1. Description of the Data Protection Activities
The privacy notice is provided in connection with our applicant management process for filling advertised positions. Applications are typically submitted electronically via the Internet; alternatively, you may also send your application to us by mail, in which case it will be processed electronically.
2. Name and Contact of the Controller
American Academy in Berlin GmbH
Am Sandwerder 17-19
14109 Berlin
GermanyAmerican Academy in Berlin
14 East 60th Street, Suite 1104
New York, NY 10022
USA
3. Contact Details of the Company’s Data Protection Officer at the AAB GmbH
Lars Beitlich
IfDuS GmbH
Landsberger Str. 396
81241 München
Tel.: +49 (89) 85 63 346 – 0
Fax: +49 (89) 85 63 346 – 90
E-Mail: privacy@ifdus.de
4. Purposes, Categories, and Legal Bases of the Data Processing
| Purpose | Categories | Legal Bases |
|---|---|---|
| Filling advertised positions, processing applications, managing applicant data | Name, titles, and academic degrees; Address and contact information; Description of work experience, skills, and education; Application materials (e.g. resume, work experience, skills, etc.); Group characteristics (e.g. applicant group); History of business relationship as reflected in correspondence; References |
Your data is processed based on our pre-contractual obligations pursuant to art. 6, para. 1 lit. b of the General Data Protection Regulation in conjunction with Section 26 of the BDSG-neu. If the pre-contractual obligations do not apply in individual cases, we would obtain your consent pursuant to art. 6, para. 1 lit. a of the General Data Protection Regulation. |
| Filling open positions through recruiters | Name, titles, and academic degrees; Address and contact information; Description of work experience, skills, and education; Application materials (e.g. resume, work experience, skills, etc.); Group characteristics (e.g. applicant group); History of business relationship as reflected in correspondence; References |
Your data is processed based on our (pre-)contractual obligations pursuant to art. 6, para. 1 lit. b of the General Data Protection Regulation in conjunction with Section 26 of the BDSG-neu. If the pre-contractual obligations do not apply in individual cases, we would obtain your consent pursuant to art. 6, para. 1 lit. a of the General Data Protection Regulation. |
| Inclusion in the talent pool | Name, titles, and academic degrees; Address and contact information; Description of work experience, skills, and education; Application materials (e.g. resume, work experience, skills, etc.); Group characteristics (e.g. applicant group); History of business relationship as reflected in correspondence; References; Evaluations |
Your data is processed based on your consent pursuant to art. 6, para. 1 lit. a of the General Data Protection Regulation. |
| Purpose | Categories | Legal Bases |
| Security | Name, titles, and academic degrees; Address and contact information; Description of work experience, skills, and education; Application materials (e.g. resume, work experience, skills, etc.); Group characteristics (e.g. applicant group); History of business relationship as reflected in correspondence; References; Certificate of good conduct |
Your data is processed based on our legitimate interest pursuant to art. 6, para. 1 lit. f of the General Data Protection Regulation (protection of the company). |
| Complaint management and handling of disputes and legal proceedings | Name, titles, and academic degrees; Address and contact information; Description of work experience, skills, and education; Application materials (e.g. resume, work experience, skills, etc.); Group characteristics (e.g. applicant group); History of business relationship as reflected in correspondence; References; Job interview; Evaluations |
Your data is processed based on our legitimate interests in protecting the company’s assets, ensuring quality control, and safeguarding against harm, as well as enforcing our rights and obligations, in accordance with art. 6, para. 1 lit. f of the General Data Protection Regulation. |
5. Source of the Data
The controller collected the personal data directly from you, received it from a recruitment agency, or the data is coming from publicly available sources of which the publication purpose is compatible with the processing activities described in this document.
6. Recipients or Categories of Recipients of Personal Data
Processors appointed by the company include cloud service providers, other companies of the corporate group, and service providers who are essential for corporate services, e.g. companies offering IT services, experts, and consultants. Otherwise, your data will not be disclosed.
7. Transfer of Personal to Third Countries
The data may be transferred to countries within and outside of the European Economic Area, in particular also to the United States of America. The company takes adequate and suitable security measures pursuant to applicable data protection laws to protect your data and ensure secure data transmission.
8. Duration of Retention of Personal Data
Once collected, your data will be stored for as long as necessary to fulfill the respective tasks, in accordance with the statutory retention periods.
| Purpose | Retention Period |
|---|---|
| Filling advertised positions through recruiters, processing applications, managing applicant data, evidence of lawfulness | Up to 90 days after the position is filled; after that, your data will be anonymized. Applicant data may be included in the personnel file as employee data upon hiring. |
| Inclusion in the talent pool | Until you revoke your consent or for a maximum of 18 months. After that, your data will be anonymized. |
| Security | Up to 90 days after the position is filled; after that, your data will be anonymized. |
| Complaint management and handling of disputes and legal proceedings | Until the expiration of any applicable statutory time limits following the conclusion of the matter |
9. Rights of the Data Subjects
Pursuant to the European GDPR you, the data subject, have the following rights:
If your personal data is processed, you have the right of information on which data concerning you was processed (art. 15 GDPR).
In case inaccurate personal data was processed, you have the right to obtain rectification of the data concerning you (art. 16 GDPR).
Where the legal requirements are met, you may request erasure of your data or restriction of processing and object to the processing of the data concerning you (art. 17, 18 and 21 GDPR).
If you have consented to data processing or a contract pertaining to data processing exits or data processing is carried out by automated means, you have the right of data portability – where applicable (art. 20 GDPR).
Should you exercise any of the rights mentioned above, the controller reviews if the legal requirements are met for this purpose.
To exercise your rights, please contact the Data Protection Officer in charge. In case of any data protection complaints you can contact the competent supervisory authority, the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).
10. Right of Revocation of Consent
If you have consented to the processing of your personal data by the controller having made an according declaration, you may revoke the consent with effect for the future at any time. The lawfulness of data processing carried out until the revocation remains unaffected by this due to your former consent.
Updated on: 26.08.2026