Privacy

1. Welcome

We are delighted that you have decided to apply to us and would like to extend a warm welcome to you. The protection of your personal data is important to us – below, we explain how we process your data during the application process. If you have any questions, please do not hesitate to contact our Data Protection Officer (see section 11).

2. Provision of the website / log file data

When you use our website purely for information purposes – that is, if you are not applying for a job or otherwise providing us with information – we collect the following technical information (log file data):

Operating system and browser (type, version, language settings) of your device
Amount of data accessed
Current IP address of your device
Date and time of access
URL of the previously visited page (referrer) and of the (sub-)page accessed
Internet service provider of the accessing system

The collection of this data is technically necessary to display the website to you and to ensure its stability and security. As a general rule, we do not know who is behind an IP address; no linking with other data takes place. The legal basis is Article 6(1), first sentence, point (f) of the GDPR. The data will be deleted as soon as it is no longer required for the purpose for which it was collected, at the latest after six weeks; in the event of longer storage, IP addresses will be deleted or anonymised.

3. Cookies

This website uses so-called cookies – small text files that are stored on your device and make using our site easier, more secure and more user-friendly. Some cookies are automatically deleted at the end of your browser session (session cookies), whilst others remain stored and recognise your device when you visit again (persistent cookies). When you access the website, we inform you about the use of cookies and, where necessary, obtain your consent. No personal data is stored in the cookies we use; we only receive anonymised information based on the cookies. You can refuse cookies at any time or disable them via your browser settings – please note that certain functions of the website may then be restricted. The legal basis, where you have given your consent, is Article 6(1)(a) of the GDPR; otherwise, it is our legitimate interest pursuant to Article 6(1)(f) of the GDPR.

Specifically, we use the following cookies:

Name	Provider	Purpose	Expiry	Type
sid	rexx systems	Anonymous user ID for grouping multiple requests within a session	1 hour	Necessary
cookieconsent_status	rexx systems	Stores your cookie settings	30 days	Necessary
_pk_id*	matomo	Unique visitor ID for statistical purposes	13 month	Web analytics
_pk_ref*	matomo	Reference to anonymous tracking session	6 month	Web analytics
_pk_ses*	matomo	Unique Session ID	30 minutes	Web analytics
MATOMO_SESSID	matomo	Session/Visitor-ID	Until browser is closed	Web analytics

We use Matomo cookies to create pseudonymised usage profiles in order to analyse behaviour on our website and improve our services. No personal identification takes place in this process.

4. The application process

The application process requires applicants to provide us with the data necessary for their assessment and selection. The information required is set out in the job description or, in the case of online forms, in the details provided therein.

Generally, the required details include personal information such as your name, address and contact details, as well as evidence of the qualifications necessary for the role. Upon request, we will be happy to provide further details on what information is required.

You are welcome to submit your application via our online form, which is encrypted using state-of-the-art technology.

For the search for applicants, the submission of applications and the selection process, we use the recruitment platform of our partner, rexx systems GmbH, in compliance with legal requirements, as well as services from third-party providers where applicable. Further details on this can be found in the ‘Rexx Systems’ section below.

5. Processing of special categories of data

Where, as part of the application process, special categories of personal data (Article 9(1) of the GDPR, e.g. health data, such as severe disability status or ethnic origin), we process this data only to the extent necessary to enable us or you to exercise the rights and fulfil the obligations arising from labour law and the law on social security and social protection. This also applies where the processing serves to protect vital interests or is necessary for the purposes of preventive healthcare, occupational medicine, the assessment of your fitness for work, medical diagnosis or the provision of healthcare or social care.

6. Deletion of data

The data you have provided may be further processed by us for the purposes of the employment relationship in the event of a successful application. Otherwise, if your application for a vacancy is unsuccessful, your data will be deleted. Your data will also be deleted if you withdraw your application, which you are entitled to do at any time. Subject to a valid withdrawal on your part, the data will be deleted no later than six months after your application – so that we can answer any follow-up questions regarding your application and fulfil our obligations to provide evidence under the regulations on the equal treatment of applicants. We archive invoices for any travel expense reimbursements in accordance with tax law requirements.

7. Inclusion in a candidate pool

Inclusion in our candidate pool, where offered, is based on your consent. We inform you that your consent to inclusion is voluntary, has no bearing on the current application process, and that you may withdraw your consent at any time with effect for the future.

