Privacy statement

Effective August 2021

Thank you for your interest in working for BASF. Before you proceed with your application, we would like to inform you about how we process and protect your personal data and what rights you have under data protection law.

For better clarity, this privacy statement is divided into two parts: Part I. contains information on the application process including the application portal. Part II. provides insights into technically relevant information.

Overview

Part I. - Information about the application process

Part II. - Technical information

Part I. - Information about the application process

A. Who is responsible for data processing?

Responsible for processing of the data is

BASF Services Europe GmbH,

Rotherstraße 11, 10245 Berlin

Phone: +49 30 2005-5000

Fax: +49 30 2005-5665 999

communications-berlin@basf.com

You can reach the Data Protection Officer at alexander.goerke@basf.com.

The respective BASF company to which you have applied is responsible for the further application process from the invitation to an interview onwards.

Questions regarding data protection can be directed to: data-protection.eu@basf.com

B. What categories of data do we use?

We process personal data that we receive from you as part of your application (e.g. cover letter, curriculum vitae, certificates and references) as well as data that we collect from you or about you during the application process (e.g. e-mails, interview notes, internal assessments, results of security checks (where relevant), information from job interviews or assessment centers). In addition, there is data collected in connection with the extended review (see below) for recruitment to particularly sensitive and security-relevant positions.

The categories of personal data processed include, where relevant in the individual case:

·Master data (e.g. name, title, academic degree, gender, date and place of birth and nationality, private contact details (address, telephone number, e-mail address), marital status, residence and work permits, copies of IDs, photos, language skills, relatives and their contact details), bank details.

·Application data (e.g., application and curriculum vitae, references, security clearance results, interview information, references, test results or assessment centers); we may also obtain the above data from other sources, including external business partners, e.g., external recruiters. We may also receive data that you have made public on business social networks, such as LinkedIn, or that you submit to us via third-party websites, such as Xing, or from other publicly available sources (only if the data has relevance to your professional life). We do not carry out any further research on your person, e.g. using online search engines. Please feel free to point us to further information about your professional career that is available online.

·Health data (e.g. occupational medical examinations, illnesses, medical aids due to illness, disabilities), insofar as stated or collected by you as part of your application.

·Declarations under data protection law (e.g. declarations of consent to the processing of personal data; declarations to revoke consent you have given; declarations to object to the processing of personal data; declarations to assert your rights of access, rectification, erasure, restriction of processing, data portability, including the information you provide to us when asserting your rights).

·Religious affiliation information relevant to tax law, which may indicate religious and ideological beliefs, to the extent provided by you as part of your application.

·Marital status information (marriage or registered domestic partnership) from which sexual orientation may be indicated, if any provided by you as part of your application.

·Other data that you additionally provide to us as part of the application (e.g. parents' occupation, previous salary). If this involves data of other persons, we ask you to inform them in advance and, if necessary, to obtain their consent to the transfer.

As a rule, your personal data is collected directly from you as part of the recruitment process or during the application selection process. In certain constellations, your personal data will also be collected from other offices due to legal requirements. This includes, in particular, event-related queries of tax-relevant information from the relevant tax office and information on periods of incapacity for work from the relevant health insurance fund. In addition, we may have received data from third parties (e.g. employment agency, family court).

C. How is your data used in the application portal?

To apply at BASF, register in the application portal and create an account. We need your name and e-mail address for this. The account allows us to track which jobs you have applied for at BASF.

You can use your personal data stored by third parties (e.g. Xing, LinkedIn, Dropbox or Google Drive) to create the profile in the portal. The use of this function is voluntary and only serves to make the entry of your data more convenient. Information on the treatment of your personal data by these third parties can be found in their privacy policies.

Once you have registered on the application portal, you can enter and/or upload additional information to your profile, such as your resume, cover letter, attachments (both general and application-specific), and other profile information (e.g., how did you hear about this job, source details, whether our recruiters may contact you regarding job opportunities that may be of interest to you), information about your education and work experience, and professional certifications and language skills.

If there is more than one profile of you with identical e-mail address in our system, the data will be merged automatically. Old data will be overwritten by the newer ones. All provided/uploaded attachments will be kept.

