Data protection information for applicants

We are pleased that you are interested in our company and apply or have applied for a position in our company. In the following, we would like to provide you with information on the processing of your personal data in connection with the application.

Who is responsible for data processing?

The controller within the meaning of data protection law is

Steigenberger Hotels AG
Lyoner Straße 25
60528 Frankfurt am Main

E-mail address:

Phone: +49 69 66564-01

You will find further information about our company, details of the authorized representatives and also further contact options in our imprint of our website:

If you apply for a job advertisement from another company (foreign company, subsidiary, holding company, management company or franchisee), Steigenberger Hotels AG processes your data on behalf of the respective company.

Our Data Protection Officer

You can contact our data protection officer at

TÜV Informationstechnik GmbH

Am TÜV 1, 45307 Essen

E-mail address:

I. Processing of your data in the context of the application

  1. Which of your data are processed by us? And for what purposes?

We process the data that you disclose to us in connection with your application (proactive or for a specific position) via our website, application platform or by e-mail in order to check your suitability for the position (or, if applicable, other open positions in our companies) and to carry out the application process. This data includes, for example: name, date of birth, gender, address, e-mail address, telephone number, photo, CV, education, professional experience, language skills, as well as any other information that you disclose to us in your documents.


If you are accepted for a position, we process your data (e.g. name, date of birth, address, e-mail address), which you disclose to us in connection with your application, in order to send you an offer for an employment contract from our personnel information system. *

* These statements do not apply to applications to franchised hotels or to applications outside the DACH region.

  1. On what legal basis do we process your personal data?

The legal basis for the processing of your personal data in the application process is § 26 BDSG, or Art. 6 para. 1 lit. b) GDPR. Accordingly, the processing of the data necessary in connection with the decision on the establishment of an employment relationship and the pre-contractual measures is permitted.

Should the data be necessary for legal prosecution after completion of the application process, data processing may take place on the basis of the requirements of Art. 6 GDPR, in particular for the protection of legitimate interests pursuant to Art. 6 para. 1 lit. f) GDPR. Our interest then lies in the assertion or defence of claims.

If you have voluntarily given us your consent for one or more specific purposes, the legal basis for this is § 26 para. 2 BDSG or Art. 6 para. 1 lit. a) GDPR.

  1. How long is the data stored?

Data of applicants will be deleted after 6 months in the event of a rejection.

You can agree to an extended storage period of 24 months when applying. Before the deadline expires, you will be notified of the upcoming deletion of your documents and you can extend this period again.

Irrespective of this, you naturally have the option at any time to delete your data in your applicant account yourself or to request deletion by our company.

Should we wish to make you a contract offer as part of the application process, it is necessary for technical reasons to transfer your data from the applicant data system to our personnel information system. If you accept the employment contract, your data will be stored for the duration of your employment relationship and for 10 years after the end of the employment relationship. If you reject the employment contract, your data will be deleted immediately in the personnel management system. This does not affect the storage periods already mentioned in the applicant management system.

  1. Where does your data come from?

In principle, the personal data originate from yourself. It is also possible that your data has been provided to us by external sources, such as the Federal Employment Agency or personnel service providers.

  1. To which recipients will the data be forwarded?

We use a software (“onlyfy”) from New Work SE for the application process with and the personnel management software from rexx sytems GmbH for the preparation of the contract offer. They act as service providers for us and may also gain knowledge of your personal data in connection with the maintenance and care of the systems. We have concluded a so-called data processing agreement with these providers, which ensures that data processing is carried out in a permissible manner.

Your applicant data will be reviewed by the HR department after receipt of your application. Suitable applications are then forwarded internally to the department managers for the respective open position. Then the further procedure is coordinated. In principle, only those persons in the company have access to your data who need it for the proper running of our application process and the preparation of contracts.

If you have applied for a position at another company, your data will also be passed on to the Human Resources managers of the company concerned or, under certain circumstances, to a service provider commissioned by the company concerned.

  1. Data transfer to third countries

If you have applied to a company outside the European Union and Switzerland, your data will be transmitted to the personnel managers of the company concerned on the basis of Art. 49 para. 1 lit. b) GDPR (fulfilment of a contract between you and the company concerned or for the implementation of pre-contractual measures).

If you have applied to our company in Switzerland, your data will be transmitted to the personnel managers of this company on the basis of Art. 45 para. 1 GDPR (transfers on the basis of an adequacy decision by the European Commission).

  1. Obligation to provide data

The provision of personal data in the context of application processes is neither required by law or contract, so you are not obliged to provide information about your personal data. Please note, however, that these are suitable for the decision on an application or the preparation of a contract offer in relation to an employment relationship with us. If you do not provide us with personal data, we cannot make a decision to establish an employment relationship. We recommend that you only provide the personal data required to complete the application as part of your application.

  1. Automated decision-making and profiling

When establishing and executing our contractual relationship, you will not be exposed to any decision based solely on automated processing – including profiling – pursuant to Article 22 GDPR that has legal effect on you or significantly affects you in a similar way.

  1. Your rights as a "data subject"

You can request confirmation from us as to whether personal data concerning you is processed by us (right of access pursuant to Art. 15 GDPR). In addition, you have a right to information about this personal data and further information on data processing.

You have a right to rectification and/or completion if the personal data processed concerning you is incorrect or incomplete (Art. 16 GDPR).

Under the conditions of Article 18 GDPR, you may request the restriction of the processing of personal data concerning you.

You can demand from us that the personal data concerning you be deleted immediately ("right to be forgotten" according to Art. 17 GDPR), unless we are entitled or obliged to further process (e.g. due to statutory retention obligations).

You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format (Art. 20 GDPR).

You have the right, for reasons arising from your particular situation to object at any time to the processing of personal data concerning you, which is based on Art. 6 para. 1 sentence 1 lit. e) or lit. f) GDPR.

You have the right to revoke your declaration of consent under data protection law at any time. The revocation of consent does not affect the legality of the processing carried out on the basis of the consent until the revocation.

The assertion of these data protection rights and in particular the assertion of the revocation are to be addressed by e-mail to

or in writing by post

Steigenberger Hotels AG
Human Resources
Lyoner Straße 25, 60528 Frankfurt am Main

Right to lodge a complaint

In accordance with Article 77 GDPR, you have the right to lodge a complaint with the responsible data protection supervisory authority.