Data protection information for the use of softgarden Software as a Service

The scope of the processing of personal data mainly results from the description of processed data categories (Annex 1 of the contract for commissioned data processing). The annex to our contract for commissioned data processing also covers special categories of personal data. The exact scope of the data processed by you depends on the one hand on the requirements of the job advertisements and on the other hand on the scope of the data provided by the applicant. The data categories described in Annex 1 are therefore “broad”.

A description of the technical and organisational measures (TOMs for short) can be found in Annex 2 to our contract for commissioned processing. To prove compliance with and further development of these measures, softgarden conducts regular internal and external audits and reviews in addition to a data protection and information security management system (DSMS/ISMS).

softgarden provides all services related to the Talent Acquisition Suite (applicant management system) as a processor, insofar as personal data are not expressly processed for its own business purposes and may be processed legitimately. Pursuant to Art. 4 No. 7 GDPR, the data controller for the use of the softgarden Talent Acquisition Suite (applicant management) is the customer company. In addition, processors (softgarden) are also data controllers within the meaning of the GDPR, for example with regard to their own subcontractors or processing for their own business purposes.

A third-country transfer of applicant data in the applicant management system does not take place and is not planned. Our software is hosted in data centres in Germany. Maintenance and operation are also carried out from Germany by softgarden employees. Furthermore, a third country transfer is only considered if the special data protection requirements are guaranteed.

It is important to us that our subcontractors meet adequate security standards. For example, in the context of contract processing, we pay particular attention to compliance with the GDPR and additionally to common security standards, such as certification according to ISO27001.
Our data centres provide us with housing services, i.e. they provide us with power, rack space and internet, including firewalls, load balancers and secure SSL certificates. Maintenance and installation of hardware and software is done by softgarden. The used data centres are checked and audited by softgarden in regular intervals. The data centres are an unconditional contractual component of the service and order processing, without which we cannot provide our products. Currently, data centres of the following providers are used.

• myLoc managed IT AG, Am Gatherhof 44, 40472 Dusseldorf, Germany
• PlusServer GmbH, Welserstraße 14, 51149 Cologne, Germany
• Equinix Germany GmbH, Kruppstraße, 60388 Frankfurt am Main, Germany

For the so-called “CV parsing” we use a service of Textkernel B.V. Nieuwendammerkade 26 A 5, (1022AB) Amsterdam, the Netherlands. Textkernel is a subcontractor verified by softgarden in the context of order processing. As “CV parsing” is an optional and not an unconditional part of the contract, the use by our customers must be confirmed separately in the recruiter backend (so-called “opt-in”). Textkernel uses AI technologies to analyse CVs and to put them into a structured format. This data is temporarily stored by Textkernel on a server in Germany and cleaned once a week.

For calendar integration, softgarden uses a service provided by Cronofy Limited, 1 Broadway, Nottingham, NG1 1PR, England. Cronofy is a subcontractor of softgarden within the framework of order processing and represents an optional contractual component of the applicant management system. Cronofy can be used by our customers after a separate “Opt-In” in the Recruiter backend. The service is not activated by default. Further information on the technology and data protection can be found in the proofs provided by Cronofy.

You can find the proofs and certifications of our subcontractors here:

• ISO certificate and evidence myLoc (a WIIT company)
• ISO certificate and evidence PlusServer
• ISO certificate and evidence Textkernel
• ISO certificate and evidence Cronofy

softgarden uses Zendesk as a tool to process support requests. In our relationship with Zendesk, we see ourselves as a data controller in the sense of data protection laws. Thus, Zendesk is not a subcontractor in the sense of order processing. We base the use of Zendesk in the context of support and thus the disclosure of our customers’ data (specifically, the business email address of the user submitting the request) on the legitimate interest pursuant to Art. 6 (1) lit. f GDPR. Alternatively, it is possible to contact the direct contacts with a request, e.g. by email. Zendesk stores data in the USA.

Training and committing employees to the confidentiality of personal data and customer information is part of both onboarding and offboarding as well as data protection and information security management at softgarden. For this purpose, we regularly conduct internal data protection and awareness trainings with a focus on data protection and information security. Our experts in this area are available to all colleagues as contact persons.

In the event of a failure, a restore can usually take place immediately or on the same day. Files, databases and complete hard disks are backed up. There is redundant mirroring of the productive environment, so that even in the event of a failure of one data centre, productive operation can be started up in another data centre. Backups are geo-redundantly saved on encrypted data carriers. Among others, rsnapshot and cepth rbd are used. Restore tests are carried out on a random basis. Backups are monitored and verified.