In the case of an express online application, you enter your personal data in the online forms and upload the associated documents. The information is then stored in our system.

In the case of applications via other channels (e-mail or paper application), we record the relevant information from your application and store your application documents in our system.

D. For what purposes and on what legal basis is data processed?

We process your personal data in compliance with the provisions of the German Federal Data Protection Act (BDSG) and the EU General Data Protection Regulation (GDPR), as well as other applicable national regulations and laws.

Primarily, the data processing serves the possible establishment, implementation and termination of the employment relationship as well as a subsequent pension phase.

If we want to process your personal data for a purpose not mentioned below, we will inform you in advance.

1. Application portal

a.If you register for our application portal in order to follow our job postings there and would like to be regularly informed about them, we process your personal data on the basis of your consent pursuant to Art. 6 para. 1 sentence 1 lit. b GDPR.

You have the right to revoke your consent at any time by sending an e-mail to jobs@basf.com, via a link in the "job notices" or in your profile, without affecting the lawfulness of the processing carried out on the basis of the consent until revocation.

b.If you would like to apply for an advertised position, your registration is required so that we can process your application and contact you about it.

Registration is carried out as part of the application process and thus serves to implement pre-contractual measures to establish an employment relationship. The legal basis for the processing of the data is therefore Art. 6 para. 1 sentence 1 lit. b, 88 para. 1 GDPR in conjunction with Section 26 para. 1 of the German Federal Data Protection Act (BDSG).

c.If you apply for an advertised position (other than vocational training, dual studies or the programs "Start in den Beruf"), you have the option of consenting to being informed about other job offers in your area of the world in addition to the specific application. Provided you have consented to this in advance, we will use personal data from your applicant profile (in particular information provided by you about your qualifications, e.g. education, work history, skills and competencies) to identify job offers that may be of interest to you and use your e-mail address to send you the job offers. The legal basis is your consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR.

You have the right to withdraw your consent at any time without affecting the lawfulness of the processing carried out on the basis of the consent until the withdrawal. To do so, please write an email to jobs@basf.com.

d.If you send us your application by other means (e.g. by express online application, e-mail or as a paper application), the application may be scanned as part of our internal processes and the information processed electronically. This serves the purpose of establishing an employment relationship. The legal basis for processing the data is Art. 6 para. 1 sentence 1 lit. b, 88 para. 1 GDPR (in conjunction with Section 26 para. 1 BDSG).

2. Subsequent application process

As part of the subsequent application process, your data will be used by the human resources departments of the respective BASF Group company and other authorized persons, in particular by the managers involved in the application process, within BASF in order to check your profile for the specific job offer and to be able to carry out the selection process. For certain positions (e.g. vocational training, dual studies, trainee programs), this includes participation in aptitude tests that determine cognitive and social skills. In addition, we also check whether we could include you in our talent pool. The legal basis for the processing of your personal data as described above is Section 26 para. 1 sentence 1 BDSG or Article 6 para. 1 sentence 1 lit. b GDPR.

To the extent necessary, we process personal data to assess your ability to work on the basis of Section 22 para. 1 No. 1 lit. c BDSG or Article 9 para. 2 lit. h GDPR. In this context, a strict division of data applies. Only the results of the examinations are communicated to the agencies involved in the recruitment. Diagnoses are not shared, but remain with the commissioned service providers or company physicians.

We process other special categories of personal data (i.e. data from which ethnic origin, political opinions, religious or ideological beliefs can be inferred, as well as health data or data from which sexual orientation can be inferred), if necessary, for the exercise of rights or the fulfillment of legal obligations arising from employment law (e.g. e.g. employer's right to ask questions; recording of severe disability due to additional leave, determining the severely disabled person's levy, ensuring the participation of the severely disabled person's representative) in accordance with Section 26 para. 3 BDSG or Article 9 para. 2 lit. b GDPR.

The processing of special categories of personal data may also be based on consent pursuant to Art. 9 para. 2 lit. a GDPR.

We also process your data in order to be able to fulfill our legal obligations as an employer, in particular in the area of tax and social security law. This is done on the basis of Art. 6 para. 1 sentence 1 lit. c GDPR.

