New design, new opportunities. The job portal is being redesigned. Current job vacancies that have not yet been transferred to the new job portal can still be found on our old job board. It’s well worth having a look there too!

Data privacy statement

Data protection notice for applications for positions at the Deutsche Bundesbank using the job portal

1. Controller and Data Protection Officer

Responsible unit:

  • Deutsche Bundesbank
  • Directorate General Human Resources
  • Wilhelm-Epstein-Strasse 14
  • 60431 Frankfurt am Main, Germany
  • Email: jobs@bundesbank.de

Data Protection Officer:

  • Email: datenschutz@bundesbank.de
  • Tel.: 069 9566-32369
  • Postal address: Deutsche Bundesbank, Data Protection Officer, Postfach 10 06 02, 60006 Frankfurt am Main, Germany

2. General information on data processing

The protection of your personal data is of great importance to the Deutsche Bundesbank. Your data will be processed in accordance with the German data protection provisions, the Federal Data Protection Act (BDSG), the General Data Protection Regulation (GDPR) and - for internal applicants - the Bundesbank’s operational data protection regulations. Below, we will inform you about the processing of your personal data in the context of your use of the job portal and your application.

3. Purpose and legal basis of data processing

We process your personal data solely for the purpose of conducting the application procedure, managing your user account, using additional functions (e.g. Job Merker, Job subscription, talent pool) and fulfiling legal obligations relating to your application and the selection procedure.

In particular, the legal basis is as follows:

  • For the implementation of the application procedure: Art. 6(1)(b), Art. 88 GDPR in conjunction with § 26 BDSG, § 106 BBG
  • In the case of special categories of personal data pursuant to Art. 9 Para. 1 GDPR (e.g. information on disability): Art. 6(1)(c), Art. 9(2)(b), Art. 88 GDPR in conjunction with § 22 para. 1 number 1a, § 26 para. 3 BDSG, § 164 SGB IX.
  • In the case of consent (e.g. talent pool): Art. 6 (1) (a) GDPR in conjunction with § 26 (2) BDSG

4. Type of data processed

As part of your application and depending on the use of the job portal and the functions offered, the following data will be processed:
For all applicants:

  • Master data (surname, first name, title, address, Contact details, marital status)
  • Application data (e.g. CV, references, qualifications, photographs, motivation letter, if applicable Information on disability)
  • Usage data (e.g. logins, watchlist, subscribed jobs)
  • Communication data (e.g. messages in the job portal)
  • Test results (for online tests)
  • Data on preferences (e.g. in talent pool, job marker, job subscription)
  • Log data (e.g. IP address, timestamp, browser type, referrer URL)
  • Cookies and similar technologies (see point 10)
  • Data related to the electronic signature of documents (e.g. name, email address, signed documents; see point 4c)

For external applicants only:

  • Access data (email address, user name, password)
  • Where applicable, Data from social media login (LinkedIn, Xing; see point 4a)

For internal applicants only:

  • Staff reference data and employment data (e.g. career history, current employment data, operational functions, secondments, leave of absence, Appraisal divisions)
  • Access data (automatically generated user account via single sign-on)
  • Data transfer from the HR system (SAP HCM; see point 4b)

Further information on additional functions:

Job flag:

In the job advertisement detail view, there is a possibility of placing job advertisements on a watchlist in order to apply for them at a later date.

Job subscription:

The job subscription offers the option of having current job offers sent by email at regular intervals according to selected search criteria.

Talent pool:

The talent pool offers the option of saving your profile in order to draw your attention to it in a targeted manner when providing suitable future job opportunities. The aim is to inform you of suitable vacancies and give you the opportunity to apply for them. Your pool profile can be updated at any time. The collection of your personal data in the talent pool is solely based on your express consent.

