Privacy Policy for Employer Branding and Recruiting at Knauf Digital
Publication Date: 10-29-2025
At Knauf Germany, we manage our employer branding and recruiting via our Career Website (the "Career Website") and using an associated applicant management system.
In this Privacy Policy, we explain how we process your personal data when:
- You access our Career Website (you are a "Visitor")
- You connect with us via our Career Website to create a profile with us and receive information about current or future job openings with us (you are a "Connected Applicant")
- You apply for a position with us, via our Career Website or a third-party service (you are an "Applying Applicant")
- We collect information about you from other parties, websites, and services because we believe your profile is of interest for our current or future job openings (you are a "Sourced Applicant")
- We receive information about you from our employees or partners because they believe your profile is of interest for our current or future job openings (you are a "Referred Applicant")
- We receive information about you from an applicant who lists you as a reference (You are a "Reference").
This Privacy Policy also describes what rights you have when we process your personal data and how you can exercise these rights.
When we use the term "applicant" in this Privacy Policy, we refer – unless otherwise stated – to each of the following terms: affiliated applicants, applying applicants, sourced applicants, and referred applicants.
1. About the Processing of Personal Data
Personal data is all information that can be directly or indirectly associated with a living, natural person. Examples of personal data include: name, email address, phone number, and IP address. The processing of personal data means any automated use of personal data – such as collecting, creating, analyzing, sharing, and deleting personal data.
There are laws and regulations regarding how companies may process personal data, known as data protection laws. Different data protection laws apply to different types of personal data use and in different parts of the world. An example of a data protection law relevant to our use of your personal data, as described in this Privacy Policy, is the EU General Data Protection Regulation (2016/679, "GDPR").
Most obligations under the GDPR apply to the so-called data controller. A data controller is the entity that decides for what purposes personal data is processed and how the processing is carried out. The data controller may engage a so-called data processor. A data processor is an entity that may only process personal data on behalf of the data controller and may not use the personal data for its own purposes.
2. What personal data do we process?
All individuals
- Device Information – When you visit our careers page, we collect information about your device, such as IP address, browser type and browser version, session behavior, traffic source, screen resolution, preferred language, geographical location, operating system, and device settings/usage.
- Technical and Statistical Data – When you visit our careers page, we collect technical and statistical data about your use of the site, such as information about which URLs you visit and your activities on the site.
- Communication Data – We will collect and store your communications with us, including the information you provided in the communication. This may include the content of emails, video recordings, social media messages, information you add to your account with us, surveys, etc.
- Contact Data – Such as your name, email address, phone number, and physical address.
Candidates
- Data from Interviews, Assessments, and Other Information from the Recruitment Process – Such as notes from interviews with you, assessments and tests conducted, salary expectations.
- Information in Your Application – Such as your CV, cover letter, work samples, references, letters of recommendation, and education.
- Information in your public profile - This refers to information we collect about you from public sources related to your professional experience, such as LinkedIn or your current employer's website.
- Information from references – This refers to information we receive from our employees or partners who refer you to us, or from the individuals you have provided as your references.
3. Where do we obtain your personal data?
All individuals
- From the careers website. When you access our careers website, we collect technical and statistical information about how you use the careers website, as well as information from your device.
- Directly from you. Most of the information about you that we process is obtained directly from you, for example, when you apply for a position with us or contact us. You can choose not to provide us with certain information at any time. However, some personal data is required for us to process your application or provide you with the information you request.
References
- From the person for whom you are a reference. If an applicant provides you as a reference, we collect your contact details submitted by the applicant in order to contact you.
Applicants
- From public sources. We may collect personal data about you from public sources, such as LinkedIn or your current employer's website.
- From our references. We may receive information about you from our employees or partners (e.g., recruitment service providers) if they believe your profile is of interest for our current or future job openings.
- From your references. If you provide us with references, we may collect information about you from them.
- Data that we create ourselves or in collaboration with you. Information about your application and profile is typically created by us or by us in collaboration with you during the recruitment process. This may include, for example, notes from conversations with you, assessments, and tests.
