WE PERFORM YOUR REVENUE
 Experts for Revenue, Distribution and Marketing Outsourcing

PRIVACY NOTICE APPLICANTS


1. Data Controller

The data controller within the meaning of the General Data Protection Regulation (GDPR) is
i-Hotel Services Germany GmbH & Co. KG
Gissigheimer Straße 26
97922 Lauda-Königshofen
Germany
Telephone: +491627641805
Email: datenschutz@i-hotelservices.com

2. Contact details of the Data Protection Officer
You can contact the Data Protection Officer at
Proliance GmbH
www.proliance.ai
Data Protection Officer
Leopoldstr. 21
80802 Munich
Email: datenschutzbeauftragter@proliance.ai
When contacting the Data Protection Officer, please state the company to which your enquiry relates. Please also refrain from attaching sensitive information, such as a copy of your ID, to your enquiry.

3. General information on data transfers to third countries
The processing of your data may, where applicable, also take place in countries outside the European Union (EU) and the European Economic Area (EEA).
For data transfers to certain third countries, an adequacy decision by the European Commission pursuant to Article 45(1) of the GDPR may apply. Such a decision establishes that an adequate level of data protection exists in the third country. A list of previous adequacy decisions can be viewed at the following link: Data protection adequacy for non-EU countries.
The scope of an adequacy decision may also be restricted to a specific group of recipients or subject to further conditions.
For example, the adequacy decision for data transfers to the US applies only to companies certified under the EU-US Data Privacy Framework. The certification status of a participating company can be viewed via the following link: Participant Search (dataprivacyframework.gov).
When your data is transferred to recipients in third countries for which no adequacy decision exists, there is a risk that authorities in those countries may access your data for security and surveillance purposes without you being informed or being able to seek legal redress.
We therefore ensure that appropriate safeguards within the meaning of Article 46 of the GDPR are in place to guarantee an adequate level of data protection when transferring your data to recipients in such third countries.
Standard data protection clauses of the European Commission pursuant to Article 46(2)(c) of the GDPR are therefore regularly concluded either by us or by the service providers we engage. These clauses oblige the recipient of the data in the third country to process it in accordance with the European level of protection. The clauses can be viewed via the following link: Publications on the Standard Contractual Clauses (SCCs) – European Commission. Should you require further details regarding the modules of the Standard Data Protection Clauses we have concluded in specific cases or any supplementary measures, we will be happy to provide you with a copy. In this case, please simply contact us using the contact details provided above under ‘Data Controller’.
In the case of certain recipients, data transfers may also be based on binding corporate rules (BCRs) approved by the supervisory authorities in accordance with Article 46(2)(b) of the GDPR. These can be viewed at the following link: Approved Binding Corporate Rules | European Data Protection Board.
Where the Standard Data Protection Clauses or Binding Corporate Rules are insufficient to ensure the required level of protection, additional technical, contractual or organisational measures are taken to safeguard the data transfer. Furthermore, we regularly review and assess whether these additional measures continue to ensure an adequate level of data protection or whether further supplementary measures may need to be taken.
Further details on data transfers to third countries can be found in the relevant cases below, in the sections on data processing or the services used, under ‘Data processing in third countries’.

4. General information on the use of artificial intelligence
Artificial intelligence may be used in the processing of your data.
Further details on the use of Artificial Intelligence can be found in the relevant sections below, in the explanations regarding data processing or the services used, under “Use of Artificial Intelligence”.