Collective agreements (works agreements and collective bargaining agreements) pursuant to Art. 6 para. 1 Sentence 1 lit. b in conjunction with Art. 88 para. 1 GDPR and, if applicable, your separate consents pursuant to Art. 6 para. 1 sentence 1 lit. a, 7 GDPR can be used as a data protection permission provision.

Where necessary, we process your data on the basis of Art. 6 para. 1 sentence 1 lit. f GDPR to protect our legitimate interests or the legitimate interests of a third party (e.g. public authorities), unless your interests requiring the protection of your personal data override these interests. The processing for the protection of legitimate interests is carried out for the following purposes or to protect the following interests:

within the BASF Group for purposes of corporate management, internal communication or administration;
Implementation and optimization of the personnel marketing and recruitment process (implementation of consulting in personnel marketing, applicant surveys and statistical evaluations);
Handling Employee Referral Programs;
for the investigation of criminal offences.

If rejected applicants are subsequently involved in legal disputes in or out of court, we also process personal data to protect our legitimate interests on the basis of Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interest here lies in the assertion, exercise or defense of legal claims. If special categories of personal data need to be processed for this purpose, this is done on the basis of Art. 9 para. 2 lit. f GDPR.

If we obtain information from your public profile on professional social networks, we base the processing on our legitimate interest in reviewing the application documents and forming a decision-making basis for establishing an employment relationship with you. The legal basis is Art. 6 para. 1 lit. f GDPR in conjunction with Art. 9 para. 2 lit. e GDPR.

3. Sanctions list comparison

In addition, European Regulations 2580/2001 and 881/2002 require us to check your data against so-called "EU terrorist list" to ensure that no funds or other economic resources are provided for terrorist purposes.

4. Extended applicant screening (only in some companies)

If you apply for a position that is considered sensitive, an extended applicant screening will take place. The aim of the extended screening is to ensure that applicants for sensitive positions at BASF meet the increased requirements for compliance with the law and reliability. The extended applicant screening takes place shortly before a decision is made to establish an employment relationship for a limited group of applicants.

A justification of the processing of personal data in the context of the extended review results from Section 26 para. 1 BDSG or Art. 6 para. 1 sentence 1 lit. b GDPR. The processing of your personal data for the purpose of establishing an employment relationship is necessary because BASF has a legitimate interest in filling sensitive positions within the company with persons who have integrity and act in accordance with applicable law. This is ensured by the extended screening process that precedes your hiring.

a. Criminal record

As part of this extended applicant screening, you will be required to submit a current criminal record. To this end, you will be contacted separately during the application process and asked to request a criminal record and to submit it by mail. The criminal record will be inspected by specially trained employees in accordance with the dual control principle. The criminal record will not be passed on to other units within BASF or to third parties unless this is necessary for legal defense. An abstracted report is prepared as to whether a criminal record has been submitted and whether it contains any relevant records for the particular position applied for. Which previous convictions are present and further data from the criminal record are not documented thereby.

Your data collected for this purpose will not be stored, processed or passed on for any other use. If it is determined that there is no relevant record, the criminal record will be returned to you immediately after review. Should a relevant record be given, the criminal record will be returned 3 months after the conclusion of the application process. The abstracted result will be recorded as a document in the personnel file in the event of employment and will remain there in accordance with the deletion period for relevant personnel documents. In the case of external applications that do not lead to employment, the abstracted result is stored for a period of 3 months.

b. Diploma

In addition, we have your last or highest educational qualification confirmed by the relevant educational institution. You will be contacted as part of the application process to give your approval for confirmation by the educational institution. The confirmation by the educational institution is carried out by specially trained employees on the basis of the dual control principle. An abstract report is created to determine whether there is a significant discrepancy between your information and the feedback from the educational institution. The deviation is not documented.

Your data collected for this purpose will not be stored, processed or passed on for further uses. The confirmation will be kept for 3 months after the conclusion of the application process and then destroyed in accordance with data protection regulations. The abstracted result is recorded as a document in the personnel file in the event of employment and remains there in accordance with the deletion period for relevant personnel documents. In the case of external applications that do not lead to employment, the abstracted result is stored for a period of 3 months.

E. Who gets your data?

When registering or applying for a job posting, initially only persons within BASF Services Europe GmbH have access to your personal data. After reviewing the application, your data will be forwarded to the company to which you have applied.

