Privacy Policy for Job Applicants 

We are delighted that you are interested in our company and have applied, or are applying, for a position with us. We would like to provide you with the following information regarding the processing of your personal data in connection with your application.

Who is responsible for data processing?

The data controller within the meaning of data protection law is

For applicants to CRS Clinical Research Services Mannheim GmbH (“hVIVO Mannheim”) and CRS Clinical Research Services Kiel GmbH (“hVIVO Kiel”)

  • CRS Clinical Research Services Mannheim GmbH Grenadierstraße 1 68167 Mannheim

For applicants to CRS Clinical Research Services Berlin GmbH

  • CRS Clinical Research Services Berlin GmbH Siemensdamm 65 13627 Berlin

You can find further information about the companies mentioned on our website: https://www.hvivo.com

What data do we process? And for what purposes?

We process the data you have sent us in connection with your application in order to assess your suitability for the role (or, where applicable, other vacant positions within our companies) and to carry out the recruitment process.

Insofar as we deem it necessary for the purpose of filling the vacancy, we may also collect personal data about you from third parties. This may involve, for example, an internet search or a search on social media platforms (e.g. LinkedIn, XING). In this regard, we would like to draw your attention in advance to the additional information provided at the end. We will then provide you with any further information that may be required in such cases under Article 14 of the GDPR – where necessary – separately.

What is the legal basis for this?

The legal basis for the processing of your personal data in this recruitment process is primarily Article 6(1)(b) of the GDPR.

Accordingly, the processing of data necessary in connection with the decision on whether to establish an employment relationship is permitted.

Should the data be required for legal proceedings after the application process has been completed, data processing may take place on the basis of the conditions set out in Article 6 of the GDPR, in particular to pursue legitimate interests under Article 6(1)(f) of the GDPR. Our interest in such cases is to assert or defend claims.

Where special categories of personal data within the meaning of Article 9 of the GDPR are processed (e.g. health data), the legal basis is Section 26(3) of the Federal Data Protection Act (BDSG) or Article 9(2)(b) of the GDPR in conjunction with Article 6(1)(b) of the GDPR.

How long is the data retained?

Data relating to applicants is deleted after 3 months in the event of a rejection.

If you have consented to the continued storage of your personal data, we will transfer your data to our talent pool. The data will be deleted from there after two years.

If you have been offered a position as part of the application process, the data will remain in our HRworks personnel system and will be transferred within the system from ‘applicant’ status to ‘employee’ status.

To whom is the data disclosed?

We use the HRworks HR system for the application process. HRworks may also gain access to your personal data in connection with the maintenance and upkeep of the system.

We have entered into a so-called data processing agreement with this provider, which ensures that data processing is carried out in a lawful manner.

Your application details will be reviewed by the HR department upon receipt of your application. Suitable applications are then forwarded internally to the department heads responsible for the relevant vacant position. The next steps are then coordinated. Within the company, access to your data is restricted to those individuals who require it for the proper conduct of our recruitment process.

Due to the Group’s structure, the head of department responsible for the vacancy may be an employee of the parent company, hVIVO Services Limited, Floor 24, 40 Bank Street, London, E14 5NR. In such cases, it is necessary to forward your application documents to the United Kingdom. The legal basis is Article 6(1)(f) in conjunction with Recital 48.

The European Commission has adopted an adequacy decision for the UK, meaning that an equivalent level of protection exists.

Your rights as a ‘data subject’

You have the right to access the personal data we process about you.

If you make a request for access, please understand that we may ask you to provide evidence proving that you are the person you claim to be.

Furthermore, you have the right to rectification, erasure or restriction of processing, insofar as you are entitled to this by law.

You have the right to object to the processing of your data within the framework of the statutory provisions. The same applies to the right to data portability.

Our Data Protection Officers

We have appointed a Data Protection Officer within our company. You can contact them using the following details:

  • CRS Clinical Research Services Mannheim GmbH – Data Protection Officer – Grenadierstraße 1 68167 Mannheim

    • Email: ds_datenschutzbeauftragter@hvivo.de

  • CRS Clinical Research Services Berlin GmbH - Data Protection Officer - Siemensdamm 65 13627 Berlin

    • Email: datenschutzbeauftragter@crs-group.de

Right to lodge a complaint

In principle, you have the right to lodge a complaint with a data protection supervisory authority regarding our processing of personal data.

  • CRS Berlin: Berlin Commissioner for Data Protection and Freedom of Information, Friedrichstrasse 219, 10969 Berlin, Tel. 030/ 13889-0, Email: mailbox@datenschutz-berlin.de

  • CRS Kiel: Independent State Centre for Data Protection Schleswig-Holstein, PO Box 7116, 24171 Kiel, Tel. 0431 988-1200, Email: mail@datenschutzzentrum.de

  • CRS Mannheim: State Commissioner for Data Protection and Freedom of Information, Baden-Württemberg, PO Box 102932, 70025 Stuttgart, Tel. 0711/ 615541-0, Email: poststelle@lfdi.bwl.de

In addition, you may contact any other data protection supervisory authority.

Additional information on the processing of personal data not collected from the data subject (Article 14 of the GDPR)

In the event that we process personal data relating to you as part of the recruitment process which we have not received directly from you, the following additional information applies:

Categories of data that we may process in this context include information about you that is generally accessible on the internet or can be found via social media platforms (e.g. LinkedIn, XING). It may also include data relating to previous employment. The legal basis for this data processing is Article 6(1)(f) of the GDPR, whereby our legitimate interest lies in finding the most suitable candidates for the respective positions.

In the event that we process personal data about you that we have not collected from you, we will inform you separately of the source of the personal data, unless you already have this information. For further information required under Article 14 of the GDPR, please refer to the information contained in this privacy notice.

This policy was last reviewed and updated: July 2026