{"id":6849,"date":"2021-07-20T22:12:52","date_gmt":"2021-07-20T20:12:52","guid":{"rendered":"https:\/\/www.wmc-healthcare.de\/privacy-policy-2\/"},"modified":"2026-06-18T10:02:28","modified_gmt":"2026-06-18T08:02:28","slug":"privacy-policy","status":"publish","type":"page","link":"https:\/\/www.wmc-healthcare.de\/en\/privacy-policy\/","title":{"rendered":"Privacy policy"},"content":{"rendered":"<div id='av_section_1'  class='avia-section av-krdqmljh-c07bb2c89997471963402e566ea3c24d main_color avia-section-large avia-no-border-styling  avia-builder-el-0  avia-builder-el-no-sibling  avia-bg-style-scroll container_wrap fullsize'  ><div class='container av-section-cont-open' ><main  role=\"main\" itemprop=\"mainContentOfPage\"  class='template-page content  av-content-full alpha units'><div class='post-entry post-entry-type-page post-entry-6849'><div class='entry-content-wrapper clearfix'>\n<div  class='flex_column av-2y7p-5120f51caff721a428235bb083daa77a av_one_full  avia-builder-el-1  el_before_av_textblock  avia-builder-el-first  first flex_column_div  '     ><section  class='av_textblock_section av-krdqny26-18482ed93b1d1fcf45d99a571b6187cb '   itemscope=\"itemscope\" itemtype=\"https:\/\/schema.org\/CreativeWork\" ><div class='avia_textblock'  itemprop=\"text\" ><h1>Privacy policy<\/h1>\n<\/div><\/section><br \/>\n\n<style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-ktohengx-2a146a0310ca72b384389eb29b832e7d\">\n#top .hr.hr-invisible.av-ktohengx-2a146a0310ca72b384389eb29b832e7d{\nheight:50px;\n}\n<\/style>\n<div  class='hr av-ktohengx-2a146a0310ca72b384389eb29b832e7d hr-invisible  avia-builder-el-3  el_after_av_textblock  el_before_av_textblock '><span class='hr-inner '><span class=\"hr-inner-style\"><\/span><\/span><\/div><br \/>\n<section  class='av_textblock_section av-lrhyo895-325532e7ab25a15ff4fdb920821921ef '   itemscope=\"itemscope\" itemtype=\"https:\/\/schema.org\/CreativeWork\" ><div class='avia_textblock'  itemprop=\"text\" ><span class=\"borlabs-cookie-open-dialog-preferences brlbs-cmpnt-container\" data-borlabs-cookie-title=\"Customize cookie settings\" data-borlabs-cookie-type=\"button\" ><\/span>\n<p>You can give your consent to entire categories or have further information displayed and thus select only certain cookies.<\/p>\n<\/div><\/section><br \/>\n\n<style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-3cx5-0f71c5545b07730328335c6bc74748e5\">\n#top .hr.hr-invisible.av-3cx5-0f71c5545b07730328335c6bc74748e5{\nheight:50px;\n}\n<\/style>\n<div  class='hr av-3cx5-0f71c5545b07730328335c6bc74748e5 hr-invisible  avia-builder-el-5  el_after_av_textblock  avia-builder-el-last '><span class='hr-inner '><span class=\"hr-inner-style\"><\/span><\/span><\/div><\/p><\/div><section  class='av_textblock_section av-2nx5-d89d89e50f4d19068b6c463c9e162900 '   itemscope=\"itemscope\" itemtype=\"https:\/\/schema.org\/CreativeWork\" ><div class='avia_textblock'  itemprop=\"text\" ><h2>Data protection information of WMC Healthcare GmbH<\/h2>\n<p>We, WMC Healthcare GmbH (WMC), take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory provisions of the relevant data protection laws, in particular the European General Data Protection Regulation (GDPR), as well as these privacy notices. <\/p>\n<p>These privacy notices apply to the use of WMC\u2019s digital services, including our social media profiles, across all internet-enabled devices, as well as to data processing in connection with customer, prospective customer and lead management, events, applications, employment relationships, and the use of AI-supported systems.<\/p>\n<p>The digital services may contain links to other websites and third-party services to which these privacy notices do not apply.<\/p>\n<h3>Contents<\/h3>\n<p>1. CONTROLLER<br \/>\n2. PURPOSES OF PROCESSING PERSONAL DATA<br \/>\n2.1 DATA PROCESSING FOR THE PROVISION OF CONTRACTUAL SERVICES<br \/>\n2.2 DATA PROCESSING FOR COMMUNICATION WITH YOU<br \/>\n2.3 DATA PROCESSING AS PART OF CUSTOMER, PROSPECT AND LEAD MANAGEMENT<br \/>\n2.4 DATA PROCESSING IN THE CONTEXT OF EVENTS<br \/>\n2.5 AI-SUPPORTED DATA PROCESSING<br \/>\n2.6 LINKEDIN<br \/>\n2.7 YOUTUBE<br \/>\n2.8 VIMEO<br \/>\n2.9 ONLINE PRESENCES ON OTHER SOCIAL NETWORKS<br \/>\n2.10 COOKIES<br \/>\n2.11 DATA PROCESSING IN THE APPLICATION PROCESS<br \/>\n2.12 DATA PROCESSING IN THE EMPLOYMENT RELATIONSHIP<br \/>\n2.13 DATA PROCESSING UNDER JOINT CONTROLLERSHIP<br \/>\n2.14 DATA PROCESSING TO SAFEGUARD LEGITIMATE INTERESTS<br \/>\n2.15 OTHER DATA PROCESSING BASED ON YOUR CONSENT<br \/>\n2.16 LOG FILES<br \/>\n2.17 DATA PROCESSING TO COMPLY WITH LEGAL OBLIGATIONS<br \/>\n3. RECIPIENTS OF PERSONAL DATA<br \/>\n4. DATA RETENTION PERIOD<br \/>\n5. DATA SECURITY<br \/>\n6. DATA SUBJECT RIGHTS<\/p>\n<h3>1. responsible person<\/h3>\n<p><strong>The controller responsible for the processing of your personal data is<\/strong><\/p>\n<p><strong>WMC Healthcare GmbH<\/strong><br \/>\nFriedrichstra\u00dfe 1a<br \/>\n80801 Munich<br \/>\n<a href=\"mailto:kontakt@wmc-healthcare.de\">kontakt@wmc-healthcare.de<\/a><\/p>\n<p>If you have any questions about data protection at our company, please write to us at the above postal address, adding \u201cData Protection\u201d, or contact us at the email address provided. You can reach our Data Protection Officer, Mr Malte Rheingans <a href=\"https:\/\/cogito.consulting\">(https:\/\/cogito.consulting),<\/a> by email at <a href=\"mailto:wmc@cogito.consulting\">mailto:wmc@cogito.consultin<\/a> or by post at the above address, adding \u201cFor the attention of the Data Protection Officer\u201d. <\/p>\n<h3>2. Purposes of processing personal data<\/h3>\n<h4>2.1 Data processing for the provision of contractual services<\/h4>\n<p>We process personal data in order to handle contractual relationships and to be able to provide contract offers tailored to your needs. Data is collected in particular for the conclusion and\/or performance of a contract. <\/p>\n<p>To carry out your engagement, we may require your correct name, address and payment details. We ask for your email address and telephone number so that we can communicate with you if there are any questions or issues regarding the service you have commissioned. <\/p>\n<p>The legal basis for data processing is Art. 6(1) sentence 1 lit. b GDPR, which permits the processing of data for the performance of a contract or pre-contractual measures.  <\/p>\n<h4>2.2 Data processing for communication with you<\/h4>\n<p>In addition to contract data, we process your communication data (name, address, telephone number, email address) in order to handle your enquiry and\/or to be able to contact you. Personal data that you provide to us by email, via a contact form or via another communication channel we have made available is processed only for correspondence with you and only for the purpose for which you provided the data to us. <\/p>\n<p>This data is processed on the basis of Art. 6(1) sentence 1 lit. b GDPR if your enquiry is related to the performance of a contract or is necessary to carry out pre-contractual measures. In all other cases, processing is based on our legitimate interest in effectively handling enquiries addressed to us pursuant to Art. 6(1) sentence 1 lit. f GDPR, or on your consent pursuant to Art. 6(1) sentence 1 lit. a GDPR, if such consent was requested. You may withdraw any consent you have given at any time with effect for the future. An informal notice to us is sufficient. The lawfulness of processing carried out up to the time of withdrawal remains unaffected.          <\/p>\n<h4>2.3 Data processing as part of customer, prospect and lead management<\/h4>\n<p>We process personal data of customers, prospective customers, business partners, contacts at companies and other leads insofar as this is necessary for initiating, conducting and maintaining business relationships, handling enquiries, carrying out sales measures, planning and tracking communication, inviting people to events, and documenting and organising our business processes.<\/p>\n<p>In particular, we process master and contact data, company and role information, communication data, information on interests, previous contacts, events attended, services requested or obtained, response and interaction data, and information on the source of the respective contact. Such data may come directly from you, e.g. from enquiries, conversations, events, business cards or forms, or from publicly accessible professional sources, in particular company websites, professional networks or public registers. <\/p>\n<p>We may manage and analyse this data in CRM systems, communication systems and other applications in order to structure contacts, assign responsibilities, prepare communication, plan sales activities and update existing information. AI-supported systems may also be used in accordance with section 2.5. <\/p>\n<p>Processing is based on Art. 6(1) sentence 1 lit. b GDPR insofar as it is necessary for the performance of a contract or pre-contractual measures. Otherwise, processing is based on Art. 6(1) sentence 1 lit. f GDPR. Our legitimate interest lies in initiating and maintaining business relationships, efficiently organising our communication, managing customer and prospect data, and providing targeted information about our services and events. Where we obtain consent for specific communication measures, processing is based on Art. 6(1) sentence 1 lit. a GDPR. Marketing communication is carried out only insofar as it is permissible under data protection and competition law.          <\/p>\n<h4>2.4 Data processing in the context of events<\/h4>\n<p>We process personal data insofar as this is necessary for the planning, organisation, implementation and follow-up of in-person, online or hybrid events. In particular, we process master and contact data, company and role information, registration data, participation details, communication data, technical access data, where applicable payment and invoicing data, and other information you provide to us in connection with the event. <\/p>\n<p>To organise and run events, we may use service providers and software solutions for invitation management, CRM, participant management, ticketing, payment processing and online communication. Where these service providers process personal data on our behalf, this is done on the basis of a data processing agreement pursuant to Art. 28 GDPR. Where personal data is transferred to third countries in this context, this is done in accordance with section 3.  <\/p>\n<p>We use your email address to send you registration confirmations, information about the event, organisational notices, access data, reminders and, where applicable, information about follow-up dates that are related in terms of content. Where events are held online or in hybrid form, it may be necessary for you to use third-party services or software. In this case, the privacy notices of the respective service also apply.  <\/p>\n<p>We reserve the right to record events in image, video or audio form or to take photos and videos insofar as this is necessary for documentation, public relations, follow-up, evaluation or improvement of the event, or where separate consent has been obtained. In particular, speakers, participants and contributions, questions or other interactions may be captured. <\/p>\n<p>Data processing for the purposes of registration, organisation, implementation and billing of the event is based on Art. 6(1) sentence 1 lit. b GDPR. Where processing is carried out to safeguard legitimate interests, in particular for documentation, follow-up, evaluation, improvement or public reporting on events, the legal basis is Art. 6(1) sentence 1 lit. f GDPR. Our legitimate interest lies in the proper implementation, documentation and further development of our events as well as in public relations. Where we obtain consent, the legal basis is Art. 6(1) sentence 1 lit. a GDPR.         <\/p>\n<h4>2.5 AI-supported data processing<\/h4>\n<p>We use AI-supported systems and functions in various business areas to support business processes, structure information, analyse content, prepare work results and improve the quality of our services.<\/p>\n<p>Depending on the use case, personal data from the respective processing contexts may be processed, in particular master and contact data, communication content, contract, project, CRM, lead, event, application and employee data, documents, notes, calendar and task data, usage and metadata, as well as inputs into AI systems and outputs generated by AI systems. We process special categories of personal data in AI-supported systems only insofar as this is necessary in individual cases, legally permissible and safeguarded by appropriate protective measures. <\/p>\n<p>The use of AI-supported systems generally serves to support human activity. Decisions that have legal effect on you or similarly significantly affect you are not made solely by automated means on the basis of an AI system. <\/p>\n<p>The legal basis depends on the respective processing context. Where AI-supported processing is necessary for the performance of a contract or for pre-contractual measures, it is carried out on the basis of Art. 6(1) sentence 1 lit. b GDPR. Where processing in the employment context is necessary for establishing, carrying out or terminating the employment relationship, it is carried out on the basis of Art. 6(1) sentence 1 lit. b GDPR. Where processing is necessary to comply with legal obligations, it is carried out on the basis of Art. 6(1) sentence 1 lit. c GDPR. Otherwise, processing is based on Art. 6(1) sentence 1 lit. f GDPR. Our legitimate interests lie in particular in the efficient organisation of our business processes, supporting our employees, improving our services, structuring and evaluating existing information, and maintaining and developing customer, prospect and business relationships. Where processing is based on your consent, the legal basis is Art. 6(1) sentence 1 lit. a GDPR. Where special categories of personal data are concerned, processing takes place only where there is a legal basis under Art. 9(2) GDPR.                  <\/p>\n<h4>2.6 LinkedIn<\/h4>\n<p>We operate a company page on the social network LinkedIn. The provider is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (\u201cLinkedIn\u201d). In connection with our LinkedIn company page, LinkedIn may provide us with so-called Page Analytics. For this processing, joint controllership within the meaning of Art. 26 GDPR may apply in accordance with the terms provided by LinkedIn.   <\/p>\n<p>Please refer to LinkedIn\u2019s privacy policy and the agreement on joint controllership provided by LinkedIn (Page Insights Joint Controller Addendum), available at https:\/\/legal.linkedin.com\/pages-joint-controller-addendum, for the type and scope of the information provided by LinkedIn, the associated purposes of data processing by LinkedIn, its lawfulness, and information on exercising your rights. This agreement specifies in particular that LinkedIn primarily assumes the data protection obligations in connection with the Page Analytics and that you can assert your data subject rights both against us and directly against LinkedIn. Page Analytics are aggregated data that can provide us with insights into how people interact with our company page. The generation and provision of these Page Analytics is within LinkedIn\u2019s area of responsibility. We have only limited influence over this.   <\/p>\n<p>We process the information provided by LinkedIn for statistical analysis of the use of our company page, to optimise our posts and our company page, and to communicate with users. In addition, we process personal data that you have made publicly accessible on LinkedIn, in particular profile information, posts, comments, likes, tags and messages, insofar as you interact with our company page or communicate with us via LinkedIn. <\/p>\n<p>If you apply via LinkedIn for a position advertised by us, we also process the application data transmitted to us by LinkedIn in accordance with section 2.11. Where LinkedIn transfers personal data to LinkedIn Corporation in the USA and the relevant certification is active at the time of transfer and covers the data concerned, a transfer to a third country may take place on the basis of the European Commission\u2019s adequacy decision for the EU-U.S. Data Privacy Framework. Otherwise, data processing by LinkedIn is within LinkedIn\u2019s area of responsibility.  <\/p>\n<p>The legal basis for our data processing is Art. 6(1) sentence 1 lit. f GDPR. Our legitimate interest lies in providing our LinkedIn company page, statistically analysing its use, optimising our posts and communicating with users. Where you have given LinkedIn consent, you can withdraw that consent from LinkedIn with effect for the future.    <\/p>\n<h4>2.7 YouTube<\/h4>\n<p>On some of our web pages, we use videos and\/or plugins from YouTube. The provider of YouTube is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Where personal data is transferred to Google LLC in the USA, the information below on transfers to third countries applies.  <\/p>\n<p>When you start a YouTube video on our website or enable YouTube functionality, a connection is established to servers of YouTube and\/or Google. In particular, your IP address, device and browser information, information about the page you accessed, time of access, interaction data and, where applicable, cookie or other identifier data may be processed. If you are logged into your YouTube or Google account, Google may be able to associate the use with your personal profile.<br \/>\nAfter a YouTube video is started, additional data processing operations may also be triggered over which we have no influence. This may include, for example, a connection to services of the Google Marketing Platform. Further information about data processing by Google can be found in Google\u2019s privacy policy at https:\/\/policies.google.com\/privacy?hl=de.    <\/p>\n<p>Where personal data is transferred to Google LLC in the USA in connection with the use of YouTube, this transfer may take place on the basis of the European Commission\u2019s adequacy decision for the EU-U.S. Data Privacy Framework, provided that Google LLC is certified for the relevant processing and the certification is active at the time of transfer. Where no adequacy decision applies in a specific scenario, a transfer to a third country will take place only if appropriate safeguards pursuant to Art. 46 GDPR are in place or a statutory exception under Art. 49 GDPR applies. <\/p>\n<p>If you have consented to our use of YouTube and the associated data processing, processing is carried out on the basis of your consent pursuant to Art. 6(1) sentence 1 lit. a GDPR. The storage of information on your device or access to information on your device is based on your consent pursuant to Section 25(1) TDDDG. You can withdraw your consent at any time with effect for the future. The lawfulness of processing carried out up to the time of withdrawal remains unaffected.      <\/p>\n<h4>2.8 Vimeo<\/h4>\n<p>On some of our web pages, we use videos and\/or plugins from the Vimeo platform. The provider is Vimeo.com, Inc., 330 West 34th Street, 10th Floor, New York, NY 10001, USA.<\/p>\n<p>When you start a Vimeo video on our website or enable Vimeo functionality, a connection is established to Vimeo servers. In particular, your IP address, device and browser information, information about the page you accessed, time of access, interaction data and, where applicable, cookie or other identifier data may be processed. If you are logged into your Vimeo account, Vimeo may be able to associate the use with your personal profile.  <\/p>\n<p>After a Vimeo video is started, additional data processing operations may also be triggered over which we have no influence. Further information on data processing by Vimeo can be found in Vimeo\u2019s privacy policy at https:\/\/vimeo.com\/privacy. <\/p>\n<p>Where personal data is transferred to Vimeo.com, Inc. in the USA in connection with the use of Vimeo, this transfer may take place on the basis of the European Commission\u2019s adequacy decision for the EU-U.S. Data Privacy Framework, provided that Vimeo.com, Inc. is certified for the relevant processing and the certification is active at the time of transfer. Where no adequacy decision applies in a specific scenario, a transfer to a third country will take place only if appropriate safeguards pursuant to Art. 46 GDPR are in place or a statutory exception under Art. 49 GDPR applies.   <\/p>\n<p>If you have consented to our use of Vimeo and the associated data processing, processing is carried out on the basis of your consent pursuant to Art. 6(1) sentence 1 lit. a GDPR. The storage of information on your device or access to information on your device is based on your consent pursuant to Section 25(1) TDDDG. You can withdraw your consent at any time with effect for the future. The lawfulness of processing carried out up to the time of withdrawal remains unaffected.      <\/p>\n<h4>2.9 Online presences on other social networks<\/h4>\n<p>In addition to LinkedIn, we may maintain other online presences on social networks in order to communicate there with prospective customers, customers, applicants and other users and to provide information about our services, events, job vacancies and current topics.<\/p>\n<p>When you visit our online presences or communicate with us via them, we process in particular publicly visible profile information, communication content, interactions with our posts, messages and other information you provide to us via the respective social network. In addition, the respective social network provider processes personal data under its own responsibility, in particular for the purposes of providing the network, market research, advertising, reach measurement and analysis of use. <\/p>\n<p>With regard to the type and scope of data processing by the respective provider, the legal bases and the exercise of your data subject rights, we refer you to the provider\u2019s privacy policy. Where we have data protection responsibility, processing is based on our legitimate interest in effectively informing and communicating with users pursuant to Art. 6(1) sentence 1 lit. f GDPR.   <\/p>\n<h4>2.10 Cookies<\/h4>\n<p>We use cookies and similar technologies. Cookies are small text files that are stored on your device. Similar technologies may in particular be used to store information on your device or to access information already stored on your device.  <\/p>\n<p>We use necessary cookies and similar technologies that are required to provide the functions you access, in particular to deliver the website, store your cookie settings, securely transmit forms and, where applicable, to carry out registrations, applications or orders in connection with events. The legal basis for storing information on your device or accessing information on your device is Section 25(2) no. 2 TDDDG. Any processing of personal data carried out in this context is based on Art. 6(1) sentence 1 lit. b GDPR insofar as it is necessary for the performance of a contract or pre-contractual measures, or on Art. 6(1) sentence 1 lit. f GDPR. Our legitimate interest lies in the technically error-free, secure and user-friendly provision of our digital services.        <\/p>\n<p>For the use of other, non-essential cookies or similar technologies, we may obtain your consent. The storage of information on your device or access to information on your device then takes place on the basis of your consent pursuant to Section 25(1) TDDDG. Any processing of personal data carried out in this context is based on Art. 6(1) sentence 1 lit. a GDPR. You can withdraw your consent at any time with effect for the future. The lawfulness of processing carried out up to the time of withdrawal remains unaffected.       <\/p>\n<h4>2.11 Data processing in the application process<\/h4>\n<p>If you are interested in working for our company, you can apply via the application channels provided on our website, via LinkedIn job ads, via job boards or by email. We process the personal data transmitted to us in this context to review, process and respond to your application, to carry out the application process and to decide on establishing an employment relationship. <\/p>\n<p>For this purpose, we process in particular master and contact data, in particular salutation, title, first name, last name, email address and telephone number, information on salary expectations and availability, information on the source of the application, application documents, in particular cover letter, CV, references, proof of employment, training and further education, information on professional background, qualifications, education and training, as well as other information you provide to us as part of your application.<\/p>\n<p>For applications via LinkedIn or job boards, the data you have enabled for the respective application process is transmitted to us by the respective provider. Further information on processing by LinkedIn or the respective job board can be found in the provider\u2019s privacy policy. <\/p>\n<p>To efficiently carry out the application process, we use the HRworks software solution from HRworks GmbH, Waldkircher Str. 28, 79106 Freiburg, as a processor. As part of operation, maintenance and support, HRworks may have access to personal data to the extent necessary. The basis for this is a data processing agreement pursuant to Art. 28 GDPR. Within WMC, only those departments have access to your application data that require it to carry out the application process. This includes in particular the HR department, the managers responsible for the respective job posting and other persons involved in the selection process. Data is shared with affiliated companies only insofar as you have consented to this or another legal basis applies. Before submitting your application, you can decide whether your application documents may be forwarded to affiliated companies of WMC Healthcare GmbH so that you can be considered for job postings there, if applicable.      <\/p>\n<p>In individual cases, the personal data processed may also include special categories of personal data pursuant to Art. 9(1) GDPR, if you provide this to us as part of your application or if it results from the application documents. We process such data only insofar as this is legally permissible and necessary for carrying out the application process, exercising rights or fulfilling legal obligations under labour law, social security law and social protection law, or insofar as you have given us explicit consent.  <\/p>\n<p>If your application does not result in an employment relationship, we generally delete your personal data no later than six months after the end of the application process, unless there is a legal obligation to retain it for longer or storage is necessary for the assertion, exercise or defence of legal claims. Longer storage takes place only if you have consented to this, in particular for inclusion in a talent pool. If you consent to inclusion in a talent pool, we store your application data for a further twelve months so that we can consider you for new or other job offers. You can withdraw your consent at any time with effect for the future, for example by email to karriere@wmc-healthcare.de.   <\/p>\n<p>If your application is successful and results in an employment relationship with us, we will transfer your application documents, as necessary, to our HR management system and your personnel file. We provide additional information on the further processing of your personal data in the employment relationship in these privacy notices under section 2.12. <\/p>\n<p>We do not use solely automated decision-making within the meaning of Art. 22 GDPR. Providing the personal data required for the decision on establishing an employment relationship is necessary. Without this data, we cannot carry out the application process.  <\/p>\n<p>The legal basis for processing personal data in the application process is Art. 6(1) sentence 1 lit. b GDPR, as processing serves to initiate an employment relationship and thus to carry out pre-contractual measures. Where individual processing goes beyond what is necessary to initiate the employment relationship, we rely on Art. 6(1) sentence 1 lit. f GDPR. Our legitimate interest lies in the proper conduct, administration and documentation of the application process. Where special categories of personal data are processed, this is done on the basis of Art. 9(2) lit. b GDPR in conjunction with Section 26(3) BDSG, insofar as this is necessary for exercising rights or fulfilling legal obligations under labour law, social security law and social protection law. Where processing is based on consent, the legal basis is Art. 6(1) sentence 1 lit. a GDPR and, where special categories of personal data are concerned, Art. 9(2) lit. a GDPR. Where processing is necessary for the assertion, exercise or defence of legal claims, it is carried out on the basis of Art. 6(1) sentence 1 lit. f GDPR and, where special categories of personal data are concerned, Art. 9(2) lit. f GDPR. Where AI-supported systems are used in the application process, this is done only in a supportive manner, in particular for organisational processing, structuring or summarising information. Decisions on selecting, rejecting or hiring applicants are not made solely by automated means. AI-supported analysis, filtering, evaluation or ranking of applications takes place only insofar as the respective use has been legally reviewed in advance and the applicable legal requirements are complied with.                       <\/p>\n<h4>2.12 Data processing in the employment relationship<\/h4>\n<p>We process personal data of employees insofar as this is necessary for establishing, carrying out and terminating the employment relationship. This includes in particular master and contact data, personnel master data, contract data, remuneration data, bank details, tax and social security data, working time data, absence data, training data, data on business-related communication processes, and other data that arises in the context of the employment relationship. <\/p>\n<p>Where necessary, we also process information on marital status, children, religious affiliation, nationality, residence permits or work permits, as well as other information required for the proper conduct of the employment relationship, payroll accounting, social security treatment or compliance with legal obligations. We maintain a personnel file in which we store the information necessary for the proper conduct and documentation of the employment relationship. <\/p>\n<p>Where special categories of personal data within the meaning of Art. 9(1) GDPR are processed, this is done only insofar as it is legally permissible and necessary. This includes in particular health data in connection with incapacity for work, company integration management, occupational health and safety, maternity protection, assessment of fitness for work or other obligations under labour and social law. Where necessary, we also process information on a severe disability or equal status in order to safeguard the rights of the data subject and to fulfil our legal obligations.   <\/p>\n<p>In the context of the employment relationship, we also process personal data in particular for managing working hours, leave, absences and incapacity for work, carrying out training measures, issuing references and assessments, processing sick notes, carrying out company integration management, fulfilling obligations related to occupational health and safety, maternity protection and social security reporting, managing occupational pension schemes, and providing, managing, using and securing company IT. This may also include the use of AI-supported systems, in particular to support the creation, summarisation, analysis, translation, structuring and research of content, as well as to support internal work and communication processes. <\/p>\n<p>The legal basis for processing personal data in connection with the employment relationship is Art. 6(1) sentence 1 lit. b GDPR insofar as processing is necessary for establishing, carrying out or terminating the employment relationship. Where processing is carried out to comply with legal obligations, the legal basis is Art. 6(1) sentence 1 lit. c GDPR. Where individual processing is necessary to safeguard legitimate interests, the legal basis is Art. 6(1) sentence 1 lit. f GDPR, provided that your interests or fundamental rights and freedoms do not prevail.        <\/p>\n<p>The legal basis for processing special categories of personal data in the employment context is Art. 9(2) lit. b GDPR in conjunction with Section 26(3) BDSG and the relevant provisions of labour and social law, insofar as processing is necessary for exercising rights or fulfilling legal obligations under labour law, social security law and social protection law. Where health data is processed as part of preventive healthcare or to assess fitness for work by the company doctor or other persons bound by confidentiality, processing may additionally be based on Art. 9(2) lit. h GDPR in conjunction with the relevant national provisions. Where AI-supported systems are used in the employment context, they generally serve to support human activity. Decisions on establishing, carrying out, changing or terminating an employment relationship are not made solely by automated means on the basis of an AI system.        <\/p>\n<h4>2.13 Data processing under joint controllership<\/h4>\n<p>In the context of applications and employment relationships, WMC may process personal data jointly with other companies in the group under joint controllership within the meaning of Art. 26 GDPR. This applies exclusively to the companies named as parties in the respective applicable joint controllership agreement. The parties to the agreement are currently PS Group Services GmbH, PS Healthcare Services GmbH, miralytik Healthcare Consulting GmbH, WMC Healthcare GmbH, WMCF GmbH, WMCS Healthcare Consulting GmbH, WMC International GmbH, Hospital Management Group GmbH and HPG Healthcare Performance Group GmbH.  <\/p>\n<p>The joint processing serves in particular group-wide workforce planning, conducting application processes, internal organisation, HR administration and fulfilling legal obligations in connection with employment relationships. The essential content of the agreement pursuant to Art. 26 GDPR is summarised in the above statements. Accordingly, joint processing is carried out for the purposes mentioned, the agreement governs responsibility for fulfilling the respective data protection obligations, and data subjects may assert their rights against any participating party.  <\/p>\n<p>Where external recruitment agencies or recruiting service providers place job ads together with us, receive applications, select applicants or draw attention to suitable job postings and in doing so jointly decide with us on the purposes and means of processing, processing is also carried out under joint controllership pursuant to Art. 26 GDPR. The service providers involved are identified, where applicable, in the respective job posting or in the application process. <\/p>\n<h4>2.14 Data processing to safeguard legitimate interests<\/h4>\n<p>We also process your data where this is necessary to safeguard legitimate interests of us or third parties. This may be the case in particular to ensure IT security and IT operations, including support requests, to organise internal processes, to assert, exercise or defend legal claims, to investigate breaches of duty, to ensure proper business operations, for market and opinion research, for statistical analysis of the use of our website, and, where applicable, in connection with photo or video recordings made at events in order to provide effective public information about them on the internet, in particular on websites and social media channels, or in press publications. <\/p>\n<p>The legal basis for data processing is Art. 6(1) sentence 1 lit. f GDPR. Our legitimate interests lie in the purposes stated above.   <\/p>\n<h4>2.15 Other data processing based on your consent<\/h4>\n<p>It may also happen that we obtain your consent for certain processing of personal data. Each consent and the respective data processing are voluntary. If you do not give consent, you will not suffer any disadvantages as a result, unless something else is expressly explained in connection with the respective consent.  <\/p>\n<p>In these cases, data processing is carried out on the basis of your consent pursuant to Art. 6(1) sentence 1 lit. a GDPR. Where special categories of personal data are concerned, processing is carried out on the basis of Art. 9(2) lit. a GDPR. You may withdraw any consent you have given at any time with effect for the future. An informal notice to us is sufficient. The lawfulness of processing carried out up to the time of withdrawal remains unaffected.        <\/p>\n<h4>2.16 Log files<\/h4>\n<p>Each time our websites are accessed, usage data is transmitted by the respective internet browser and stored in log files, known as server log files. The data records stored may include, in particular, the following information: browser type and version, operating system used, referrer URL, time of server request, and IP address, where technically implemented in abbreviated form. <\/p>\n<p>This data is processed to provide the website technically, ensure system security, analyze errors, and investigate cases of misuse. We do not, as a rule, combine this data with other data sources. We reserve the right to review this data retrospectively if we become aware of concrete indications of unlawful use.  <\/p>\n<p>The legal basis for data processing is Art. 6(1)(1)(f) GDPR. Our legitimate interest lies in the secure, stable, and error-free provision of our digital services and in investigating unlawful use.   <\/p>\n<h4>2.17 Data Processing to Fulfill Legal Obligations<\/h4>\n<p>In addition, we process personal data to fulfill legal obligations. This particularly concerns commercial and tax retention and documentation requirements, labor and social insurance obligations, supervisory requirements, and obligations toward authorities, social insurance providers, accident insurance providers, courts, or other legally designated entities. <\/p>\n<p>The legal basis for data processing is Art. 6(1)(1)(c) GDPR.  <\/p>\n<h3>3. recipient of the personal data<\/h3>\n<p>Your personal data will only be disclosed or otherwise transmitted to third parties if this is necessary to fulfill contractual or legal obligations, if you have previously consented, if another legal basis for disclosure exists, or if disclosure is permissible to protect legitimate interests.<\/p>\n<p>Within WMC, only those departments that require personal data to fulfill the respective purposes receive access. This may include, in particular, management, specialist departments, human resources, marketing, event organization, IT, and other relevant internal departments. <\/p>\n<p>Service providers who support us in delivering our services and operating our digital platforms may include, in particular, IT service providers, hosting providers, email service providers, software vendors, CRM providers, invitation and event management service providers, ticket shop providers, payment service providers, sales and marketing service providers, and software and hardware maintenance providers. For application and personnel administration processes, we use HRworks as applicant management and personnel administration software. In connection with events, HubSpot, EventKingdom, and pretix may be used. Where service providers process personal data on our behalf, this is done on the basis of a data processing agreement pursuant to Art. 28 GDPR.   <\/p>\n<p>In the employment context, external recipients may include, in particular, payroll service providers, tax advisors, legal advisors, banks, social insurance providers, health insurance companies, employers&#8217; liability insurance associations, pension providers, authorities, courts, and, where applicable, commissioned personnel or recruiting service providers.<\/p>\n<p>In addition, personal data may be transmitted to independently responsible third parties where this is necessary for the respective processing operation. This may include, in particular, operators of social networks, video platforms, job boards, affiliated companies, consultants, authorities, courts, or other legally designated recipients. <\/p>\n<p>In connection with the use of AI-powered systems, providers of cloud, platform, productivity, AI, analytics, security, and software services may also process personal data. Where these providers process personal data on our behalf, this is done on the basis of a data processing agreement pursuant to Art. 28 GDPR. <\/p>\n<p>Personal data is only transferred to third countries or international organizations if the requirements of Art. 44 et seq. GDPR are met. Where personal data is transferred to recipients in the USA who are certified under the EU-U.S. Data Privacy Framework, the transfer may be based on the European Commission&#8217;s adequacy decision pursuant to Art. 45 GDPR, provided that the certification is active at the time of transfer and the data concerned and the respective processing purpose are covered by the certification. Where no adequacy decision applies, a third-country transfer only takes place if appropriate safeguards exist pursuant to Art. 46 GDPR, in particular on the basis of standard contractual clauses, or if a legal exception under Art. 49 GDPR applies.  <\/p>\n<h3>4. duration of data storage<\/h3>\n<p>We store personal data only for as long as necessary for the respective purposes, unless legal retention obligations require otherwise and unless longer storage is necessary to assert, exercise, or defend legal claims.<\/p>\n<p>We generally store data from inquiries and communications for the duration of processing the respective inquiry and beyond, where this is necessary for documentation, contract performance, or legal defense. We store contract- and billing-related data for the duration of the statutory commercial and tax retention periods. <\/p>\n<p>We store data in connection with customer, prospect, and lead management for as long as necessary for initiating, performing, or maintaining the respective business relationship, processing inquiries, documenting communications, or protecting legitimate interests. If you object to processing or withdraw consent, the affected data will be deleted or blocked from further marketing use, unless legal retention obligations or other legitimate reasons for continued storage exist. <\/p>\n<p>We store inputs into AI-powered systems, outputs generated thereby, and associated usage, log, and metadata only for as long as necessary for the respective processing purpose, traceability, quality assurance, IT security, error analysis, abuse prevention, fulfillment of legal obligations, or assertion, exercise, or defense of legal claims. Where such data is stored in systems we use, the specific retention periods are additionally governed by the deletion, retention, and logging settings we configure. <\/p>\n<p>We store data in connection with events for the duration of organizing, conducting, and following up on the respective event and beyond, where this is necessary for billing, documentation, fulfillment of legal obligations, or legal defense.<br \/>\nApplication documents are generally deleted no later than six months after completion of the application process, unless a legal obligation for longer retention exists or storage is necessary to assert, exercise, or defend legal claims. Longer storage occurs only if you have consented, particularly for inclusion in a talent pool. In the case of inclusion in the talent pool, we store application data for an additional twelve months, unless you withdraw your consent earlier.  <\/p>\n<p>We generally store personal data from the employment relationship for the duration of the employment relationship and beyond only where legal retention obligations exist or the data is necessary to assert, exercise, or defend legal claims. This particularly concerns tax and social insurance-related documents, for which statutory retention periods of up to six or ten years may apply. Where data is necessary to assert, exercise, or defend legal claims, storage may continue until the expiration of the respective statutory limitation periods.  <\/p>\n<p>We store log files only for the period necessary for technical provision, ensuring operations, error analysis, and investigating cases of misuse, unless longer storage is required for the aforementioned reasons.<\/p>\n<h3>5. data security<\/h3>\n<p>Your personal data is transmitted securely on our systems. We use TLS\/SSL encryption for this purpose. You can recognize an encrypted connection, in particular, by the fact that the browser&#8217;s address bar begins with &#8220;https:\/\/&#8221; and by the lock symbol in your browser bar.<br \/>\nFurthermore, we secure our websites and other systems through technical and organizational measures against loss, destruction, access, alteration, or distribution of your data by unauthorized persons. When using AI-powered systems, we implement appropriate technical and organizational measures, in particular authorization and access controls, logging, encryption, guidelines for permissible use, and restrictions on entering sensitive or confidential information.   <\/p>\n<h3>6. rights of data subjects<\/h3>\n<p>Subject to the statutory requirements, you have the right to obtain information about the personal data stored about you, the right to rectification of inaccurate data, the right to erasure, the right to restriction of processing, the right to data portability, and the right to object to processing, where the respective processing is based on Art. 6(1)(1)(e) or (f) GDPR.   <\/p>\n<p>If you have given us consent to process personal data, you may withdraw it at any time with effect for the future. The lawfulness of processing carried out until withdrawal remains unaffected. Where we process your personal data on the basis of legitimate interests, you may object to this processing for reasons arising from your particular situation. If personal data is processed for the purpose of direct marketing, you may object to this processing at any time.   <\/p>\n<p>To exercise your rights, you may contact us at any time using the contact details provided in Section 1. In addition, you have the right to lodge a complaint with a data protection supervisory authority.<\/p>\n<\/div><\/section>\n\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-6849","page","type-page","status-publish","hentry"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.0 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Privacy policy &#8226; WMC HEALTHCARE<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.wmc-healthcare.de\/en\/privacy-policy\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Privacy policy &#8226; WMC HEALTHCARE\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.wmc-healthcare.de\/en\/privacy-policy\/\" \/>\n<meta property=\"og:site_name\" content=\"WMC HEALTHCARE\" \/>\n<meta property=\"article:modified_time\" content=\"2026-06-18T08:02:28+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.wmc-healthcare.de\/wp-content\/uploads\/2022\/01\/wmc-healthcare-aus-leidenschaft.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"2560\" \/>\n\t<meta property=\"og:image:height\" content=\"1440\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"36 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.wmc-healthcare.de\\\/en\\\/privacy-policy\\\/\",\"url\":\"https:\\\/\\\/www.wmc-healthcare.de\\\/en\\\/privacy-policy\\\/\",\"name\":\"Privacy policy &#8226; WMC HEALTHCARE\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.wmc-healthcare.de\\\/en\\\/#website\"},\"datePublished\":\"2021-07-20T20:12:52+00:00\",\"dateModified\":\"2026-06-18T08:02:28+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.wmc-healthcare.de\\\/en\\\/privacy-policy\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.wmc-healthcare.de\\\/en\\\/privacy-policy\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.wmc-healthcare.de\\\/en\\\/privacy-policy\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Startseite\",\"item\":\"https:\\\/\\\/www.wmc-healthcare.de\\\/en\\\/home\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Privacy policy\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.wmc-healthcare.de\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/www.wmc-healthcare.de\\\/en\\\/\",\"name\":\"WMC HEALTHCARE\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.wmc-healthcare.de\\\/en\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.wmc-healthcare.de\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.wmc-healthcare.de\\\/en\\\/#organization\",\"name\":\"WMC HEALTHCARE\",\"url\":\"https:\\\/\\\/www.wmc-healthcare.de\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.wmc-healthcare.de\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.wmc-healthcare.de\\\/wp-content\\\/uploads\\\/2022\\\/01\\\/wmc-healthcare-logo-menu.png\",\"contentUrl\":\"https:\\\/\\\/www.wmc-healthcare.de\\\/wp-content\\\/uploads\\\/2022\\\/01\\\/wmc-healthcare-logo-menu.png\",\"width\":93,\"height\":60,\"caption\":\"WMC HEALTHCARE\"},\"image\":{\"@id\":\"https:\\\/\\\/www.wmc-healthcare.de\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Privacy policy &#8226; WMC HEALTHCARE","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.wmc-healthcare.de\/en\/privacy-policy\/","og_locale":"en_US","og_type":"article","og_title":"Privacy policy &#8226; WMC HEALTHCARE","og_url":"https:\/\/www.wmc-healthcare.de\/en\/privacy-policy\/","og_site_name":"WMC HEALTHCARE","article_modified_time":"2026-06-18T08:02:28+00:00","og_image":[{"width":2560,"height":1440,"url":"https:\/\/www.wmc-healthcare.de\/wp-content\/uploads\/2022\/01\/wmc-healthcare-aus-leidenschaft.jpg","type":"image\/jpeg"}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"36 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.wmc-healthcare.de\/en\/privacy-policy\/","url":"https:\/\/www.wmc-healthcare.de\/en\/privacy-policy\/","name":"Privacy policy &#8226; WMC HEALTHCARE","isPartOf":{"@id":"https:\/\/www.wmc-healthcare.de\/en\/#website"},"datePublished":"2021-07-20T20:12:52+00:00","dateModified":"2026-06-18T08:02:28+00:00","breadcrumb":{"@id":"https:\/\/www.wmc-healthcare.de\/en\/privacy-policy\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.wmc-healthcare.de\/en\/privacy-policy\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.wmc-healthcare.de\/en\/privacy-policy\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Startseite","item":"https:\/\/www.wmc-healthcare.de\/en\/home\/"},{"@type":"ListItem","position":2,"name":"Privacy policy"}]},{"@type":"WebSite","@id":"https:\/\/www.wmc-healthcare.de\/en\/#website","url":"https:\/\/www.wmc-healthcare.de\/en\/","name":"WMC HEALTHCARE","description":"","publisher":{"@id":"https:\/\/www.wmc-healthcare.de\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.wmc-healthcare.de\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.wmc-healthcare.de\/en\/#organization","name":"WMC HEALTHCARE","url":"https:\/\/www.wmc-healthcare.de\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.wmc-healthcare.de\/en\/#\/schema\/logo\/image\/","url":"https:\/\/www.wmc-healthcare.de\/wp-content\/uploads\/2022\/01\/wmc-healthcare-logo-menu.png","contentUrl":"https:\/\/www.wmc-healthcare.de\/wp-content\/uploads\/2022\/01\/wmc-healthcare-logo-menu.png","width":93,"height":60,"caption":"WMC HEALTHCARE"},"image":{"@id":"https:\/\/www.wmc-healthcare.de\/en\/#\/schema\/logo\/image\/"}}]}},"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www.wmc-healthcare.de\/en\/wp-json\/wp\/v2\/pages\/6849","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wmc-healthcare.de\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.wmc-healthcare.de\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.wmc-healthcare.de\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wmc-healthcare.de\/en\/wp-json\/wp\/v2\/comments?post=6849"}],"version-history":[{"count":9,"href":"https:\/\/www.wmc-healthcare.de\/en\/wp-json\/wp\/v2\/pages\/6849\/revisions"}],"predecessor-version":[{"id":9575,"href":"https:\/\/www.wmc-healthcare.de\/en\/wp-json\/wp\/v2\/pages\/6849\/revisions\/9575"}],"wp:attachment":[{"href":"https:\/\/www.wmc-healthcare.de\/en\/wp-json\/wp\/v2\/media?parent=6849"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}