Applicant Privacy Notice

1. Controller

Codex Operation (sole proprietorship)
Owner: Ibrahim Alakeel
Hofholzallee
24109 Kiel, Germany
Email: info@codex-operations.com

2. Purpose of processing

We process application data to receive your application, assess your professional and personal suitability for the selected or a comparable role, communicate with you about the recruitment process, arrange interviews or technical selection steps, and decide whether to establish an employment relationship.

3. Data we process

Depending on the information you provide, we process in particular:

• identity and contact data such as name, email address, telephone number and location,
• information about the desired role, availability, professional experience, skills and motivation,
• voluntarily provided profile, LinkedIn, GitHub or portfolio links,
• uploaded application documents such as a CV or other documents,
• communications generated during the recruitment process,
• technically necessary security data where required to secure the form and prevent abuse.

Please do not send information that is not required for your application, in particular passwords, confidential client data or secret project information.

4. Legal basis

Application data is processed primarily on the basis of Section 26(1) of the German Federal Data Protection Act (BDSG) where processing is necessary for a decision on entering into an employment relationship. Applicants are treated as employees for the purposes of Section 26 BDSG. Where necessary for the establishment, exercise or defence of legal claims, processing may additionally be based on Article 6(1)(f) GDPR.

The mandatory checkbox in the application form only confirms that you have taken note of this privacy notice. It is not consent and is not the legal basis for the recruitment process.

5. Required and optional information

Fields marked as required and an application attachment are necessary so that we can process your application. Without them, an application cannot be submitted through the form. Telephone number, location, availability and profile or portfolio links are voluntary where they are not marked as required.

6. Upload and technical transmission

The application form accepts PDF, DOC, DOCX and ZIP files up to 6 MB. The web server checks the upload server-side for permitted size, file extension and basic file signature. The application does not extract or execute the file and does not move it into permanent website storage.

PHP temporarily buffers the upload during the request. The application data and attachment are then sent by email to info@codex-operations.com. The website does not permanently place application content in its own applicant database. After transmission, further storage is governed by the retention and backup mechanisms of the email system used.

7. Recipients and service providers

Within Codex Operation, access to application data is limited to people who need it for recruitment and selection. Technical hosting and email service providers may process data to the extent necessary for operation, transmission, security or storage. Application data is not disclosed for advertising or address-trading purposes.

8. Retention and deletion

If no employment relationship is established, we generally delete application documents no later than six months after the recruitment process has ended, unless longer retention is required by law or for the establishment, exercise or defence of legal claims. Technical backup copies may be overwritten later within regular backup and deletion cycles.

If an employment relationship is established, data required for employment may be transferred to personnel administration and processed under the applicable statutory and operational retention rules.

We currently do not operate a talent pool with longer retention through this form. If such an option is introduced later, longer storage will only take place on a separate legal basis and with separate information.

9. Automated decisions

No decision about your application is made solely by automated means and no profiling within the meaning of Article 22 GDPR is carried out. Decisions about the recruitment process are made by people.

10. Your rights

Subject to the statutory requirements, you have rights including access, rectification, erasure, restriction of processing and, where applicable, data portability and objection. To exercise your rights, contact info@codex-operations.com.

11. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. In Schleswig-Holstein, the Independent State Centre for Data Protection Schleswig-Holstein (ULD) is the competent authority in particular. Information and contact details are available at datenschutzzentrum.de.

12. Security of the application form

The application form uses safeguards including TLS/HTTPS, CSRF protection, short-lived sessions, server-side input validation, honeypot mechanisms, rate limiting, and size, extension and signature checks for uploads. Even with appropriate safeguards, data transmission over the internet can never be completely risk-free.

13. Further information

Additional information about the general operation of the website, hosting, external resources and other processing is available in our general Privacy Policy. For questions about privacy in the recruitment process, contact info@codex-operations.com.