Within BASF Services Europe GmbH and the company to which you are applying, your personal data will only be disclosed to those persons and departments (e.g. human resources department, works council, representatives of the severely disabled) who need it to fulfill our contractual and legal obligations.

Within the BASF Group, your data will be transferred to certain Group companies as well as affiliated companies (e.g. joint ventures) if they perform tasks centrally for the companies affiliated in the BASF Group or perform tasks across companies due to the organizational structure.

In addition, we use various service providers to fulfill our contractual and legal obligations. These service providers are carefully selected and regularly monitored by us.These are, for example:

·If you receive an invitation to an online cognitive aptitude test, this will be carried out on our behalf by the company HR Diagnostics (Königstraße 20, 70173 Stuttgart; www.hr-diagnostics.de). In the process, we transmit the following personal data for the purpose of sending access data: Name, first name, e-mail address. The purpose of the processing is the use of methodologically target-oriented instruments (such as cognitive test procedures, personality tests as well as professional tests) to determine the level of suitability for individual job profiles. The summarized results of the tests are in turn processed and stored by us in our recruiting system. You can view the relevant privacy policy here: https://www.hr-diagnostics.de/de/datenschutz/.

·If an employment relationship is established, the preparation of onboarding at some Group companies is carried out on behalf of the company Enboarder Limited (UK), (10 John Street, London, WC1N 2EB, United Kingdom). In doing so, we transmit the following personal data for the use of the "Enboarder" tool: Name, first name, e-mail address, telephone number. The purpose of the processing is to send you information about your future employer at regular intervals before you start work, to enable you to place necessary orders, e.g. for workplace equipment and work clothing, and to ask questions about the application process. You can view the relevant privacy statement here: https://enboarder.com/privacy/

·As IT service provider, among others, SAP Deutschland SE & Co. KG (Hasso-Plattner-Ring 7, 69190 Walldorf) (HR data core system and applicant tracking system).

·Incidentally: travel service providers, consulting companies.

In addition, we transfer your personal data to other recipients outside the company, insofar as this is necessary for the fulfillment of contractual and legal obligations as a potential employer. These may be, for example:

· Authorities (e.g. pension insurance institutions, professional pension institutions, social insurance institutions, tax authorities, courts)

· Applicants' bank (SEPA payment medium)

· Health insurance company acceptance points

· Positions in order to be able to guarantee entitlements from the company pension scheme

· Third party debtors in the case of wage and salary garnishments

· Insolvency administrator in the event of personal insolvency

· Auditors and appraisers

· Institutions with which we provide joint vocational training, e.g. vocational school or university

· As part of the "Start in den Beruf" program to partner companies in the region

F. How long will your data be stored?

We usually delete your personal data immediately

after the abovementioned legal basis has ceased to exist;
if your personal data is no longer required for the purposes we pursue;
if the processing is based on your consent and you revoke it.

If, in the above-mentioned cases, another legal basis (e.g. commercial and tax retention periods) should intervene, we will delete the data after the other legal basis ceases to apply.

Taking into account the above principles, we provide for the following retention periods:

a.If you have registered in our application portal for information purposes only (see I. D. 1.a), your data will be deleted after 12 months since your registration in the portal. If you decide to submit an application for an advertised position during this period, the following regulations apply.

b.If you also select the option to be informed of other job offers as part of an application, your applicant profile will be stored for 12 months after completion of the last open application or until you revoke it in advance.

c.If an employment relationship is established, we process and store your personal data for the duration of your employment, which also includes the processing of the employment relationship. In this case, you will be informed separately about the further processing. The data in the application portal will be deleted after the conclusion of the last application process, as soon as the retention of the data is no longer necessary for the above-mentioned purposes.

d.If your application is rejected, your registration will be deleted after the conclusion of the last application process, as soon as the retention of the data is no longer necessary for the above-mentioned purposes. In this context, your personal data will be retained in particular for the period during which claims can be asserted against us. Deletion will therefore generally take place 6 months after completion of your last application. If legal disputes arise in or out of court, we will store your personal data in any case for the duration of the proceedings as well as afterwards in order to comply with various retention and documentation obligations. Should you be offered participation in the talent programs and have given your (revocable) consent for inclusion, your data will be stored for longer. For more information, please refer to the separate data protection information that you will receive with your invitation to the talent programs.

e.In the case of an extended applicant review, the abstracted result is recorded as a document in the personnel file and remains there in accordance with the deletion period for relevant personnel documents. In the case of external applications that do not lead to employment, the abstracted result is stored for a period of 3 months.

f.You can also delete your entire account via the profile function, or have it deleted by a recruiter.

