Privacy Policy

  1. Controller and Data Protection Officer

This privacy policy informs users of this website about the nature, scope, and purpose of the collection and use of personal data by the operator of the website https://mesalvo.com.

We take your data protection very seriously and always treat your personal data confidentially and in accordance with legal regulations. Due to new technologies and the continuous development of this website, changes to this privacy policy may be made. Therefore, we recommend that you visit our privacy policy regularly.

Status of the privacy policy: 19.01.2024

1.1 The controller within the meaning of Art. 4 No. 7 GDPR is:

Mesalvo GmbH
Heinrich-von-Stephan-Straße 25
D-79100 Freiburg

The authorized representatives are the managing directors:
Holger Cordes, Dr. Tino Großmann, William Oliver, PD Dr. med. Matthias Wuttke

The controller is headquartered in Freiburg (Register court: Freiburg, HRB 265645).

1.2 Data Protection Officer

For all questions regarding data protection concerning our website and our service offering or for exercising your personal rights, please contact our data protection officer:

Alexander Vogel
DATATREE AG
Märkische Straße 212-218
44141 Dortmund
Tel.: +49 231 54380-398
Email: dsb@datatree.ag

1.3 Responsible for content according to § 55 Abs. 2 RStV:

Mesalvo GmbH
Marketing & Communication, represented by Petra Janssen (President Sales & Marketing)
Heinrich-von-Stephan-Straße 25
D-79100 Freiburg

  1. Rights of the data subject

You can exercise your data protection rights at any time free of charge. Our data protection officer reviews and answers every request individually. You can find their contact details under point 1.2.

2.1 Right of access pursuant to Art. 15 GDPR

You have the right at any time to receive free information about whether we process data concerning you.

2.2 Right to rectification pursuant to Art. 16 GDPR, right to erasure pursuant to Art. 17 GDPR, right to restriction of processing pursuant to Art. 18 GDPR, right to data portability pursuant to Art. 20 GDPR and right to object pursuant to Art. 21 GDPR

Furthermore, you have the possibility to assert the rights to rectification, erasure, or restriction of processing. You can also object to the processing of your data by us at any time.

2.3 Withdrawal in case of consent pursuant to Art. 7 Para. 3 GDPR

If we process your personal data based on consent, you have the right to revoke your consent at any time for the future. However, your revocation only applies from the time you express it and has no retroactive effect. The use of your data up to that point remains lawful.

2.4 Your right to complain to the supervisory authority

If you believe that the processing of your personal data by Mesalvo GmbH is not lawful, you have the right at any time to complain to any data protection supervisory authority (according to Art. 55 GDPR). The competent supervisory authority is:

State Commissioner for Data Protection and Freedom of Information Baden-Württemberg

Dr. Stefan Brink
Lautenschlagerstraße 20
70173 Stuttgart
T +49 711 615541-0
Email: poststelle@lfdi.bwl.de

Further information and current contact details can be found on the website www.baden-wuerttemberg.datenschutz.de.

  1. Processing of your data when using this website

3.1 Logging

When you visit our website, information is automatically transmitted to the server of our website by the browser used on your device. This information is temporarily stored in a so-called log file.

The following information is stored without your intervention:

IP address of the requesting computer, website from which access is made (so-called referrer URL), browser type and version, and other information transmitted by the browser (e.g., the operating system of your computer) and language, date and time of the request, time zone difference to Greenwich Mean Time (GMT), access status / HTTP status code, the data volume transferred.

The data processing takes place pursuant to Art. 6 I f) GDPR to ensure uninterrupted operation of our pages and to evaluate system security and stability. The collected data is not used to draw conclusions about your person.

The stored data will be kept in the log files for a maximum of 7 days and then deleted. Data whose further retention is necessary for evidential purposes is excluded from deletion until the respective incident is finally clarified.

  1. General part of the privacy policy

4.1 Cookies

4.1.1 Definition: Temporary and permanent cookies

Cookies are small text files placed on your computer by a web server. When you visit the website again, it can recognize your web browser based on the cookie. Cookies cannot execute programs or transmit viruses to your computer. They serve to make the online offer more user-friendly and effective overall.

There are different types of cookies, whose scope and function we want to explain now:

There are so-called temporary or transient cookies, which are automatically deleted when you close the browser. This includes session cookies, which store a session ID that assigns various requests of your browser to a common session. This allows your computer to be recognized when you return to our website. Session cookies are deleted when you log out or close your browser.

