We want to keep you in the loop about how we handle your personal data during our applicant management process here at Boerse Stuttgart Group. Typically, within our group, your data is used solely for the job you applied for and is only shared with departments involved in the recruitment process, such as our HR department at the Vereinigung Baden-Württembergische Wertpapierbörse e.V., which is the central hub for recruitment in our group. If the position is directly with Vereinigung Baden-Württembergische Wertpapierbörse e.V., your data stays internal, shared only with departments responsible for the recruitment process. The hiring process is a team effort between HR and the specific department related to your application.
I. RESPONSIBLE ENTITY UNDER GDPR
In the context of processing your personal data for recruitment, the Vereinigung Baden-Württembergische Wertpapierbörse e.V., Börsenstraße 4, 70174 Stuttgart, and the specific Boerse Stuttgart Group company where the job is located, are joint controllers as per Art. 26 GDPR. This could be one of several companies, such as:
Baden-Württembergische Wertpapierbörse GmbH, Börsenstraße 4, 70174 Stuttgart
Boerse Stuttgart Commodities GmbH, Börsenstraße 4, 70174 Stuttgart
Boerse Stuttgart GmbH, Börsenstraße 4, 70174 Stuttgart
Boerse Stuttgart Digital Custody GmbH, Börsenstraße 4, 70174 Stuttgart
Boerse Stuttgart Digital Broker GmbH, Börsenstraße 4, 70174 Stuttgart
Boerse Stuttgart Digital Holding GmbH, Börsenstraße 4, 70174 Stuttgart
Boerse Stuttgart cats GmbH, Börsenstraße 4, 70174 Stuttgart
Boerse Stuttgart Digital Exchange GmbH, Börsenstraße 4, 70174 Stuttgart
EUWAX Aktiengesellschaft, Börsenstraße 4, 70174 Stuttgart
Seturion GmbH, Börsenstraße 4, 70174 Stuttgart
II. KEY ASPECTS OF JOINT CONTROLLERSHIP AGREEMENT (ART. 26 GDPR)
The joint controllers have outlined responsibilities under GDPR in an agreement. Key points include:
Information as per Art. 13/14 GDPR: You'll receive this through our data privacy notices in the application process.
Data Subject Rights (Art. 15–22 GDPR): Requests can be directed to Vereinigung Baden-Württembergische Wertpapierbörse e.V., which primarily handles them unless the specific company needs to get involved.
Data Security (Art. 32 GDPR): Appropriate technical and organizational measures are in place, along with a coordinated role and access concept.
Reporting Data Breaches (Art. 33/34 GDPR): We have processes to assess, report, and notify as needed.
III. DATA PROTECTION OFFICER CONTACT INFORMATION
Ms. Yvonne Piater
By Mail: Data Protection Officer, Vereinigung Baden-Württembergische Wertpapierbörse e.V., Börsenstraße 4, 70174 Stuttgart
Email: dsb@boerse-stuttgart.de
IV. PURPOSE OF DATA PROCESSING
Your personal data is processed to manage the application process and decide on establishing an employment relationship. This includes reviewing your documents, communicating with you, organizing and conducting interviews, coordinating and documenting the selection process, and issuing acceptance or rejection notices. We collect, process, and store your personal data during the application process. After submission, we review your application and provide feedback. We use your data for the selection process (forwarding to relevant internal functions, organizing and conducting interviews, managing the job filling process). We use your contact details for follow-up, like inviting you to an interview or sending an offer or rejection letter.
Your contact details, such as name, address, email, and phone number.
Other personal information like academic degree, gender, birthdate, nationality, marital status, current professional situation, salary data, desired salary, availability, as well as attachments like CV, cover letter, etc.
Information regarding your career and qualifications, as well as additional information about you that you provide in your application. This may include health information (e.g., degree of disability) or other special categories of personal data. Please only submit special categories of data (Art. 9 GDPR) if necessary for the application (e.g., disability status if you wish it to be considered).
Internal assessments, such as notes from phone interviews or in-person interviews.
If you use the "Apply with LinkedIn/Xing" feature, the profile data you actively release will be used to pre-fill the application.
Once you visit our website https://group.boerse-stuttgart.com/de/career/ and select the “career” section, you'll be redirected to the talentsconnect applicant portal. Here, you can apply for open positions or submit speculative applications. The portal is operated by talentsconnect AG. When applying through the portal, your application data is processed by talentsconnect systems. We use their JobShop feature, allowing us to create career pages, post job ads, and manage our digital application processes. When you apply through JobShop, your application data is sent to us for processing.
talentsconnect processes application data as a data processor. We have a data processing agreement with talentsconnect according to Art. 28 GDPR, ensuring the protection and processing of your applicant data on our behalf and according to our instructions.
For data processing outside our JobShop by talentsconnect (e.g., general platform operation, IT security), refer to talentsconnect’s privacy notice on https://www.talentsconnect.com/datenschutzerklaerung.
Applications via JobShop are forwarded to our applicant management system (P&I), where they are further processed. Data from your application is transmitted with TLS encryption and stored in a database. We use the P&I Personal & Informatik AG system, which acts as our data processor under Art. 28 GDPR. Their privacy policy is available at https://www.piag.com/datenschutz/.