G. Possibility of objection and removal

You can change or delete the data stored about you at any time. Please refer to the contact information mentioned in A. for this purpose. In addition, the e-mail address jobs@basf.com is available to you as a contact option. As a user, you also have the following options in the profile area at any time:

- You can cancel your entire account/registration at any time.

- You can delete all or selected information in your profile.

- You can withdraw your application.

However, if you delete the account before the end of the application process, we will unfortunately no longer be able to consider your application.

H. Will your data be transferred to a third country?

If we transfer personal data to service providers or BASF Group companies outside the European Economic Area (EEA), the transfer will only take place if the third country has been confirmed by the EU Commission to have an adequate level of data protection or if other appropriate data protection guarantees (e.g. binding internal company data protection regulations or EU standard contractual clauses) are in place. You can request information on this and on the level of data protection at our service providers in third countries using the contact information above.

I. Are you obliged to provide your data?

As part of your application, you must provide those personal data that are required for the establishment, implementation and termination of the potential employment relationship as well as a subsequent pension phase and the fulfillment of the associated contractual obligations, or which we are required to collect by law. Without this data, we will not be able to verify whether an employment relationship can be established with you.

J. What rights do you have?

Under the General Data Protection Regulation, you have certain rights:

Right of access: the right of access allows you to obtain information about your personal data processed by us and about certain other information (such as that provided in this Privacy Policy);

Right to rectification: If your personal data is inaccurate or incomplete, you have a right to rectification;

Right to erasure: Based on the so-called "right to be forgotten", you can request the erasure of your personal data, unless there is a retention obligation. The right to erasure is not a right without exception. For example, we have the right to continue to process your personal data if such processing is necessary to comply with our legal obligations or to assert, exercise or defend legal claims;

Right to restriction of processing: this right includes the restriction of the use or the manner of use. This right is limited to specific cases and exists in particular when: (a) the data is inaccurate; (b) the processing is unlawful and you object to erasure; (c) we no longer need the data but you need the data to assert, exercise or defend legal claims. If processing is restricted, we may continue to store the data but not use it. We keep a list of those who have exercised the right to restrict processing in order to be able to ensure this restriction;

Right to data portability: This right implies that we transfer your personal data, if technically possible, in a structured, common and machine-readable format for your own purposes;

Right to object:

You may object to the processing of your personal data if it is processed on the basis of legitimate interests, in particular in the case of direct marketing.

Right to withdraw your consent: If you have given us your consent to process, you have the right to withdraw your consent at any time. Such a revocation does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.

The exercise of these rights is free of charge for you. However, you must prove your identity with two factors. We will use reasonable efforts in accordance with our legal obligations to transfer, correct or delete your personal data in our file systems.

To exercise your rights, please contact us e.g. by e-mail or by post. You will find the contact details under section A.

K. Where can you complain?

You have the possibility to address a complaint to the data protection officer mentioned in this privacy statement (for contact details see section A) or to a supervisory authority, in particular in the member state of your residence, workplace or the place of the alleged infringement.

In any case, you can contact:

Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz (Rhineland-Palatinate State Commissioner for the Protection of Data and Freedom of Information)

Hintere Bleiche 34

55116 Mainz, Germany

https://www.datenschutz.rlp.de/de/general-storage/footer/ueber-den-lfdi/kontakt/

E-mail: poststelle@datenschutz.rlp.de

Part II. - Technical information

BASF appreciates your visit to our website and your interest in our company.

Data protection is a top priority at BASF. Therefore, we would like to inform you about it in detail below:

A. Who is responsible for data processing and who is our data protection officer?

You can find the person responsible for data processing here.