8. Overview of data processing

Types of data processed: Contact details (e.g. postal and email addresses, telephone numbers); and application data (e.g. personal details, documents relating to the application and the information contained therein, such as cover letters, CVs, certificates, as well as any further information regarding your person or qualifications provided in relation to a specific post or on a voluntary basis).

Data subjects: Job applicants.

Purposes of processing and legitimate interests: Conducting the recruitment process (establishment and, where applicable, subsequent implementation, as well as possible termination of the employment relationship).

Retention and erasure: see section ‘6. Deletion of data’.

Legal bases: Recruitment process as a pre-contractual or contractual relationship (Article 6(1), first sentence, point (b) of the GDPR); legitimate interests (Article 6(1), first sentence, point (f) of the GDPR). Inclusion in the candidate pool: consent (Article 6(1), point (a) of the GDPR).

9. Rexx Systems

We use the platform provided by rexx systems GmbH to manage recruitment processes. This includes, in particular: storing and organising your application data, processing online applications, communicating with you, scheduling interviews, compiling reports on recruitment processes, and managing job advertisements;

Service provider: rexx systems GmbH, Süderstraße 75-79, 20097 Hamburg, Germany;
Legal basis: our legitimate interest (Article 6(1), first sentence, point (f) of the GDPR);
Further information:
Website: https://www.rexx-systems.com/.
Privacy policy: https://www.rexx-systems.com/datenschutz/.

10. Disclosure of data / recipients

Generally, your personal data will not be disclosed to third parties - unless we are legally obliged to do so, the disclosure is necessary for the purposes of the recruitment process, or you have given your express consent.

Your data will only be disclosed to affiliated companies and service providers acting on our behalf (e.g. rexx systems, see above) who assist us in providing our services. These service providers receive only the information necessary for their respective tasks and are not permitted to use it for their own purposes.

We process the data you submit via our application portal within the EU/EEA and in accordance with the data protection standards applicable there. For job vacancies outside Germany, we sometimes also use external job portals (e.g. in the UK or the USA). If you apply via such an external portal, the privacy policy of the respective provider applies to the data processing carried out there – we have no influence over this processing and cannot provide any guarantee in line with EU data protection standards.

11. Data controller

For applications in Germany:

BRAIN Biotech AG
Darmstädter Straße 34-36
D-64673 Zwingenberg

For applications outside Germany:

Biocatalysts Ltd,
Unit 1 Cefn Coed, Parc Nantgarw,
Cardiff, UK CF15 7QQ

You can contact our Data Protection Officer at privacy [at] brainbio.com.

12. Rights of data subjects

As a data subject, you are entitled to various rights under the GDPR, those set out in Articles 15 to 21 of the GDPR:
Right to object: You may object at any time, on grounds relating to your situation, to the processing of your data based on Article 6(1)(e) or (f) of the GDPR.
Right to withdraw consent: You may withdraw any consent you have given at any time.
Right of access: You may request confirmation as to whether and which data we process about you, as well as access to and a copy of this data.
Right to rectification: You may request that incomplete data be completed or that incorrect data be rectified.
Right to erasure and restriction of processing: You may request the immediate erasure of your data or, alternatively, a restriction on processing.
Right to data portability: You may receive the data you have provided in a structured, commonly used, machine-readable format or request that it be transferred to another data controller.
No automated decision-making: No automated decision regarding your application or profiling will take place.
Voluntary provision: The provision of your data is voluntary; there is no obligation to do so, although this may affect the conduct of the recruitment process.
Right to lodge a complaint: You may lodge a complaint with a data protection supervisory authority, in the Member State of your residence, place of work or the place where the alleged infringement occurred.
The supervisory authority responsible for data protection matters in our case is the State Data Protection Commissioner of the federal state in which our company is based:

The Hessian Commissioner for Data Protection and Freedom of Information
Wilhelmstraße 7
D-65185 Wiesbaden
Telephone: +49 (0)611 1408-0
E-Mail:poststelle [at] datenschutz.hessen.de

13. Data security

We have implemented comprehensive technical and organisational measures to protect your data against accidental or deliberate manipulation, loss, destruction or unauthorised access. Our security measures are regularly reviewed and updated in line with the latest technical standards.

Date: 27 August 2026