CV parsing:

As part of the application process, we offer you the opportunity to upload your CV. Using an automated CV parsing tool, the information contained in the course of life (e.g. name, contact details, training, professional experience, skills) is read out and transferred to the corresponding fields of the application form. The CV parser of Microsoft Ireland Operations Limited (Ireland) is used for this purpose. The CV parsing tool does not work with artificial intelligence (AI), but uses rule-based algorithms for automated data extraction. The transferred data will not be automatically transferred, but will be displayed to you in the application form. You can review, correct or supplement the data you have received at any time before submitting your application. The processing is solely for the purpose of simplifying and accelerating the application process.

Skillmatcher:

Provided that you use this function, the qualifications, experience and skills specified in the CV are automatically analysed in order to suggest suitable job advertisements. The analysis is based exclusively on the data you provide. Your personal data is processed by an algorithm-based system in order to create an individual qualification profile and match it with the requirements of vacancies. The Bundesbank is responsible for the processing of your personal data as part of the skillmatcher under data protection law. The technical implementation is carried out by our service provider Milch & Zucker GmbH as part of a contract processing pursuant to Art. 28 GDPR. No independent use or processing of your data by Milch & Zucker GmbH for other purposes is permitted. The processing is only used to show you relevant job offers.

4a. Social media login (external only)

If you register or log in via LinkedIn or Xing, we use these platforms exclusively as identity providers. As part of this process, the data required for authentication and registration (name and email address) are transmitted by the respective provider to the job portal and stored there. Personal data will not be transferred back from the job portal to LinkedIn or Xing.
Please note that when using the social media login, technical data (such as your IP address or timestamp) can be exchanged between your end device and the respective provider as part of the authentication process. The specific data transfer depends on the settings of your social media profile. As providers may be domiciled outside the EU/EEA, authentication may involve the transfer of personal data to third countries. For further information on data processing by LinkedIn and Xing, please refer to the data protection notices of the respective provider.

4b. Data transfer from the HR system (internal only)

Relevant personal data (e.g. staff master data, employment data) are automatically transferred from the HR system (SAP HCM) for the use of the internal job portal and for the implementation of application procedures. This is used to simplify the application process and avoid duplicating information.

4c. Electronic signature of documents (for all)

As part of the application process, certain documents (e.g. contracts, declarations) may need to be signed electronically. To this end, we use the external service provider Yousign SAS, which, as a subcontractor of our technical service provider Milch & Zucker AG, is responsible for processing orders pursuant to Art. 28 GDPR. As part of this process, the personal data required for the electronic signature (e.g. name, email address, signed document) will be transmitted to Yousign by both applicants and signatory Deutsche Bundesbank staff and processed there exclusively for the purpose of legally secure electronic signature. For more information on data processing by Yousign, see the Yousign Data Protection Notice: https://yousign.com/de/datenschutz.

5. Categories of special personal data

The provision of special categories of personal data (e.g. information on disabilities) is voluntary and is only required if you wish these to be taken into account in the application process (e.g. to safeguard legal rights or to take account of compensation for disadvantages). Provided that you transmit special categories of personal data, their processing takes place exclusively for the purpose specified in each case, in compliance with the legal requirements and with respect to confidentiality. This data is processed on the basis of Art. 9 (2) (b) GDPR in conjunction with § 26 (3) BDSG (fulfilment of obligations in the area of labour law and the law of social security and social protection).

6. Origin of data

External applicants:

Your data will generally be collected directly from you as part of the registration, application or use of the job portal. When using the social media login (LinkedIn, Xing), the data required for registration are transmitted directly by the respective provider.

Internal applicants:

The data are generally collected directly from you as part of your application or use of the internal job portal. In addition, relevant data are automatically transferred from the HR system (SAP HCM).

Other data sources:

As the application procedure progresses, personal data from other sources may also be processed - insofar as necessary for the conduct of the selection procedure, e.g. feedback from specialist departments, interview notes, results of suitability tests or assessment centres. Data from other sources will only be processed to the extent permitted by law.