Our data protection officer:

Alexandra Haug

EU Data Protection Officer

67056 Ludwigshafen

+49 (0) 621 60-0

E-mail: data-protection.eu@basf.com

B. What data do we process, for what purposes, for how long and on what legal basis?

In the following, we will inform you about the data processing that takes place on our site (a), its purposes and legal basis (b) as well as the respective storage period and, if applicable, concrete options for objection and elimination (c).

1. Log files

a. Data processing

If you visit our website for information purposes only, i.e. do not register or otherwise transmit data (e.g. via a contact form), the following information is automatically transmitted from your browser to our server:

Your terminal's IP address
Information about your browser
Name of the website from which you are visiting
Name of the offer page (URL) accessed or file opened
Date and time of your visit
Status information such as error messages
Transferred data volumes and the access status (file transferred, file not found, etc.)
Operating system and version of the operating system of your computer as well as the name of your access provider

b. Purposes and legal bases

When you visit the BASF website, we use the IP address and other data that is automatically transmitted by your browser to our server under section B. 1 a. to:

(i) provide you with the requested content

(ii) to ensure the security and stability of our website and to trace any unauthorized use

(iii) make it easy to use our website.

The legal basis for data processing is Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interests follow from the data processing purposes specified above. We do not use the collected data for the purpose of drawing conclusions on your person under any circumstances.

c. Storage period

The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. In the case of the collection of data for the provision of the website, this is the case when the respective session has ended. In the case of storage of data in log files, this is the case after seven days at the latest. Storage beyond this period is possible. In this case, the IP addresses are anonymized by deleting the last eight bits, so that an assignment of the calling client is no longer possible.

2. Cookies

a. Data processing and respective legal basis

We use cookies on our website. This is text information that can be stored for a visited website in the browser on the viewer's terminal (web server, server). The cookie is either sent from the web server to the browser or generated in the browser by a script (JavaScript). The web server can read this cookie information directly from the server during subsequent visits to this page or transfer the cookie information to the server via a website script. Cookies do not cause any damage to your terminal, and do not contain any viruses, Trojans or other malware.

The cookie stores information which in each instance arise in connection with the specifically used terminal device. However, this does not mean that as a result, we obtain immediate knowledge of your identity.

Generally, we use the following cookies:

·Essential cookies

These cookies are required for the website to function. Usually, such cookies are only set in response to actions taken by you which correspond to a service request, such as configuring your privacy settings, logging in, or completing forms. You can select your browser settings to block such cookies or to notify you about them. However, in this case, some areas of the website will not work.

The legal basis for processing such cookies is Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interests follow from the data processing purposes specified under B.1.b.

·Service cookies

These cookies enable us to count visits and traffic sources in order to gauge and enhance the performance of our website. They assist us in determining which pages are most popular, which are least used and how visitors move around the website. All information gathered by these cookies is aggregated and therefore anonymous. If you do not accept these cookies, we cannot know when you have visited our website.

The legal basis for processing such cookies is your consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR, which you have given us by selecting in the cookie banner or in our Privacy Preference Center.

You have the right to withdraw your consent at any time without affecting the lawfulness of the processing carried out on the basis of the consent until withdrawal. To do this, please change the settings in the Privacy Preference Center.

·Functional cookies

These cookies enable the website to provide enhanced functionality and customization. They can be set by us or by third party providers whose services we use on our pages. If you do not allow these cookies, some or all of these services may not function properly.

·Cookies for marketing purposes

These cookies may be set via our website. They may be used by our advertising partners to profile your interests and show you relevant ads on other sites. If you do not accept such cookies, you will experience less targeted advertising.

b. Specific cookie use, purposes and storage duration

Specifically, we use the following cookies, depending on the cookie preferences you set in the Privacy Preference Center. Only essential cookies are activated by default. If you do not want this either, you have the option of rejecting cookies in your browser altogether. In this case the functionality of the visited website may be affected.

3. Contact form and e-mail

a. Data processing

Our websites contain contact forms as well as links for contacting us directly by e-mail. If you use one of these contact forms, the data entered in the entry mask will be transmitted to us and processed. The mandatory data, which must be provided in the respective contact form electronic contact information, are marked therein with (*). If you provide us with additional data, this is done voluntarily.