5. Data protection information for applicants
Description of data processing and purpose
We process your personal data to the extent necessary for the decision regarding the establishment of an employment relationship with us.
We process only data relating to your application. This may include general personal data (name, address, contact details, etc.), details of your professional qualifications and education, details of further professional training, and, where applicable, any other data you provide to us in connection with your application.
If an employment relationship is established between you and us, we may continue to process the personal data already received from you for the purposes of the employment relationship, to the extent that this is necessary for the performance or termination of the employment relationship or for the exercise or fulfilment of the rights and obligations of the employees’ representative body arising from a law or a collective agreement, a works or service agreement (collective agreement).
Legal basis for data processing
The legal basis for data processing is Article 88 of the GDPR in conjunction with Section 26(1) of the BDSG or Article 6(1)(b) of the GDPR, insofar as the data processing is necessary for the decision on the establishment of an employment relationship.
If you give us your explicit consent to the processing of personal data for specific purposes, the lawfulness of this processing is based on your consent in accordance with Section 26(2) of the Federal Data Protection Act (BDSG) and Article 6(1)(a) of the GDPR. Consent given may be withdrawn at any time with effect for the future.
The legal basis for any further processing carried out for the purpose of implementing or terminating the employment relationship is Article 88 of the GDPR in conjunction with Section 26(1) of the BDSG or Article 6(1)(b) of the GDPR.
Source
We process personal data which we receive from you when you contact us or submit your application via the upload function on our careers portal, by post or by email, or which you send to us via job portals and professional networks of your choice, or which we receive from recruitment agencies .
Recipients
As part of data processing, your data is transferred to the following categories of recipients, whom we engage in the course of data processing to achieve the stated purposes:
• Software service providers who provide us with solutions for internal and external communication, for the creation and editing of documents, and for the management of data sets.
These include, in particular, the following recipients:
• Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA.
• Microsoft Ireland Operations, Ltd, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland.
Data processing in third countries
Your data is transferred to recipients in third countries. For data transfers to the USA, there is an adequacy decision by the European Commission regarding companies certified under the EU-US Data Privacy Framework. Microsoft Corporation is certified under the EU-US Data Privacy Framework.
Further information on this and additional links can be found above in the section ‘General information on data transfers to third countries’.
Use of Artificial Intelligence
No artificial intelligence is used in the processing of your data.
Further information on this subject, as well as related links, can be found in the section above entitled ‘General information on the use of artificial intelligence’.
Retention period
We store your personal data for as long as is necessary to make a decision on your application. Your personal data and application documents will be deleted no later than 6 months after the application process has ended (e.g. notification of the rejection decision), unless longer storage is legally required or permitted.
Furthermore, we will only store your personal data to the extent that this is required by law or, in specific cases, to assert, exercise or defend legal claims for the duration of any legal proceedings.
In the event that you have consented to the longer storage of your personal data, we will store it in accordance with your declaration of consent.
If, following the application process, an employment, training or internship relationship is established, your data will, where necessary and permissible, initially continue to be stored and subsequently transferred to the personnel file.
Where applicable, you may receive an invitation to join our talent pool following the application process. This allows us to consider you in our selection of candidates for suitable vacancies in the future. If we have received your consent to this, we will store your application data in our talent pool in accordance with your consent or any future consents.
Necessity of providing personal data
The provision of your personal data as part of application processes is voluntary. However, we can only make a decision to establish an employment relationship, or establish an employment relationship with you, provided that you supply the personal data required to process your application.

6. Data protection information regarding data processing for compliance with data protection regulations
6.1. Documentation of consents and implementation of data subjects’ rights
Description of data processing and purpose
Where you provide us with a declaration of consent, we process your personal data regarding the circumstances and time of submission (where applicable, signature, email address, telephone or fax number or IP address) in order to be able to demonstrate, within the scope of our accountability obligation under Article 5(2)(f) of the GDPR, that you have consented to the data processing in question. The same applies to the withdrawal of your consent.
Where you exercise your data subject rights under the GDPR vis-à-vis us, we also process your personal data in order to be able to demonstrate, within the framework of the accountability obligation under Article 5(2)(f) of the GDPR, that we have complied with the GDPR when processing your request.
Legal basis for data processing
Processing is carried out in each case on the basis of Article 6(1)(c) GDPR in conjunction with Article 5(2) GDPR or Article 6(1)(f) GDPR. Our legitimate interest lies in being able to document compliance with the requirements of the GDPR as part of our accountability.
Recipients
In the course of data processing, your data will be transferred to the following categories of recipients whom we engage in the course of data processing to achieve the stated purposes:
• External Data Protection Officer,
• Software service providers who provide us with solutions for internal and external communication, for the creation and editing of documents, and for the management of data sets.
These recipients include, in particular:
• Proliance GmbH, Leopoldstr. 21, 80802 Munich, Germany
• Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA.
• Microsoft Ireland Operations, Ltd, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland.
Retention period
We store your data for as long as is necessary to achieve the aforementioned purpose. We generally store data relating to consent given for a period of 3 years from the end of the year in which we last made use of it. Data that we process in connection with the exercise of data subject rights is generally stored for a period of 3 years from the end of the year in which you exercised your data subject rights.
We will then delete your data, unless data processing, including in other systems where applicable, remains permissible on another legal basis or is mandatory for us (e.g. in the case of statutory retention obligations).

6.2. Maintaining an advertising opt-out list
Description of data processing and its purpose
If you object to data processing for advertising purposes on the basis of legitimate interests, we will regularly add your contact details (e.g. first name and surname, email address, telephone number, address) to our advertising opt-out list.
We maintain this list to ensure permanently that you will no longer be contacted for advertising purposes in the future, even if we collect and process your data again in accordance with the GDPR.
Thus, only by cross-referencing this list can we ensure that your data is not used again for advertising purposes after it has been otherwise deleted from the active data stock of our operational systems – for example, because you are re-registered as a customer in our systems, or because we collect your data again from other data sources, or receive it again from third parties, including processors.
You will also be added to the advertising opt-out list if, in addition to objecting, you exercise your right to erasure, unless it is explicitly important to you – or it is clear to us that it is important to you – that your data be erased and the permanent implementation of your right to object is not the primary concern.
Legal basis for data processing
Processing is carried out in each case on the basis of Article 6(1)(f) of the GDPR. Our legitimate interest lies in being able to permanently and effectively implement compliance with the right to object under the GDPR, as well as the right to object within the meaning of Section 7(3) of the Unfair Competition Act (UWG) in cases of direct marketing or marketing to existing customers, beyond the mere deletion of the data.
Recipients
In the course of data processing, your data is transferred to the following categories of recipients whom we engage in the course of data processing to achieve the stated purposes:
• Marketing and email marketing service providers,
• Software service providers who provide us with solutions for internal and external communication, for the creation and editing of documents, and for the management of data sets.
These recipients include, in particular:
• Cleverreach GmbH & Co. KG, Schafjücken 2, 26180 Rastede, Germany
• Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA.
• Microsoft Ireland Operations, Ltd, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland.
Retention period
We store your data in the advertising opt-out list for as long as is necessary to achieve the aforementioned purpose. This is generally for as long as we, as a company, are active in the market and advertise our products, goods, services, offers and events.

