Privacy notice for applicants

Information pursuant to Article 13 GDPR · Version: August 2026

This is a translation provided for your convenience. In case of any discrepancy, the German version of this notice shall prevail.

Thank you for your interest in working at LESER GmbH. Below we explain how we process your personal data when you apply to us. This notice supplements our general privacy policy and takes precedence for the application process.

1. Controller and contact for applications

The controller for the processing of your application data within the meaning of the GDPR is:

For all questions concerning your application and the protection of applicant data, please contact exclusively:

2. Data protection officer

You can reach the data protection officer appointed by LESER GmbH at:

3. Purpose and legal basis of processing

We process your application data exclusively for the purpose of handling your application and assessing your suitability for the advertised position. The legal basis is Article 6(1)(b) GDPR in conjunction with Section 26(1) of the German Federal Data Protection Act (BDSG), as participation in an application procedure constitutes steps preliminary to an employment contract.

Where we process special categories of personal data within the meaning of Article 9(1) GDPR (for example information on severe disability) in the course of the application procedure, we do so pursuant to Article 9(2)(b) GDPR, in order to exercise rights and fulfil obligations arising from employment law and the law of social security and social protection.

Where we determine the approximate distance between your place of residence and our site, and retain your data until the periods set out in section 8 expire, we rely on Article 6(1)(f) GDPR. Our legitimate interest lies in assessing the commute and in meeting our obligations to provide evidence.

If you voluntarily join our talent pool beyond the current application procedure, we additionally process your data on the basis of your consent pursuant to Article 6(1)(a) GDPR. You may withdraw consent at any time with effect for the future. The lawfulness of processing carried out before withdrawal remains unaffected.

4. Which data we process

• Name and contact details (e-mail, telephone and, depending on the application route, postal address or postcode and place of residence)
• Application documents: CV, references and, where applicable, a covering letter
• Details of qualifications, professional experience, salary expectations and earliest possible starting date
• If you apply via our form, additionally: the field of activity you selected, the desired type of employment (for example full-time, part-time, apprenticeship) and your answer to the free-text question
• Answers to position-specific questions as well as the source and channel of your application
• If you consent to being included in our talent pool: the time of your consent and the version of the consent text shown to you. We store this because we must be able to demonstrate consent (Article 7(1) GDPR)

We deliberately do not collect information on age, gender, marital status, religion, ethnic origin, political opinions or health. Please refrain from sending us such information unprompted. We do not require a photograph.

You are not obliged to inform us of a severe disability or equivalent status. If you disclose it voluntarily, we process this information solely in order to exercise rights and fulfil obligations under Book Nine of the German Social Code. No disadvantage arises from not disclosing it.

From your place of residence we determine the approximate distance to our site in Lahr. This serves solely to assess the commute and is not in itself a ground for exclusion. We take the place of residence from your application documents. We do not use a postcode that you enter in our application form for this purpose; it serves solely as a rough geographical classification.

The desired type of employment serves exclusively to allocate your application and is not used for pre-selection.

Information on the origin of your application, for example the page through which you reached us, is used solely internally to understand which routes lead applicants to us. No data is transmitted back to advertising networks.

Providing your data is neither required by law nor by contract. However, without the details marked as mandatory fields and without your application documents we cannot assess your application. All other details are voluntary and no disadvantage arises from withholding them.

5. Application routes and channels

You can apply to us in the following ways:

• Via the application form on our careers page
• By e-mail to personal(at)leser.de
• Via our careers portal at Workwise (leser.workwise.io)
• Via the job portals Indeed and Join as well as the job exchange of the German Federal Employment Agency

Applications received via external portals are technically forwarded to our internal application inbox and processed there. The privacy provisions of the respective provider additionally apply to your data held on those portals.

6. Use of artificial intelligence

7. Recipients of your data

Internally, only those persons involved in the application procedure have access to your application (management, our human resources team and the relevant specialist department). In addition, we use the following carefully selected service providers, with whom data processing agreements pursuant to Article 28 GDPR are in place:

Your application data is processed on servers in Germany and the European Union. Neither we nor the service providers we commission transfer it to a country outside the EU or the EEA. Notification of incoming applications is handled by our own systems; the dispatch service of our form provider is deliberately deactivated.

If you apply via one of the job portals named in section 5, the privacy provisions of the respective provider additionally apply to the data you store there. Depending on the portal, this may involve processing outside the EU over which we have no influence. This notice applies to processing from the moment your application reaches us.

8. Storage period and erasure

• If your application is rejected or withdrawn: We erase your application data as soon as the procedure has concluded for you, at the latest six months after the rejection. As a rule we erase immediately after sending the rejection. The six months are an upper limit and are based on our legitimate interest (Article 6(1)(f) GDPR) in answering follow-up questions and being able to meet obligations to provide evidence under the German General Act on Equal Treatment.
• Unsolicited applications without a specific position: We erase your documents at the latest six months after receipt, unless you have consented to inclusion in our talent pool.
• Talent pool: Inclusion takes place only with your express consent and for six months from the submission of your application. If you receive a rejection before then, your data remains stored until those six months have elapsed and is erased thereafter. You may withdraw your consent at any time with effect for the future, informally by e-mail to personal(at)leser.de.
• Applications via our form: Your details and uploaded files are erased at the form provider immediately after transfer into our application system. For technical reasons they subsequently remain there in the recycle bin for up to 90 days before being finally removed.
• Technical execution logs: Application data remains in the logs of our processing steps for up to 30 days and is then removed automatically.
• If your application is successful: The data provided is further processed on the basis of Article 6(1)(b) GDPR in conjunction with Section 26(1) BDSG for the purpose of performing the employment relationship and is transferred to the personnel file. Statutory retention periods apply there.

9. Your rights

You have the following rights as a data subject:

• Right of access pursuant to Article 15 GDPR
• Right to rectification pursuant to Article 16 GDPR
• Right to erasure pursuant to Article 17 GDPR
• Right to restriction of processing pursuant to Article 18 GDPR
• Right to notification pursuant to Article 19 GDPR
• Right to data portability pursuant to Article 20 GDPR
• Right to withdraw consent given pursuant to Article 7(3) GDPR
• Right to object pursuant to Article 21 GDPR to processing based on a legitimate interest. This concerns in particular the assessment of the commute and the AI-supported preparation described in section 6. An informal message to personal(at)leser.de is sufficient.
• Right to lodge a complaint with a data protection supervisory authority pursuant to Article 77 GDPR

The competent authority for LESER GmbH is the State Commissioner for Data Protection and Freedom of Information of Baden-Wuerttemberg (baden-wuerttemberg.datenschutz.de).

10. Contact

For information, to exercise your rights or for questions about the protection of applicant data, you can reach us at personal(at)leser.de.