There are also permanent or persistent cookies, which remain stored after closing the browser but are automatically deleted after a predefined period. The duration varies depending on the cookie, but we want to inform you that you can delete cookies at any time using your browser’s security settings.

Third-party cookies are cookies offered by providers other than the controller operating the online service.

4.1.2 We use the following cookies on our website:

Name: Session Cookie
Scope: Website functionality
Legal basis: Technically necessary §25 para. 2 TTDSG
Storage duration: Until the end of the session
Explanation: Required for basic website functionality

4.1.3 Restriction and deletion of cookies

You have the right and possibility to restrict or prevent the installation of cookies via your browser settings. Furthermore, you can delete already stored cookies at any time. The steps and measures depend on the browser you use.

  1. Social Media / Social Plugins / Third-party content

5.1 Pure linking to social media websites

The LinkedIn, Xing, Twitter links embedded on our site are not integrated via so-called social plugins. The embedded graphic contains only an HTTP link to our LinkedIn, Xing, Twitter, etc., pages. When our site is accessed, no direct connection with the servers of the aforementioned sites is established.

  1. Processing your data in case of an application

You can apply for open positions via our website or send unsolicited applications. As part of the application process, your application data will be processed electronically by us.

For efficient and promising application handling, you can provide the following information when applying:

Master data (last name, first name), contact data (address, phone number), CV data (e.g., school education, professional training, work experience), documents related to applications (application photos, cover letters, certificates, references, work samples, etc.).

The legal basis for processing for the purpose of conducting the application process and initiating an employment relationship is § 26 para. 1 BDSG. Additionally, the use of the applicant management system by the controller is based on legitimate interest pursuant to Art. 6 para. 1 lit. f) GDPR. If a consent according to Art. 6 para. 1 lit. a) GDPR is required for a specific processing activity, it will be obtained separately and transparently from you, unless it follows from your explicit and voluntary behavior, such as voluntary participation in a video interview.

6.1 Data transfer

Your data will not be passed on to unauthorized third parties within the scope of applicant management and will be processed for the purposes described in this privacy policy. Internal departments and responsible specialists have access on legitimate grounds as far as knowledge of the data from the application process is necessary and permissible for applicant selection or internal administrative purposes. To this end, your data may be forwarded by email or within the management system to third parties within the company. Legal basis can be § 26 para. 1 BDSG, Art. 6 para. 1 lit. f) and a) GDPR.

Data transfer to third parties also occurs within the scope of order processing pursuant to Art. 28 GDPR, i.e., processing activities that the controller has a legitimate interest to outsource, which they would otherwise be entitled to perform themselves. The controller takes measures to ensure compliance with data protection regulations.

Transfer to external third parties can also occur to defend legal claims based on legitimate interest or in the context of investigations or disclosures to government authorities, provided a law requires this or there is an obligation to disclose. Information obligations towards affected persons pursuant to Art. 13, 14 GDPR are fulfilled in advance of the respective transfer if applicable.

6.2 CV analysis by rexx systems GmbH

We process and analyze documents you upload using AI technology to extract CV data and convert it into a structured form (so-called “CV parsing”).

To ensure data subject rights and security standards, a contract for order processing was concluded with the service provider. The processor is rexx systems GmbH.

Data processing takes place on a server in Germany in a secured environment.

The legal basis for processing is § 26 para. 1 BDSG and Art. 6 para. 1 sentence 1 lit. f) GDPR to initiate an employment relationship and make the application process as efficient as possible. No transmission of personal data to insecure third countries takes place. Your data will be deleted from the temporary storage at rexx systems GmbH after processing.

  1. Contact inquiry / Contact form

When you contact us by e-mail or via a contact form, the data you provide (your e-mail address, possibly your name and telephone number) will be stored by us to answer your questions. Providing additional data is always voluntary.

The legal basis for processing your contact request and handling it is, in the case of a pre-contractual or already contractual relationship, Art. 6 para. 1 lit. b GDPR or, in the case of other inquiries, our legitimate interest to respond to you, Art. 6 para. 1 lit. f GDPR.

The storage of your data is based on your consent pursuant to Art. 6 para. 1 lit. a GDPR, which you have given by sending your contact request / clicking the submit button. We delete the data collected in this context once storage is no longer necessary and there are no statutory retention obligations (e.g., in the case of subsequent contract processing).

Since you have given consent, we would like to inform you that you can revoke your consent given for the contact request at any time and without giving reasons with effect for the future, Art. 7 para. 3 GDPR. If you wish to exercise this right of revocation, please contact us.