V. RECIPIENTS OF YOUR DATA
If service providers assist us, the data shared is limited to what's necessary. They access your data only as needed for their tasks. For processing by service providers, we ensure they comply with data protection laws under Art. 28 GDPR. Further sharing with third parties happens only if legally required or in case of misuse or for clarification, given concrete evidence of illegal or abusive behavior. If requested by an authority, we may disclose these data for law enforcement purposes.
Recipients / Access within Boerse Stuttgart Group
Your data is accessible within the Boerse Stuttgart Group only to individuals and departments involved in the recruitment process (e.g., central recruiting/HR, relevant departments of the target company, relevant committees/stakeholders, if necessary). No further use occurs.
Recipients / Service Providers (Data Processors)
We use service providers for the technical provision and operation of recruiting systems and support in the application process. These service providers process personal data on our behalf (data processors according to Art. 28 GDPR), including:
For data processing, P&I Personal & Informatik AG's applicant management system.
For our applicant portal, talentsconnect AG.
Other categories of data processors may include hosting, development, IT service providers, and possibly providers of aptitude/recruitment tests. These providers receive only the data necessary for the service. Independent controllers: For data processed by service providers independently (e.g., general platform operation), see their privacy policies.
VI. PROVISION OF YOUR PERSONAL DATA
Providing personal data through our applicant portal is generally voluntary. However, some information is marked as required within the application forms. Without these fields filled, we cannot process your application, and it won't be considered in the selection process.
VII. LEGAL BASIS FOR DATA PROCESSING
Data processing in the application process occurs primarily based on § 26 BDSG (decision on establishing an employment relationship and conducting the application process).
If we store your application documents post-process for a limited time, it is for asserting, exercising, or defending legal claims (Art. 6 para. 1 lit. f GDPR; our legitimate interest lies in documenting the application process and defending/enforcing legal claims).
If special categories of personal data (Art. 9 para. 1 GDPR) are processed (e.g., disability status), it is only when necessary, based on Art. 9 para. 2 lit. b GDPR in conjunction with § 26 para. 3 BDSG.
If we include your data in an applicant pool or process it based on your consent, it is based on Art. 6 para. 1 lit. a GDPR. Consent can be revoked at any time with future effect.
VIII. DURATION OF DATA STORAGE
Your documents are automatically deleted six months after a rejection. If you applied for multiple positions, deletion occurs six months after the last rejection. If hired, we store application documents and necessary employment data until employment ends. Travel reimbursement invoices from the application process are archived per tax regulations and deleted afterward.
If we add applications to our applicant pool due to no current suitable position, we'll ask via email if we can store your data longer. With your consent, we'll keep you in the pool for up to 18 months to contact you for suitable opportunities. If no employment relationship is established within 18 months, your data is automatically deleted. No special notification or archiving occurs.
After these periods, application data is deleted. Statistical evaluations (e.g., number of applications per period) are based on aggregated and, if necessary, pseudonymized data. The legal basis is Art. 6 para. 1 lit. f GDPR (legitimate interest in analyzing and improving our recruitment processes).
IX. YOUR RIGHTS AS A DATA SUBJECT
You have the following rights as a data subject, exercisable against us. You can request information about your personal data under Art. 15 GDPR. You can rectify your data per Art. 16 GDPR or have it erased if conditions under Art. 17 GDPR are met. You also have the right to restrict processing (Art. 18 GDPR). A right to object exists under Art. 21 GDPR if we process your data based on Art. 6 para. 1 lit. f GDPR. For data you provided, you can request a copy in a common format under Art. 20 GDPR conditions. Consents given for data processing can be revoked anytime.
You can exercise your rights with any joint controller. To simplify, contact our data protection officer (dsb@boerse-stuttgart.de) or Vereinigung Baden-Württembergische Wertpapierbörse e.V.; they will coordinate with the target company if needed. Note, revocation applies only prospectively, not affecting prior processing legitimacy. You can also file a complaint with a supervisory authority under Art. 77 GDPR if you believe your data processing violates GDPR. In Baden-Württemberg, the competent authority is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (LfDI BW). This right is independent of other administrative or judicial remedies.
X. AUTOMATED DECISION-MAKING / PROFILING
We do not use automated decision-making or profiling (an automated analysis of your personal circumstances) as defined by Art. 22 GDPR.
XI. ORIGIN OF YOUR DATA / USE OF STAFFING SERVICES
Generally, we only collect data directly from you during the application process, such as the materials you provide for job openings. Occasionally, we also engage staffing services as headhunters. Based on a job profile we provide, our service providers help us find and select suitable candidates, from whom we then receive application profiles. Our data processing aims to find suitable candidates during the recruitment process. The legal basis for data collection from headhunters and subsequent processing is § 26 BDSG and, if applicable, Art. 6 para. 1 lit f GDPR. Where engaging headhunters constitutes data processing, we ensure data protection through processing agreements per Art. 28 GDPR, ensuring data protection and processing under our directive. However, headhunters are usually independent controllers.
XII. DATA TRANSFER TO THIRD COUNTRIES
Data transfers to third countries (outside EU/EEA) occur only if necessary for operating/supporting service providers. Such transfers comply with Art. 44 ff. GDPR, mainly based on EU Standard Clauses, details of which are available upon request.
XIII. SECURITY
We implement technical and organizational security measures to protect data managed by us against manipulation, loss, destruction, and unauthorized access. Our security measures are continuously improved to align with technological advancements and are adapted accordingly.
As of: January 2026