If you contact us directly by e-mail, we process the associated e-mail meta data as well as the content of the message.

b. Purposes and legal bases

Your data will be processed to enable us to contact you and to process your request and also to provide you with our respective services, as well as to prevent any misuse of the contact form and to ensure the security of our information technology systems.

The legal basis for processing such mandatory information is Art. 6 para. 1 sentence 1 lit. f GDPR. The aforementioned purposes also constitute legitimate interests in the processing of the data. If the objective of the contact is the entering into a contract, an additional legal basis for the processing is Art. 6 para. 1 sentence 1 lit. b GDPR. The legal basis for processing of data voluntarily provided by you is your consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR.

c. Storage period

The data subject's personal data will be erased or blocked once the storage purpose ceases to apply. Data may also be stored if this has been provided for by the European or national legislator in EU regulations, laws or other regulations governing the controller. The data will also be blocked or erased once a storage period prescribed by the aforementioned standards expires, unless there is a need for further storage of such data for entering into or performance of a contract.

If you have given your consent, you have the right to withdraw your consent at any time without affecting the lawfulness of the processing carried out on the basis of the consent until withdrawal. Please notify your respective BASF contact partner accordingly.

4. Social media hyperlink

Our website includes hyperlinks to the following social media services: LinkedIn, Facebook, Twitter, Vimeo, YouTube, Slideshare, flickr and Instagram.

These are designed in the form of the corresponding logos and are stored on our own server. No data about you as a user is transferred to the respective provider services that when our website is loaded for the first time. You will be directed to the respective website only when you click on the logos. More of your data may be processed on such websites.

We have no influence on such data processing on the respective linked websites.

5. Chatbot/Livechat

a. Data processing and purposes

We have integrated the chatbot "Anilina" on our BASF career website. This is a service of jobpal Ltd, Third Floor, 20 Old Bailey, EC4M 7AN London and optimize-it GmbH, Kehrwieder 9, 20457 Hamburg. The chatbot and the associated data processing will only be started if you have previously either clicked the "Accept All Cookies" button in the cookie banner or activated "Functional Cookies" and "Targeting Cookies" in the Privacy Preference Center. By default, "Anilina" is not loaded and therefore no personal data is collected from you.

Our chatbot supports you around the clock with general questions about applications and about BASF as an employer as well as with the search for suitable job offers as self-marketing. If the chatbot cannot answer your request, it will be passed on to the Livechat from our BASF Talent Acquisition-Team.

The participation in a chat is voluntary and possible without registration via the BASF career website. You alone decide which personal data you disclose about yourself in the consulting chat. There is no need to tell us your name. The data provided by you will be processed exclusively for the purpose of carrying out the consultation and its quality assurance. Only data which is necessary to provide our consulting service or to handle your request will be used. This data will not be processed by besides anyone else than the service providers mentioned above and us.

The transfer of the data is encrypted. Technical and organizational security measures are used to protect the data from intentional or accidental manipulation, access by unauthorized persons, changes, loss and destruction.

b. Legal basis

The legal basis for the processing of the data you have voluntarily provided us within the chat is your consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR. You give us this consent by accepting the necessary cookies.

Insofar as the chat is in connection with a potential application to BASF, the legal basis for processing is Art. 6 Para. 1 sentence 1 lit. b) GDPR. Here we use your personal data only to answer your questions. The chat record will not be linked to a concrete application.

Apart from that, we use your information for quality assurance purposes. As far as possible, we will anonymous them. If this cannot be done, we will process your personal data on the basis of Art. 6 Para. 1 sentence 1 lit. f) GDPR. Our legitimate interest in processing the data collected lies in the continuous improvement of our service within the framework of the chat.

c. Storage period

The chat record and its associated metadata will be deleted or blocked as soon as the purpose for which it was stored ceases to apply. Furthermore, data may be stored if this has been provided for by the European or national legislator in EU regulations, laws or other regulations to which the person responsible is subject. Data will also be deleted or made unavailable when a storage period prescribed by the above-mentioned provisions expires, unless there is a need to continue storing the data for the purpose of concluding or fulfilling a contract.