4. For what purposes do we process your personal data?
To protect and enforce our rights, interests, and the interests of others, for example, in connection with legal claims.
Data subjects: The person(s) affected by the legal matter – this may include individuals from all categories of persons listed above.
Categories of personal data used: All categories of personal data listed above may be used for this purpose.
Disclosure of your personal data to other recipients for the purposes mentioned in Section 5 below.
Data Subjects: Varies depending on the purpose of the disclosure, see Section 5 below.
Categories of personal data used: All categories of personal data listed above may be used for this purpose.
Collecting information about your use of the career website using cookies and other tracking technologies, as described in our Cookie Policy.
Data Subjects: Visitors.
Categories of personal data used: Device information.
Maintenance, development, testing, and other assurance of the security of the career website.
Data Subjects: Visitors.
Categories of personal data used: Device data; Technical and statistical data.
Analysis of the use and performance of the career website and its content to generate statistics and improve operational performance.
Data Subjects: Visitors.
Categories of personal data used: Device information; Technical and statistical data.
Provision of current information about job vacancies with us.
Data Subjects: Connected applicants.
Categories of personal data used: Contact data; Communication data.
Reviewing profiles and applications submitted to us. This also includes communicating with you regarding your application and profile.
Data Subjects: Connected applicants; applying applicants.
Categories of personal data used: All categories of personal data listed above may be used for this purpose.
Collection and evaluation of your professional profile on our own initiative. This also includes communication with you regarding your profile.
Data subjects: sourced applicants; recommended applicants.
Categories of personal data used: All categories of personal data listed above may be used for this purpose.
Direct contact with you regarding specific, future job offers with us.
Data subjects: applicants.
Categories of personal data used: All categories of personal data listed above may be used for this purpose.
Recording of the interview(s) with you.
Data subjects: applicants.
Categories of personal data used: Communication data.
Contacting you to ask for your participation in surveys
Data subjects: applicants.
Categories of personal data used: All categories of personal data listed above may be used for this purpose.
Contacting you to ask for information about an applicant, as well as the evaluation of information provided by you.
Data subjects: references.
Categories of personal data used: Contact details; Communication data.
5. With whom do we share your personal data?
With our service providers. We share your personal data with our service providers who provide services and functionality for our employer branding and recruiting. These include, for example, recruitment service providers and the provider of our career website and the associated applicant tracking system.
Our group companies. We share your personal data with our group companies when they provide us with services and functionality for our employer branding and recruiting, such as access to certain systems and software.
Companies that provide cookies on the career website. If you agree, cookies will be set by companies other than us, which use the data collected by these cookies in accordance with their own privacy policies. Information about which cookies this concerns can be found in our Cookie Policy.
To authorities and other public bodies – if we are requested to do so. We share your personal data with authorities and other public bodies if we are legally obliged to do so.
To parties involved in legal proceedings. If it is necessary to protect or defend our rights, we will disclose your personal data to authorities or other parties involved in potential or ongoing legal proceedings. This may apply, for example, to discrimination claims.
Mergers and acquisitions, etc. In connection with a possible merger, the sale of company assets, financing, or the acquisition of all or part of our company by another company, we may disclose your personal data to other parties involved in this process.
6. On what legal basis do we process your personal data?
Consent
Insofar as we obtain the data subject's consent for the processing of personal data, Article 6 (1) sentence 1 a) GDPR serves as the legal basis. You can withdraw your consent at any time with effect for the future. The lawfulness of the data processing carried out up to that point will not be affected by the withdrawal.
Performance of a contract
For the processing of personal data that is necessary for the establishment, performance, and termination of the employment relationship, Article 6 (1) sentence 1 b) GDPR, Paragraph 26 (1) Federal Data Protection Act (where applicable) serve as the legal basis. Article 6(1) first sentence, lit. b) GDPR, Paragraph 26 (1) Federal Data Protection Act (where applicable) as the legal basis. This also applies to processing operations that are necessary for the implementation of pre-contractual measures and measures for the fulfillment of rights and obligations arising from a collective bargaining agreement, a works agreement, or a service agreement, as well as for communication with you.
