Last updated: August 2026
1. Controller
The controller responsible for processing your personal data as part of the application process is:
nodeline GmbH
Lorenzstraße 12
76135 Karlsruhe
Germany
Email: info@nodeline.de
2. Purposes and Legal Bases of Processing
We process your personal data to the extent necessary to process your application, assess your suitability for the advertised position, communicate with you during the application process, and decide whether to establish an employment relationship with you.
The legal basis for processing your application data is Art. 6(1)(b) GDPR. The application process serves to take pre-contractual steps at your request, i.e. on the basis of your application. The State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg expressly considers Art. 6(1)(b) GDPR to be a legal basis for the processing of applicant data during the recruitment process.
Where continued storage after completion of the application process is necessary for the establishment, exercise or defence of legal claims, processing is based on Art. 6(1)(f) GDPR. In this case, our legitimate interest is the protection and defence of our legal interests.
If your application documents contain special categories of personal data within the meaning of Art. 9 GDPR and their processing is necessary for the application process, such data will only be processed where a lawful basis for doing so exists.
3. What Data Do We Process?
We primarily process the personal data that you provide to us in connection with your application. This may include in particular:
- name and contact details,
- cover letter and CV,
- information about education, studies and professional experience,
- qualifications and skills,
- certificates and other application documents,
- information about availability and the position you are interested in,
- communications with you during the application process, and
- information generated during interviews and other selection stages.
As a general rule, please only provide us with special categories of personal data, such as health information, where this is necessary for the application process.
4. Source of the Data
As a rule, we receive your personal data directly from you, in particular when you submit your application to us by email.
If you apply to us via LinkedIn or contact us there in connection with an application, we may also receive application and profile data via LinkedIn.
5. Applications by Email and Microsoft 365
We use Microsoft 365 for our email and communications infrastructure. Applications submitted to us by email are therefore processed within our Microsoft 365 environment.
Microsoft provides a Data Protection Addendum for its business services that governs the data protection terms applicable to the processing of customer data. The current version is dated May 2026.
Due to Microsoft’s global infrastructure, it cannot be completely ruled out that personal data may be processed outside the European Union or the European Economic Area. For such transfers, Microsoft uses, among other safeguards, the European Commission’s Standard Contractual Clauses and provides appropriate safeguards pursuant to Art. 46 GDPR.
6. Applications and Contact via LinkedIn
If you apply to us via LinkedIn or contact us there, personal data will initially also be processed by LinkedIn.
LinkedIn’s own privacy policy applies to this processing within the LinkedIn platform. For users in the European Economic Area, the LinkedIn service is provided by LinkedIn Ireland Unlimited Company, Dublin, Ireland.
Once we process data received via LinkedIn for our own recruitment process, nodeline GmbH is responsible for this processing in accordance with this Privacy Notice.
7. Recipients of Your Data
Within nodeline GmbH, only those persons who are involved in the respective application and selection process, or whose involvement is necessary for that process, will have access to your application data.
In addition, technical service providers used by us may process personal data to the extent necessary to provide their services. This includes, in particular, Microsoft in connection with the provision of Microsoft 365.
As a general rule, we do not disclose your application data to any other third parties unless there is a legal obligation or another valid legal basis under data protection law.
8. Retention Period
If your application results in an employment relationship, the personal data required for the employment relationship will be transferred to our personnel administration.
If no employment relationship is established, we generally delete your application data no later than six months after completion of the application process, unless legal obligations or specific reasons require a longer retention period.
Longer storage may be necessary in particular where data is required for the establishment, exercise or defence of legal claims.
If we would like to retain your application documents beyond the specific application process in order to consider you for future vacancies, we will obtain your separate consent in advance. You may withdraw such consent at any time with effect for the future.
9. Use of AI and Automated Decision-Making
We currently do not use AI systems for the automated assessment or selection of applicants.
We also do not make decisions in the application process that are based solely on automated processing within the meaning of Art. 22 GDPR. Decisions regarding the consideration and selection of applicants are made by humans.
If we expand our recruitment process in the future to include such procedures, we will review the associated data processing from a data protection perspective before introducing them and update this Privacy Notice where necessary.
10. Provision of Your Personal Data
The provision of your personal data as part of an application is generally voluntary.
However, in order to conduct the application process, we require the information necessary to assess your application and decide on possible employment. Without this information, we may not be able to consider your application, or may only be able to consider it to a limited extent.
11. Your Rights
Subject to the applicable legal requirements, you have in particular the following rights:
- the right to obtain information about the personal data we process about you pursuant to Art. 15 GDPR,
- the right to rectification of inaccurate data pursuant to Art. 16 GDPR,
- the right to erasure pursuant to Art. 17 GDPR,
- the right to restriction of processing pursuant to Art. 18 GDPR,
- where applicable, the right to data portability pursuant to Art. 20 GDPR, and
- where applicable, the right to object pursuant to Art. 21 GDPR.
Where processing is based on your consent, you may withdraw that consent at any time with effect for the future.
You may also withdraw your application at any time.
To exercise your rights, you may contact us using the contact details provided in Section 1.
12. Right to Lodge a Complaint
Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes applicable data protection law.
The supervisory authority particularly responsible for nodeline GmbH is:
The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (LfDI BW)
Heilbronner Straße 35
70191 Stuttgart
Germany