In case of a consent, you have the right to revoke such consent at any time, without affecting the lawfulness of the processing carried out on the basis of the consent until revocation. Please inform your respective contact partner at our company about this

C. Are you obliged to provide us with this data?

When visiting our website, the information mentioned in Section B. 1. a. and the information from the cookies classified as essential is processed automatically. Transmission of such information is voluntary. We cannot display the requested page without the provision of such personal data.

If you:

- allow us to use cookies not classified as essential,

- want to contact us and send us an e-mail or use our contact form to do so (including the necessary reCAPTCHA query), or

- would like to watch embedded YouTube videos,

transmission of such information is voluntary.

If you contact us, we will not be able to answer your request, or not in the optimal manner in the selected way if you do not provide us with personal data required in the particular case. Insofar as cookies are concerned, the lack of consent may lead to the restriction of the functionality of the website or parts of it. Embedded videos cannot be played without your consent.

D. Whom do we disclose your personal data to?

Within our company, only persons and departments are given access to your aforementioned personal data who need such data to fulfill the purposes mentioned above.

We also collaborate with service providers. These service providers work only according to our instructions and are contractually obliged to comply with the applicable data protection requirements.

Moreover, we disclose your data to third parties only if:

- you have given your express consent to do so in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR,

- the disclosure is necessary pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR for the establishment, exercise or defense of legal claims and if there is no reason to assume that you have overriding legitimate interests in your data not being disclosed,

- there is a statutory disclosure obligation in accordance with Art. 6 para. 1 sentence 1 lit. c GDPR or

- this is permitted by law and required for the performance of contractual relationships with you in accordance with Art. 6 para. 1 sentence 1 lit. b GDPR.

Your personal data will be disclosed to service providers in a third country only if the special requirements of Article 44 et seqq. GDPR are satisfied.

E. How do we secure your personal data?

BASF uses technical and organizational security measures to protect your personal data against accidental or intentional manipulation, loss, destruction or access by unauthorized persons. Our security measures are continuously revised in line with technological developments.

F. What are your rights?

You are entitled to certain rights under the General Data Protection Regulation:

Right of access: The right of access allows you to obtain information about your personal data processed by us and about certain other information (such as that provided in this Privacy Statement);

Right to rectification: If your personal data is incorrect or incomplete, you have a right to rectification;

Right to erasure: Based on the so-called "right to be forgotten", you can request the erasure of your personal data, unless there is an obligation to retain them. The right to erasure is not an absolute right. For example, we have the right to continue processing your personal data if such processing is necessary for compliance with our statutory obligations or for the establishment, exercise or defense of legal claims;

Right to restriction of processing: This right includes the restriction of use or of the manner of use. This right is limited to certain cases and exists in particular if: (a) the data is inaccurate; (b) processing is unlawful and you refuse its erasure; (c) we no longer require the data, but you need for the establishment, exercise or defense of legal claims. If the processing is restricted, we may continue to store the data, but not use it. We keep a list of persons who have exercised the right to restrict processing in order to be able to ensure this restriction;

Right to data portability: This right includes that if technically possible, we transmit your personal data in a structured, common and machine-readable format for your own purposes;

Right to object:

You may object to the processing of your personal data if they are processed on the basis of legitimate interests, in particular in the case of direct marketing.

Right to withdraw your consent: If you have given us your consent to processing, you have the right to withdraw your consent at any time. Such withdrawal will not affect the lawfulness of the processing carried out on the basis of the consent until withdrawal.

The exercise of these rights is free of charge for you. However, you must prove your identity with two factors. We will make reasonable efforts in accordance with our statutory obligations to transfer, rectify or erase your personal data in our file systems.

To exercise your rights, please contact us, e.g. by e-mail or by post. The contact details are provided in section A.

G. Where can you lodge a complaint?

You have the option of lodging a complaint with the data protection officer specified to in this Privacy Policy (see section A for contact details) or with a supervisory authority, in particular in the Member State of your place of abode, your place of employment or the place of the suspected infringement.

In any case, you may contact:

Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz (Rhineland-Palatinate State Commissioner for the Protection of Data and Freedom of Information)

Hintere Bleiche 34

55116 Mainz, Germany

https://www.datenschutz.rlp.de/de/general-storage/footer/ueber-den-lfdi/kontakt/

e-mail: poststelle@datenschutz.rlp.de