Please read the following information carefully before sending your data to us.

1. Name and address of the controller The controller and service provider is LeasePlan Deutschland GmbH, Lippestr. 4, 40221 Düsseldorf (hereinafter ‘LeasePlan’).

2. Name and address of the data protection officer Our data protection officer is the lawyer Dr Karsten Kinast, Kinast Rechtsanwaltsgesellschaft mbH, Hohenzollernring 54, 50672 Köln. You can contact our data protection officer at any time if you have any questions relating to data privacy. You can send an e-mail to: marketing.de@leaseplan.com or a letter to: LeasePlan Deutschland GmbH, Lippestr. 4, 40221 Düsseldorf.

3. What is personal data? Personal data comprises information that can be used to learn about your personal or factual circumstances (e.g. your name, address, telephone number, date of birth, or e-mail address). Information which we cannot use (or only with disproportionate effort) to establish a reference to your person, for example by means of anonymization, is not personal data.

4. What personal data do we process? If you wish to send an online application for a job to LeasePlan Deutschland GmbH we will need you to provide certain information about yourself. The following data are collected and processed in connection with online applications: • Salutation • First name • Surname • Street and house no. • Post code and place • E-mail address • Landline/mobile telephone no. • Salary expectation (gross/annual) • Uploaded application attachments.

5. Purpose of data collection and processing The application data are collected and processed by LeasePlan Deutschland GmbH for the purpose of processing the application. For the purpose of carrying out the application procedure, your application data may also be forwarded to ALD Autoleasing D GmbH, which also belongs to Société Générale and thus to the same group of companies as LeasePlan Deutschland GmbH.

6. Legal basis The personal data of job applicants is generally only collected and used after their consent has been obtained. The processing of personal data is lawful under Art. 6(1) a) of the EU’s GDPR provided we obtain the consent of the data subject to processing activities involving personal data.

7. Security, SSL technology We take appropriate technical and organisational measures to protect personal data against accidental or deliberate manipulation, loss, destruction and unauthorised access. These measures are regularly optimised and upgraded to reflect the state-of-the-art. Personal data transferred between your computer or mobile device and our server is always encrypted (Secure Socket Layer (SSL) procedure).

8. Data subject rights 8.1. Right to information You have the right to obtain information from us at any time about the data concerning you that we store, where we obtained them, recipients and categories of recipients of these data and the purposes for which they are stored.

8.2. Right of revocation If you have provided your consent to the use of your data, you can revoke it at any time with future effect and without stating reasons.

8.3. Right to rectification If the personal data concerning you that we store is incorrect you can instruct us to correct it at any time.

8.4. Right to erasure and blocking You have the right to instruct us to block or erase the personal data concerning you that we store. Personal data is generally erased within 2 working days of the data subject exercising this right. If it is not possible for us to erase your personal data due to statutory, contractual, tax or commercial law archiving requirements or for other legal reasons, the data can be blocked instead of erased. After the erasure of your data it is no longer possible for us to provide information about it. Application data are erased 6 months at the latest after the end of the application process.

8.5. Right to data portability If you instruct us to transfer your personal data to you, we will send the data to you or another controller in a structured, commonly used and machine-readable format. However, the latter only applies if it is technically feasible.

8.6. Contact for exercising data subject rights When you send an e-mail to marketing.de@leaseplan.com or a letter to LeasePlan Deutschland GmbH, Lippestr. 4, 40221 Düsseldorf, we will store the data that you provide to us (your e-mail address, or your name and telephone number) in order to respond to your question or comply with your request. We delete all data in this connection when it is no longer necessary to store it, or we restrict the processing of that data if we are required to comply with statutory archiving requirements.

9. Right to lodge a complaint with a supervisory authority You have the right to lodge a complaint with the competent supervisory body regarding the processing of your personal data if you believe that your rights under the GDPR have been infringed.

10. Amendment of this privacy policy Due to the exponential development of the internet and developments in case law we reserve the right to adapt this privacy policy to technical and legal requirements at any time. We also refer to our general privacy policy for our websites