Data protection information for the use of softgarden Software as a Service

The scope of the processing of personal data mainly results from the description of processed data categories (Annex 1 of the contract for commissioned data processing). The annex to our contract for commissioned data processing also covers special categories of personal data. The exact scope of the data processed by you depends on the one hand on the requirements of the job advertisements and on the other hand on the scope of the data provided by the applicant. The data categories described in Annex 1 are therefore “broad”.

A description of the technical and organisational measures (TOMs for short) can be found in Annex 2 to our contract for commissioned processing. To prove compliance with and further development of these measures, softgarden conducts regular internal and external audits and reviews in addition to a data protection and information security management system (DSMS/ISMS).

softgarden provides all services related to the Talent Acquisition Suite (applicant management system) as a processor, insofar as personal data are not expressly processed for its own business purposes and may be processed legitimately. Pursuant to Art. 4 No. 7 GDPR, the data controller for the use of the softgarden Talent Acquisition Suite (applicant management) is the customer company. In addition, processors (softgarden) are also data controllers within the meaning of the GDPR, for example with regard to their own subcontractors or processing for their own business purposes.

A third-country transfer of applicant data in the applicant management system does not take place and is not planned. Our software is hosted in data centres in Germany. Maintenance and operation are also carried out from Germany by softgarden employees. Furthermore, a third country transfer is only considered if the special data protection requirements are guaranteed.

You can find a current list of our subcontractors in our terms of use: Appointed subcontractors

You can find the certificates and certifications of our subcontractors here:

• ISO certificate and evidence myLoc (a WIIT company) (PDF)
• ISO certificate and evidence Textkernel (PDF)
• ISO certificate and evidence Cronofy (PDF)

softgarden uses Zendesk as a tool to process support requests. In our relationship with Zendesk, we see ourselves as a data controller in the sense of data protection laws. Thus, Zendesk is not a subcontractor in the sense of order processing. We base the use of Zendesk in the context of support and thus the disclosure of our customers’ data (specifically, the business email address of the user submitting the request) on the legitimate interest pursuant to Art. 6 (1) lit. f GDPR. Alternatively, it is possible to contact the direct contacts with a request, e.g. by email. Zendesk stores data in the USA.

Training and committing employees to the confidentiality of personal data and customer information is part of both onboarding and offboarding as well as data protection and information security management at softgarden. For this purpose, we regularly conduct internal data protection and awareness trainings with a focus on data protection and information security. Our experts in this area are available to all colleagues as contact persons.

In the event of a failure, a restore can usually take place immediately or on the same day. Files, databases and complete hard disks are backed up. There is redundant mirroring of the productive environment, so that even in the event of a failure of one data centre, productive operation can be started up in another data centre. Backups are geo-redundantly saved on encrypted data carriers. Among others, rsnapshot and cepth rbd are used. Restore tests are carried out on a random basis. Backups are monitored and verified.