Legal Obligation
Insofar as the processing of personal data is necessary for the fulfillment of our legal obligations as an employer, particularly in tax and social security law, Article 6 (1) sentence 1 lit. c) GDPR, Paragraph 26 (1) Federal Data Protection Act (where applicable) serve as the legal basis. 6 para. 1 sentence 1 letter c) GDPR, Paragraph 26 (1) Federal Data Protection Act (where applicable) as legal basis.
Legitimate Interest
If the processing is necessary for the protection of the legitimate interests of our company or a third party, provided that the interests or fundamental rights and freedoms of the data subject do not override them, Article 6 (1) sentence 1 f) GDPR serves as the legal basis. This particularly concerns intra-group data exchange for administrative purposes and/or in the case of central corporate functions or for maintaining operational safety and order, for preventing legal violations or for criminal prosecution.
Special Categories of Personal Data
It is also possible that we process special categories of personal data in accordance with Article 9 (1) GDPR for the exercise of rights or the fulfillment of obligations under labor, social security, and social protection law in the context of establishing an employment relationship (e.g., disclosure of health data to the health insurance company, recording of severe disability for additional leave and determination of the severe disability levy). The legal basis for this is Article 9 (2) b), h) GDPR and Paragraph 26 (3) Federal Data Protection Act.
7. When do we transfer your personal data outside the EU/EEA and how do we protect it then?
We always strive to process your personal data within the EU/EEA.
However, some of our service providers process your personal data outside the EU/EEA. We also work with providers whose parent company or the parent company of a subcontractor is based outside the EU/EEA. In these cases, we have considered the risk that personal data may be transferred to countries outside the EU/EEA, for example, due to a government request.
In cases where another recipient of your personal data (as described in section 5 above) is based outside the EU/EEA, this also means that your personal data will be transferred outside the EU/EEA.
If we or one of our service providers transfer your personal data outside the EU/EEA, we ensure that we use a security measure recognized by the GDPR to enable the transfer. We use the following safeguards:
When your personal data is transferred outside the EU/EEA, we also implement appropriate technical and organizational safeguards to protect the personal data in the event of disclosure. The exact safeguards we take depend on what is technically feasible and sufficiently effective for the respective transfer.
If you would like further information on the cases in which your personal data is transferred outside the EU/EEA, you can contact us using the contact details in sections 9 and 10 below.
8. How long do we store your personal data?
All Persons
If we process your personal data to protect and enforce our rights, we will store your personal data until the relevant legal matter has been fully and finally resolved.
Website Visitors
We store your personal data for security reasons for one (1) year. The storage periods for cookies are set out in our Cookie Policy. We store your personal data for the analysis of the career website's performance for as long as we store personal data about you for other purposes.
Applicants
Connection via Connect
If you are (only) a connected applicant, we will store your personal data for as long as a connection to us exists.
If you have consented to us continuing to contact you for future job offers, we will delete your data if you withdraw your consent or after you have been inactive for 6 months.
If you are hired, we will store your personal data during your employment for purposes other than those mentioned above. You will be informed about this.
Application without connection via Connect
For other types of applicants, we store your personal data to decide whether you are a suitable candidate for the relevant position(s) with us.
If you are not successful in the initial recruitment process, we will delete your data no later than 6 months after your application is rejected.
If you have agreed that we may continue to contact you for future job offers, we will delete your data if you withdraw your consent or after you have been inactive for 6 months.
If you are hired, we will retain your personal data during your employment for purposes other than those mentioned above. You will be informed about this.
References
We will retain your personal data for as long as we retain the personal data of the applicant for whom you acted as a reference.
9. What rights do you have, and how can you exercise them?
In this section, you will find information about the rights you have when we process your personal data. As described below, some of these rights only apply if we process your personal data on a specific legal basis.
