for further storage.

You can revoke your consent here.

For questions regarding data protection, you can contact us at any time on the privacy policy addresses mentioned above or under datenschutz@horvath-partners.com.

V. Right to appeal

In the event of breaches of data protection legislation, data subjects have a right of appeal to a data protection supervisory authority, in particular in the Member State of their habitual residence, their place of employment or the place where the alleged breach occurred. The right of appeal is without prejudice to any other administrative or judicial remedy.

Our competent data protection supervisory authority (Horváth AG) is:

State Commissioner for Data Protection and Freedom of Information Baden-Württemberg

Dr. Stefan Brink

Home address: Königstraße 10a, 70173 Stuttgart

Postal address: 10 29 32, 70025 Stuttgart

Central telephone: 0711 61 55 41 0

Email: poststelle@lfdi.bwl.de

The contact details of other data protection supervisory authorities can be found under the following link:

https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html

You can find the general data protection declaration for our homepage here.