Privacy statement

2. Purpose of data collection

thyssenkrupp Steel Europe generally uses your personal data to answer your inquiry, process your order or provide you with access to special information or offers. However, thyssenkrupp Steel Europe would also like to make your job search easier. On the following pages you can therefore apply directly online for jobs at the respective Group companies. We assure you that your details will be treated confidentially. The data entered here will be processed and used exclusively for the purpose of selecting applicants.

Primarily, the data processing serves the decision on the establishment of the employment relationship. The primary legal basis for this is Art. 6 (1) b) GDPR in conjunction with §26 (1) BDSG.

For the processing of your data within the framework of the applicant management system, we request your consent in accordance with Art. 6 Para. 1 a) GDPR in conjunction with § 26 (2) BDSG.

3. What data is collected?

On the following pages we collect the information required for an application process at thyssenkrupp Steel Europe.

If you apply for a job at a Group company, you will be asked for certain personal data (name, address, e-mail). In addition, position-related questions may be asked. For an application at our company, it is also mandatory to include your professional background.

For security reasons, we will send you a confirmation email after you have registered with us online and applied for a job.

Please note that your data will not be stored anonymously, but will be accessible to the Recruiting team and the relevant departments of the Group companies for the position.

4. Application information

By submitting your application, you represent that the information you have provided is true and correct. Please note that any false statement or omission may constitute grounds for rejection or subsequent dismissal. Moreover, participation in this online application process is formally valid even without providing a signature.

The companies in the thyssenkrupp Steel Europe Group are looking for the best applicants, regardless of race, ethnic origin, gender, religion or belief, disability, age or sexual identity. We do not require any information from you that is not usable under the General Equal Treatment Act. Please also do not forward to us any confidential internal information or even trade secrets of your former or current employer. In addition, please do not provide any unnecessary information about:

• Diseases
• Pregnancy
• ethnic origin, political views, philosophical or religious beliefs, trade union membership, physical or mental health, or sex life
• defamatory or dishonorable information
• Information that has nothing to do with the job profile

5. Who processes the data?

The data collected by thyssenkrupp Steel Europe is processed exclusively by contractually affiliated group service providers. Personal data is only passed on for specific purposes as part of contract processing in accordance with data protection regulations to bodies which, for example, operate our servers or provide certain services. These entities are located in Germany and in the countries of the EU and are bound by contractual obligations and data protection instructions to handle personal data in accordance with data protection law.

Depending on the job(s) and the company(ies) to which you have applied, the persons within the company(ies) concerned who are necessary to fill vacancies, such as recruiters, will have access to your applicant profile.

In the thyssenkrupp Steel Europe applicant pool, the people responsible for filling vacancies from different Group companies can search for suitable profiles and have access to your data.

If special categories of personal data are processed within the EU/EEA within the meaning of Art. 9 (1) GDPR, this serves the exercise of rights or the fulfillment of legal obligations under labor law, social security law and social protection within the scope of the application procedure. The legal basis for this processing is Article 9 (2) (b) EU GDPR in conjunction with § 26 (3) BDSG.

In addition, employees of contract processors have access to your personal data in order to perform and fulfill their contractual administrative and support tasks. Personal data is only passed on for specific purposes within the framework of order processing in accordance with data protection regulations to bodies that, for example, operate the servers or provide certain services.

For the aforementioned purposes, we have individual services performed by carefully selected and commissioned service providers (such as IT service providers, communication service providers). In individual cases, these service providers are located outside the EU/European Economic Area ("third country"). In these cases, a third country transfer of personal data takes place. The third country transfer takes place in compliance with the data protection requirements of the EU and the applicable national law. In order to establish an adequate level of protection for your data, the thyssenkrupp Group implements safeguards in accordance with legal requirements to establish an adequate level of data protection, including EU standard contractual clauses. You have the option of requesting a sample of these guarantees from the thyssenkrupp Group.

6. With whom do we share your personal data?

The information you provide to us will be treated confidentially and will only be passed on within the respective Group company to those persons who are involved in a specific application process. Your personal data will only be passed on to other Group companies with your separate, explicit consent.

Please refer to the corresponding note on the website.

7. Right of access, editing and deletion of your resume.

You can view, change or delete your resume at any time. You can also ask us to help you with this.

Please understand that for legal reasons it is not possible to change or delete data during an ongoing application process or for a period of approximately three months after completion of an ongoing application process.

8. Data security

We protect our data with data security measures that comply with current legal regulations on data protection and the state of the art (including firewalls, virus scanners, intrusion detection software).

9. Malfunctions

thyssenkrupp Steel Europe gives no guarantee that the career pages will be available at all times.

10. Modification of the privacy policy

If we decide to change the content of this privacy statement, we will post those changes on our careers page. If we change this privacy statement, we will always provide links to previous versions in a way that is easy to find.

11. How long will your data be stored?

Your application will be deleted 6 months after completion of the application process, unless longer or shorter storage is required for legal or statutory reasons. The period begins with the receipt of the rejection of your application.

12. Are you obliged to provide your data?

There is no contractual or legal obligation to provide personal data. However, without processing your personal data, you cannot participate in the meeting in person, but only virtually.

13. What data protection rights can you assert as a data subject?

You have the right to request information about the data stored about you, Art. 15 GDPR. In addition, you can request the correction or deletion of your data, Art. 16, 17 GDPR. You may also have the right to restrict the processing of your data and the right to receive the data you have provided in a structured, common and machine-readable format, provided that this does not adversely affect the rights and freedoms of other persons, Art. 18, 20 GDPR.

If you have given us consent to process your personal data, you can revoke this consent at any time. The lawfulness of the processing carried out on the basis of the consent until the revocation remains unaffected.

To exercise these rights, please contact the data controller or data protection officer named in section 1.

In addition, you have a right to object, which is explained in more detail at the end of this privacy notice.

You also have the possibility to lodge a complaint with a data protection supervisory authority, Art. 77 GDPR. The right of appeal is without prejudice to any other administrative or judicial remedy. The data protection supervisory authority responsible for us – see section 1.

Status: 01.07.2021

Information about your right to object according to Art. 21 of the General Data Protection Regulation (GDPR)

You have the right to object at any time on grounds relating to your particular situation to the processing of personal data relating to you which is carried out on the basis of Article 6 (1) (f) of the DSGVO (data processing on the basis of a balance of interests) (e-mail: [email protected]); this also applies to any profiling based on this provision within the meaning of Article 4 No. 4 GDPR.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the purpose of asserting, exercising or defending legal claims.

The objection can be made without any formalities and should, if possible, be addressed to the data controller or data protection officer named in the data protection declaration under point 2.