7. Recipients of data or order processing

Internal recipients:

Access to your personal data As part of the application process, only authorised employees of the Deutsche Bundesbank who are involved in the selection process in accordance with their function and role will be granted. This includes, in particular, the following roles in the job portal: Administrators, HR management, business unit, Commission members, equal opportunities officer, Representatives of disabled employees, Staff Representation Council and Analysis tics (exclusively for statistical evaluations, without access to individual personal data).

Employees in other supporting roles (e.g. job evaluation, organisational development, coordination unit) do not have access to application data, but are involved exclusively in organisational review and administration.

Access to your data is always based on the principles of necessity and purpose and is restricted to the persons and roles required to carry out the application procedure.

External service providers:

As a technical service provider, Milch & Zucker GmbH is responsible for the job portal as part of a contract processing pursuant to Art. 28 GDPR. The following subcontractors will also be employed by Milch & Zucker GmbH as part of the application process:

  • Microsoft Ireland Operations Limited (Ireland) for the automated reading and transfer of life cycle data (CV parsing).
  • Yousign SAS for electronic document signing.
  • Commify Germany GmbH (Mail2SMS Provider) for sending automated SMS reminders for upcoming appointments (e.g. interview, selection procedure), if provided for in the respective procedure. For this purpose, your mobile number specified in the application process will be used exclusively to send the reminder SMS.

In the case of online tests, a transmission is made to ELIGO Psychologische Personalsoftware GmbH, which is also the processor pursuant to Art. 28 GDPR.

All service providers and their subcontractors process your data exclusively on the instructions of the Deutsche Bundesbank and are contractually obliged to comply with data protection regulations.

Other third parties:

Passing on to other third parties shall only take place insofar as this is required by law.

Data transfer to third countries:

As a general rule, your personal data will not be transferred to third countries (countries outside the EU/EEA). However, when using the social media login (LinkedIn, Xing; external only), data that may be domiciled outside the EU/EEA are transmitted to the respective providers as part of the authentication process. In these cases, data are transmitted on the basis of the standard contractual clauses provided by the European Commission by the providers or other appropriate guarantees pursuant to Art. 46 GDPR, where applicable. Please note that transfers to third countries where there is no adequate level of data protection and where there are no suitable guarantees may pose an increased risk to the rights and freedoms of the data subject (e.g. limited enforceability of data protection rights). Further information on data processing and the guarantees used can be found in the data protection notices of the respective providers.

8. Duration of storage and deletion

Your personal data, which are processed in the job portal as part of the application procedure, will only be stored for as long as this is necessary for the conduct of the selection procedure and the filling of the advertised position.

Uncompleted applications (e.g. only saved, not submitted, or email verification not done):

  • External: Automatically deleted or anonymised after 10 or 21 days.
  • Internal: Automatically deleted or anonymised after 21 days.

If application is successful:

  • The data collected during the application procedure are transferred to the personnel file and stored according to the retention periods applicable to the employment relationship.

If the application is not successful:

  • Upon receipt of the rejection letter, your application data will be stored for a period of 180 days (six months) in order to answer any questions regarding the application process and defend against possible claims under the General Equal Treatment Act (Allgemeine Gleichbehandlungsgesetz – AGG). After expiry of this period, your personal data will be deleted or - provided that further use for statistical purposes is necessary - anonymised. Anonymised data no longer contain personal references and are used exclusively for statistical evaluation.

In the event of revocation of consent or deletion request:

  • Deletion or anonymisation shall take place no later than one day after receipt of the application, provided that no statutory retention periods or legitimate interests conflict.

Online test data:

  • The data collected as part of online tests will be deleted by the service provider no later than 12 months after the last registration.

