Privacy Notice for the career website jobs.leonardo-hotels.com

Sunflower Management GmbH & Co KG / Leonardo Hotels

Landsberger Allee 117 A

10407 Berlin

Germany

Phone: +49 30 688 322 0

E-mail address: info@leonardo-hotels.com

Registered Office: Berlin

Amtsgericht Berlin-Charlottenburg

HRA 38202 B

UST ID: DE 250 42 1966

(hereinafter provider or responsible person)

General Partner:

Rennes Hotel Management GmbH

Landsberger Allee 117A

10407 Berlin

Registered Office: Berlin

Amtsgericht Berlin-Charlottenburg

HRB 98823 B

Managing Directors: Yoram Biton, Daniel Roger

Contact Details of Data protection officer:

Sunflower Management GmbH & Co KG / Leonardo Hotels

Data Protection Officer

Landsberger Allee 117 A

10407 Berlin Germany dataprotection@leonardo-hotels.com

Website: jobs.leonardo-hotels.com

The provider is the responsible party within the meaning of the General Data Protection Regulation and other national data protection laws of the member states as well as other data protection regulations.

With the following declaration, we inform you about the type, scope and purposes of the collection, processing and use of your data in connection with your visit to the website and any further use of the contents and services.

Summary

The provider stores and processes your personal data (hereinafter collectively referred to as processing) in compliance with the relevant data protection regulations, in particular the General Data Protection Regulation (GDPR/DSGVO), the German Federal Data Protection Act (BDSG) and the German Telemedia Act (TMG).

The provider observes the principle of data minimization. This means that data is processed to the extent necessary for the purposes of processing, as is appropriate and necessary for the provision of a functional website and with regard to the content and services offered. In this context, processing takes place either on the basis of prior consent or if permitted by legal regulations.

When you access the provider's website, the provider processes certain usage data to enable you to use its offer.

If you enter data in the provider's contact, order or registration forms, the provider will process this data exclusively for the purposes stated in each case. All processed personal data will be deleted by the provider after the expiration of the storage period.

You can find more information below.

I. General information on data processing

1. definitions

1. Personal data

Personal data means any information relating to an identified or identifiable natural person (hereinafter "data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

1. Inventory data

Inventory data is personal data of a user that is required for the establishment, content-related structuring or modification of a contractual relationship between the service provider and the user regarding the use of Telemedia.

1. Usage data

Usage data is personal data of a user that is required to enable and bill the use of Telemedia. This includes, in particular, features for identifying the user, information about the beginning and end as well as the scope of the respective use and information about the Telemedia used by the user.

1. Processing

Processing means any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organization, filing, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

1. Pseudonymization

Pseudonymization is the processing of personal data in such a way that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separate and is subject to technical and organizational measures to ensure that the personal data is not attributed to an identified or identifiable natural person.

1. Cookies

Cookies are small text files that are stored on your computer. Cookies always have a validity period, which can be limited to the end of the user session (so-called session cookies) or can also exist for a longer period (so-called permanent cookies). These permanent cookies remain on your computer and enable the provider or its partner companies (so-called third-party cookies) to recognize your computer on your next visit. You can set your browser so that you are informed about the setting of cookies and can decide individually whether to accept them or refuse the setting of cookies for certain cases or in general. If you do not accept cookies, the functionality of the website may be limited.

1. Website

A website, also known as a web presence, is the presence of a private or corporate provider of Telemedia on the worldwide web (World Wide Web), grouped together under a specific Internet address. Web presence includes websites and optionally available downloadable documents as well as other retrievable audiovisual media services.

2. existence of suitable guarantees

1. Pseudonymization

Insofar as the provider collects usage data, it always stores this under pseudonyms (in the case of cookies, for example, via a unique session key). The provider does not merge pseudonymous data with data about the bearer of the pseudonym (such as inventory data).

1. Use of encryption technologies

When transferring data between your computer or mobile device and the provider's server, the provider uses the SSL security system (Secure Socket Layer).

This technology is designed to protect your data from being read by unauthorized third parties and offers a very high security standard. You can recognize that your data is transmitted encrypted by the closed display of a key or lock symbol in the lower status bar of your browser.

II. processing

1. applicant management system job board

The provider publishes job advertisements via the job exchange section of its website. As a user of the website, you can apply to Leonardo Hotels for a specific job posting or submit a speculative application. Leonardo Hotels is made up of different legal entities which are operated by Sunflower Management GmbH & Co. KG and its affiliates within Europe. Therefore, if you apply for a specific job, your application data may be processed by other companies affiliated with the provider in several European Countries (including non-EU country Switzerland), depending on the location of the job you applied for.

Data collection (inventory data)

• Salutation (mandatory field)
• First name and last name (required)
• E-mail address (mandatory field)
• Application documents (such as cover letter, curriculum vitae (mandatory field), references, photo)

In the event of a successful application, the provider will retain your data for the duration of the employment relationship and delete your data within 60 days of its termination at the latest. Otherwise, your submitted data will be processed exclusively for the purpose of carrying out the application process and will be deleted within 60 days after completion of the application process.