7. Privacy information for other data processing
7.1. Fulfilment of other legal obligations
Description of data processing and purpose
We process personal data where this is necessary to fulfil a legal obligation. The scope of the data to be processed is determined by the legal obligation with which we must comply.
Legal basis for data processing
In these cases, the legal basis for the processing of your data is Article 6(1)(c) of the GDPR in conjunction with the relevant legal provision imposing such an obligation on us.
These may include, for example, provisions of the German Fiscal Code (AO), e.g. Section 147 AO, the German Commercial Code (HGB), e.g. Section 257 HGB, or the Code of Criminal Procedure (StPO).
Recipients
In the course of data processing, your data is transferred to the following categories of recipients whom we engage in the course of data processing to achieve the stated purposes:
• Tax advisers, auditors, Tax or investigative authorities, solicitors, experts, courts.
Retention period
We store your data to the extent necessary for as long as is required to achieve the aforementioned purpose. The storage period is determined by specific statutory provisions which oblige us to retain or process data for up to 10 years, with the specific start date of the retention periods being determined by the relevant specific law.
We will then delete your data, unless data processing, including in other systems where applicable, remains permissible on the basis of another legal ground.


7.2. Exercise or defence of legal claims
Description of data processing and purpose
In addition, we process your data in individual cases for the purpose and in the interest of asserting legal claims, for example to enforce our claims arising from unpaid invoices, provided your data is relevant to a legal dispute.
We also process your data in individual cases for the purpose and in the interest of defending against legal claims brought against us, for example in the event of claims for liability for material defects, provided your data is relevant to a legal dispute.
Legal basis for data processing
The legal basis for the processing of your data is Article 6(1)(f) of the GDPR.
Recipients
As part of our data processing activities, your data will be disclosed to the following categories of recipients, whom we engage in the course of data processing to achieve the stated purposes:
• Tax advisers, auditors, tax or investigative authorities, solicitors, experts, courts.
Retention period
We store your data on a case-by-case basis to the extent necessary, for as long as this is required to achieve the aforementioned purpose. We will then delete your data, unless data processing, including in other systems where applicable, remains permissible on another legal basis or is mandatory for us (e.g. in the event of statutory retention obligations).


8. Your rights
Below you will find information on the data subject rights granted to you by applicable data protection law vis-à-vis the controller with regard to the processing of your personal data:
The right, pursuant to Article 15 of the GDPR, to request information about your personal data processed by us. In particular, you may request information regarding the purposes of processing, the categories of personal data, the categories of recipients to whom your data has been or will be disclosed, the intended storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the origin of your data where it was not collected by us, as well as the existence of automated decision-making, including profiling, and, where applicable, meaningful information regarding its details.
The right, pursuant to Article 16 of the GDPR, to request the immediate rectification of inaccurate personal data or the completion of your personal data stored by us.
The right, pursuant to Article 17 of the GDPR, to request the erasure of your personal data stored by us, unless processing is necessary for the exercise of the right to freedom of expression and information, to comply with a legal obligation, for reasons of public interest, or for the establishment, exercise or defence of legal claims.
The right, pursuant to Article 18 of the GDPR, to request the restriction of the processing of your personal data, provided that you contest the accuracy of the data, the processing is unlawful but you oppose its erasure and we no longer require the data, but you require it for the establishment, exercise or defend legal claims, or you have objected to the processing in accordance with Article 21 of the GDPR.
The right, pursuant to Article 20 of the GDPR, to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, or to request that it be transmitted to another controller.
The right to lodge a complaint with a supervisory authority in accordance with Article 77 of the GDPR. As a rule, you may contact the supervisory authority of the federal state in which our registered office is located, as stated above, or, where applicable, that of your usual place of residence or workplace.
The right to withdraw consent pursuant to Article 7(3) of the GDPR: You have the right to withdraw your consent to the processing of data at any time with effect for the future. In the event of withdrawal, we will delete the relevant data without delay, provided that further processing cannot be based on a legal ground for processing without consent. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent prior to withdrawal.
Right to object
Where we process your personal data on the basis of legitimate interests pursuant to Article 6(1)(f) of the GDPR, you have the right under Article 21 of the GDPR to object to the processing of your personal data , provided this is for reasons arising from your particular situation. Where the objection relates to the processing of personal data for the purposes of direct marketing, you have a general right to object without the need to specify a particular situation.
If you wish to exercise your right to withdraw consent or object, please contact us using the contact details provided above under ‘Data Controller’.

9. Status of the privacy policy
This privacy policy was last amended on 7th of October 2026 .