At zigzag, you can apply in two ways: send us your application by email or apply directly online via our website. In both cases, we process your data through our recruiting tool onlyfy and will get back to you promptly. Since we will contact you via our recruiting tool, we kindly ask you to check your spam folder regularly. If you don't hear from us or have any questions, feel free to reach out to us! Below, you will find important information about how zigzag GmbH processes your data when applying by email. The privacy policy for online applications can be found at: https://privacy.xing.com/en/privacy-policy General information about data processing when visiting the zigzag website is available at: https://zigzag.is/data_policy/en/ Johannes Schmidt Senior Manager People & Operations zigzag GmbH Kronprinzstr. 11 70173 Stuttgart play@zigzag.is +49 711 50454712

With this notice, we inform you about the processing of your personal data and your rights under data protection law.

Controller: zigzag GmbH Kronprinzstraße 11 70173 Stuttgart, Germany Data Protection Officer: Sandra Hangst Email: datenschutz@zigzag.is

We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable data protection laws.

The processing is based on Article 6(1)(b) GDPR in conjunction with Section 26 of the German Federal Data Protection Act (BDSG) for the purpose of carrying out the application process. The primary purpose of the data processing is to establish an employment relationship with you. The categories of personal data processed during the application phase and for the handling of your application may include, in particular, your master data (such as first name, last name, name suffixes, nationality), contact details (e.g., private address, (mobile) phone number, email address), as well as other data (e.g., qualification data, information about previous employment, application photo, etc.). This may also include special categories of personal data, such as health-related data. As a rule, we receive your personal data directly from you, for example, through your application submitted via email or our online application form. In addition, data may also be transmitted via external job platforms or career networks (e.g. StepStone, LinkedIn), provided that you have actively submitted your application to our job postings through those services.

The processing of personal data is carried out for the purpose of selecting suitable candidates. This includes, among other things, the processing of personal identification data, address details, qualification information, certificates, application documents, and contact details. To organize and conduct interviews, we may also process personal data such as identification data, address details, qualification information, potential absence periods (e.g., for scheduling), contact information, as well as interview content or notes. If travel expenses are reimbursed, we also process address data, personal identification data, and bank account information.

Where necessary, we also process your data to safeguard legitimate interests of our company or third parties.

This includes, in particular, ensuring IT security and IT operations, which may involve the processing of log and protocol data. Additionally, all categories of personal data may be processed in specific cases, for example, to prevent or investigate criminal offenses.

Within our company, only those individuals and departments (e.g., relevant departments) who need access to your personal data in order to fulfill contractual and legal obligations will receive it. Furthermore, your data will be transferred to New Work SE. We use the e-recruiting system “onlyfy” provided by New Work SE, Dammtorstraße 30, 20354 Hamburg, to manage our recruitment process. In this context, zigzag GmbH remains the data controller under data protection law. onlyfy acts on our behalf as a data processor in accordance with Article 28 GDPR and has been carefully selected. A data processing agreement has been concluded accordingly. Applications submitted via the application form or by email are processed through the jobbase.io platform. You can find more information about how onlyfy processes data at: https://privacy.xing.com/en/privacy-policy

We retain the personal data of applicants whose applications were not successful for a maximum period of twelve months from the date of rejection. If you would like your data to be stored for a longer period- e.g., to be considered for future job openings or for the continuation of the application process at a later date - we require your explicit written consent. Please provide us with a corresponding statement so we can properly document your consent.

All data is processed within the European Union.

You have the right to request access to the personal data we store about you (Article 15 GDPR). Under certain conditions, you also have the right to request the rectification or deletion of your data (Articles 16 and 17 GDPR). Furthermore, you have the right to restrict the processing of your personal data (Article 18 GDPR) and the right to receive the data you have provided in a structured, commonly used, and machine-readable format (Article 20 GDPR). No automated decision-making, including profiling, as defined by Article 22 GDPR, takes place in the context of the application process.

In the context of the application process, the provision of certain personal data is necessary in order for us to review your application and carry out the recruitment process. This includes, in particular, data that is required to decide whether to establish an employment relationship or data we are legally obligated to collect. If you do not provide us with this data, unfortunately, you cannot participate in the application process.

If you believe that the processing of your personal data violates data protection laws, you have the right to lodge a complaint with a data protection supervisory authority. You may also contact our Data Protection Officer at any time using the contact details provided above.

If we process your personal data on the basis of Article 6(1)(e) or (f) GDPR (legitimate interests), you have the right to object to such processing at any time on grounds relating to your particular situation. In this case, we will cease processing your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms in accordance with legal requirements. If we process your personal data for the purpose of direct marketing, you have the right to object to such processing at any time; this also applies to any profiling related to direct marketing. You may submit your objection informally - for example, by email to: datenschutz@zigzag.is