Legal bases for the processing are Art. 6 para. 1 lit. b, 88 DSGVO, § 26 BDSG (new).

You have the possibility at any time to revoke your consent to the processing of personal data or to object to data processing that is not based on consent. The exercise of the revocation or objection can be made in particular by e-mail to hr.ho@leonardo-hotels.com. All personal data that the provider has stored in the course of your contact will be deleted in this case.

In principle, your right to object does not apply to data that the provider requires in the context of the fulfillment of a contract or pre-contractual measures. However, you may have other rights on the basis of which you can claim the deletion of your data.

2. job feed newsletter

If you register for the newsletter, the provider will use the e-mail address you entered to inform you about current job advertisements. You will find the option to register for the newsletter on the website of the job advertisement. The unsubscription is possible at any time at no costs (except for internet transmission costs) by clicking “unsubscribe” at the bottom of each newsletter or writing to hr.ho@leonardo-hotels.com.

Data collection (inventory data) - E-mail address (mandatory field)

Your submitted data will only be processed if you have given us prior consent. Your data will be deleted after 60 days after you have given your consent, unless you give us your consent again beforehand to process your data for the Job Feed newsletter.

The legal basis for the processing of data after consent of the user is Art. 6 para. 1 lit. a DSGVO.

You have the possibility to revoke your consent to the processing of personal data at any time. The exercise of the revocation can be made in particular by e-mail to hr.ho@leonardo-hotels.com. All personal data that the provider has stored in the course of your contact will be deleted in this case.

3. talent network

When you register with the Talent Network, you enable the provider or other Leonardo Hotels companies to maintain contact with you for your future career path. You will receive regular career news, invitations and information about professional and career events and special job offers.

Data collection (inventory data)

• Salutation (mandatory field)
• First name and last name (required)
• E-mail address (mandatory field)
• voluntary: application documents (such as cover letter, CV (mandatory field), certificates, photo)

Your transmitted data will only be processed if you have given the provider prior consent. Your data will be deleted by the provider if you unsubscribe from participation in the Talent Network.

The legal basis for the processing of data after consent of the user is Art. 6 para. 1 lit. a DSGVO.

You have the possibility to revoke your consent to the processing of personal data at any time. The exercise of the revocation can be made in particular by e-mail to hr.ho@leonardo-hotels.com. All personal data that the provider has stored in the course of your contact will be deleted in this case.

4. processing of log data

When accessing the provider's website, your internet browser automatically transmits certain data to the provider's server for technical reasons. The following data is collected separately from other data that you may transmit to the provider and used for the aforementioned purposes:

Data collection (usage data)

• Name of the accessed web page or URL,
• Date and time of retrieval,
• Access status / Http status code,
• amount of data transferred in each case,
• Website through which the request comes,
• Browser software and software version,
• Operating system and version,
• IP address (anonymized, shortened by the last 3 digits), - randomly generated key number of the cookie or session.

If the data is stored in log files, the usage data is deleted after 7 days at the latest. Storage beyond this period is possible in accordance with data protection law. In this case, the IP addresses are deleted or alienated so that it is no longer possible to assign the Internet page retrieval to your computer.

The legal basis for the storage of the data and the log files is Art. 6 para. 1 lit. f DSGVO in conjunction with. § 15 TMG.

The collection of data for the provision of the website and the storage of the data in log files is absolutely necessary for the operation of the website. Consequently, there is no possibility for the user to object. However, you can exercise your right to object by means of automated processes that use technical specifications, such as in the case of anonymization of your IP address by VPN providers.

The following section Use of cookies by the provider for web analysis is authoritative for the collection of usage data for the purpose of measuring reach.

5. use of cookies

a. Use of cookies of the provider for the purpose of website use (technically necessary cookie) The provider uses session cookies to make the visit to the website attractive and to enable the use of certain functions.

Data collection (usage data)

- randomly generated key number of the cookie or session.

The legal basis for the processing of the data is Art. 6 para. 1 lit. f DSGVO.

Technically necessary cookies are automatically stored on your computer and transmitted from it to our website. You have the option at any time to object to the data processing, which is not based on consent. In the case of technically necessary cookies, you as the user have control over their use. By changing the settings in your Internet browser, you can disable or restrict the transmission of cookies. You can delete cookies that have already been stored at any time.

b. Use of cookies of the provider for web analysis (technically not necessary cookie)

When the website is called up, the provider transmits permanent cookies for the purpose of web analysis of its Telemedia (so-called web analysis cookie). With the help of the web analysis cookie, the provider determines the user's usage data in pseudonymous form and can thus recognize, for example, how often the website is frequented by the respective pseudonymous Internet user from which regions and with which types of end devices the user accesses the website. The provider stores the information collected in this way exclusively on its server in Germany.