User account:

  • External: Accounts that are not activated or not used (e.g. registration not completed) are deleted after 10 days. Temporary accounts (e.g. application without registration) will be deleted 10 days after the application process has been completed, provided that there are no further active applications. Active user accounts will be deleted no later than 180 days (six months) after the last activation of the data protection declaration, provided that there are no further active applications and the data protection declaration is not extended. If you or the administration actively delete your user account and all associated data, the user account and all associated data will be deleted immediately, provided that there are no more active applications.
  • Internal: The user account is managed via the internal system (SSO).

Talent pool:

  • Provided that you agree to be included in the talent pool, your personal data will be stored beyond the specific application procedure in order to be able to consider and contact you in future suitable job postings. The data are stored solely on the basis of your consent. You will be asked to renew your consent on a regular basis (every six months). In the case of explicit rejection or revocation, the deletion or anonymisation takes place no later than one day after the status change. If no reply is received, your consent will be considered non-extended and your data will be deleted or anonymised no later than one day after the deadline.

Job marker and job subscription:

  • Data that is stored as part of the Job Flag and Job Subscription functions will remain in the system until you delete it or until your user account is terminated. The job subscription is immediately deleted by clicking on the unsubscribe link.

Log Data:

  • Log data (e.g. IP address, access time) is typically deleted after seven days. Longer periods of storage only take place if this is necessary to clarify security-related incidents (e.g. IT attacks, suspected misuse) or to fulfil legal obligations. In such cases, the data will be deleted after the action is completed.

Data from social media logins (external only):

  • The data transmitted via LinkedIn or Xing as part of the registration will be treated like the other registration data and deleted after the aforementioned deadlines.

Data from the electronic signature:

  • The data processed as part of the electronic signature will be stored in accordance with the statutory requirements and the deletion deadlines of the service provider used (Yousign) and then deleted.

Longer storage is only possible if statutory retention periods (e.g. pursuant to the German Commercial Code (Handelsgesetzbuch), the German Fiscal Code (Abgabenordnung) or the General Equal Treatment Act (Allgemeine Gleichbe-Handlungsgesetz)) require this. The retention periods are usually:

  • According to the General Equal Treatment Act: 6 months from receipt of the cancellation,
  • According to the Commercial Code and the Financial Statutes: Up to 10 years for billing-relevant documents;
  • For other documents: In accordance with the relevant legal requirements in each case.

After the respective deadline, the data will be deleted or anonymised.

9. Data security

Your data is protected during transmission and storage by suitable technical and organisational measures (e.g. SSL encryption, access restrictions, regular security screenings). The servers are located in Germany and are operated according to current standards.

10. Use of cookies, web analysis tools, plugins

The JobPortal uses a technically necessary cookie, which is necessary for the operation and the basic functionality of the JobPortal. Without this cookie, the job portal can only be used to a limited extent or cannot be used properly.

11. Rights of data subjects

You have the right to:

  • Information about the data stored about you (Art. 15 GDPR)
  • Correction of incorrect data (Art. 16 GDPR)
  • Deletion of your data (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Opposition to processing (Art. 21 GDPR)
  • Revocation of a given consent (Art. 7 (3) GDPR)
  • Complaint to a supervisory authority, in particular the Federal Commissioner for Data Protection and Freedom of Information (BfDI: E-Mail: poststelle@bfdi.bund.de)

12. Obligation to provide the data

The provision of your personal data is necessary for the implementation of the application procedure. Without this data, your application cannot be processed. The use of the social media login (LinkedIn, Xing) is voluntary (external only). Alternatively, you can register directly via the job portal.

13. Withdrawal of consent

Provided that the processing of your data is based on your consent (e.g. Talentpool), you can revoke this consent at any time with effect for the future. This shall be without prejudice to the legality of the processing carried out up to the time of revocation.

14. Contact options

If you have any questions regarding data protection or the assertion of your rights, please contact the Bundesbank’s Data Protection Officer (see above).

15. Subject to change

The Bundesbank reserves the right to update this data protection notice if necessary. The latest version can be found in the job portal.

Last updated: 02/03/2026