If you wish to exercise any of the rights listed here, we recommend the following:
- Visit the Data & Privacy page on our career website. Here we offer functions that allow you to exercise your rights;
- Log in to your account with us, where you can use the settings in your account to exercise your rights; or
- contact us directly at jobs.germany@knauf.com.
The right to be informed.
You have the right to be informed about how we process your personal data. You also have the right to be informed if we intend to process your personal data for a purpose other than that for which it was originally collected.
We provide you with this information through this Privacy Policy, through updates on our career website (see also Section 11 below), and by answering your questions.
Right to access your personal data.
You have the right to know whether we process personal data about you and to receive a copy of the data we process about you. In connection with receiving a copy of your data, you will also receive information about how we process your personal data.
Right to access and to transfer your personal data to another recipient ("data portability").
You can request a copy of the personal data concerning you, which we process to fulfill an agreement with you or based on your consent, in a structured, common, and machine-readable format. This allows you to use this data elsewhere, for example, to transfer it to another recipient. Where technically feasible, you also have the right to request that we transmit your data directly to another recipient.
Right to erasure of your personal data ("Right to be forgotten").
In some cases, you have the right for us to erase personal data about you. This is the case, for example, when the processing of the data is no longer necessary for the purpose for which we collected it; when you withdraw your consent; when you have objected to the processing and there are no legitimate, overriding grounds for the processing. (For the separate right to object, see below.)
Right to object to our processing of your personal data.
You have the right to object to the processing of your personal data, which is based on our legitimate interest, by stating your personal circumstances.
Right to restriction of processing.
If you believe that the personal data we process about you is inaccurate, that our processing is unlawful, or that we no longer need the information for a specific purpose, you have the right to request that we restrict the processing of this personal data. If, as described above, you object to our processing, you can also ask us to restrict the processing of this personal data while we review your request.
If we restrict the processing of your personal data, we will only process the data (except for storage) with your consent or for the establishment, exercise, or defense of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest.
Right to rectification.
You have the right to request that we rectify inaccurate information and complete information about you that you consider incomplete.
Right to withdraw your consent.
If we process your personal data based on your consent, you have the right to withdraw this consent at any time. If you do so, we will stop processing your data for the purposes for which you have withdrawn your consent. However, this does not affect the lawfulness of processing based on your consent before its withdrawal.
The right to lodge a complaint.
If you have complaints about our processing of your personal data, you can lodge a complaint with the responsible data protection authority in Germany. Their contact details can be found here.
You can also lodge a complaint with your national data protection authority, which you can find here if you are resident in the EU. If you live in the United Kingdom, you can lodge a complaint here with the Data Protection Officer in Great Britain (Information Commissioner's Office).
10. Contact Details
Controller(s)
Within the Knauf Group Germany, the Human Resources department of Knauf Gips KG, Am Bahnhof 7, 97346 Iphofen, zentrale@knauf.com, is responsible as the central HR department for employer branding and recruiting and thus acts as a processor for the respective Knauf company. A contractual agreement in accordance with Art. 28 Para. 3 GDPR exists.
The Knauf company responsible for your job advertisement can be found in your job advertisement. A list of all Knauf companies can be found at the following link:
Companies of the Knauf Group Germany
Data Protection Officer
Am Bahnhof 7, 97346 Iphofen, Germany, Phone: + 49 9323 / 31-0, E-Mail: data-protection@knauf.com
11. Where to direct comments or questions?
If you wish to contact us to exercise your rights, or if you have any questions, comments, or concerns regarding the handling of your personal data, you can reach us by email at jobs.germany@knauf.com.
12. Updates to this Privacy Policy
We update this Privacy Policy when necessary – for example, because we process your personal data in a new way, because we want to make the information even clearer for you, or when it is necessary to comply with applicable data protection laws.
We recommend that you regularly check this page for changes. You can always check at the top of this page when this Privacy Policy was last updated.