Data collection (usage data)

• Name of the accessed web page or URL,
• Date and time of retrieval,
• Http response code,
• Website through which the request comes,
• IP address (anonymized during processing and deleted from log files within 7 days),
• Browser type,
• randomly generated key number of the cookie or session.

The legal basis for the processing of usage data is Art. 6 para. 1 lit. f DSGVO.

If the data is stored in log files, the usage data is deleted after 7 days at the latest. Storage beyond this period is possible in accordance with data protection law. In this case, the IP addresses are deleted or alienated so that it is no longer possible to assign the Internet page retrieval to your computer.

Technically unnecessary cookies are automatically stored on your computer and transmitted from it to our website. You have the option at any time to object to the data processing, which is not based on consent. You can prevent a web analysis cookie from being set by clicking on the following link. A cookie will then be set that prevents the future collection of your data by the provider when you visit this website:

Disable Web Analytics

c. Table of cookies

6. further processing for other purposes

Unless otherwise stated above, your data will not be disclosed to third parties and will not be processed for purposes other than those stated.

III. data subject rights

You have a right of access to the personal data concerning you as well as the right to rectification or erasure or to restriction of processing or a right to object to processing as well as the right to data portability in accordance with the description below. In the cases of Sections 32 et seq. BDSG 2018, however, these claims exist only to the extent that they are provided for under the BDSG 2018.

You have the right:

- in accordance with Art. 15 DSGVO to request information about your personal data processed by the provider. In particular, you can request information about the processing purposes, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right of appeal,

the origin of their data, if it was not collected by us, as well as about the existence of automated decision-making, including profiling, and, if applicable, meaningful information about its details (see

III.1);

• in accordance with Art. 16 DSGVO to immediately demand the correction of incorrect or completion of your personal data stored by us ;
• pursuant to Art. 17 DSGVO to request the erasure of your personal data stored by us, unless the processing is necessary for the exercise of the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the assertion, exercise or defense of legal claims;
• in accordance with Art. 18 DSGVO to request the restriction of the processing of your personal data, insofar as the accuracy of the data is disputed by you, the processing is unlawful, but you object to its erasure and we no longer require the data, but you wish to delete it.

to assert, exercise or defend legal claims or you have objected to the processing pursuant to Art. 21 DSGVO;

• in accordance with Art. 20 DSGVO to receive your personal data that you have provided to us in a structured, common and machine-readable format or the transfer of to another responsible person;
• complain to a supervisory authority in accordance with Art. 77 DSGVO. As a rule, you can contact the supervisory authority of your usual place of residence or workplace or our company headquarters for this purpose which is the Berlin Data Protection Authority (Berliner Beauftragte für Datenschutz und Informationsfreiheit, Friedrichstr. 219, 10969 Berlin, www.datenschutz-berlin.de). We would, however, appreciate the chance to deal with your concerns before you approach the Authority so please contact us or our DPO in the first instance;
• to revoke your consent at any time in accordance with Art. 7 (3) DSGVO. This has the consequence that we may no longer continue the data processing based on this consent for the future(.

If your personal data is processed on the basis of legitimate interests pursuant to Art. 6 (1) p. 1 lit. f DSGVO, you have the right to object to the processing of your personal data pursuant to Art. 21 DSGVO, provided that there are grounds for doing so that arise from your particular situation or the objection is directed against direct advertising. In the latter case, you have a general right to object, which is implemented by us without specifying a particular situation.

If you wish to exercise your right of revocation or objection, simply send an e-mail to hr.ho@leonardohotels.com.

7. recipients of the personal data within the country

Use of Talention Analytics

This website uses the Talention Analytics program, which is used to analyze page views and page visitors. The Talention Analytics program is operated by TFI GmbH, Lise-Meitner-Straße 5-9, 42119 Wuppertal, Germany. Talention Analytics uses persistent cookies, which allow Talention to analyze the website by the user. The information stored in the cookie about the use of the website is transmitted to the web server of Talention Analytics and stored there. Talention Analytics anonymizes the IP address of the calling computer in the process. The data transmitted by the browser of the calling computer in the context of the use of Talention Analytics will not be merged with other data of the user, unless the user has given a corresponding consent. You can prevent the use of Talention Analytics by preventing the storage of the cookie through an appropriate setting in your browser software. In addition, you can permanently deactivate the Talention Analytics program by clicking on the link below. In this case, a socalled opt-out cookie will be set on your computer. This cookie will be read when you access this website and will result in Talention Analytics not being executed. Furthermore, Talention Analytics will not be executed if a Do-Not-Track procedure (see https://de.wikipedia.org/wiki/Do_Not_Track_(Software)) is activated in your browser.

Disable Talention analytics

The legal basis for the transmission of usage data is Art. 6 para. 1 lit. f DSGVO.

The Provider has concluded an order processing contract with TFI GmbH.

--- End of privacy policy ---