MEDWING International Recruiting GmbH Privacy Policy
‍
1. Contact Details of the Controller and the Data Protection Officer
‍
1.1 The controller within the meaning of the GDPR is:

MEDWING International Recruiting GmbH (hereinafter "MEDWING") represented by Petra Lütkewittte

Hannoversche Straße 9, 10115 Berlin

Email: info@medwing-international.com | Phone: 030 27595481

1.2 MEDWING has appointed a Data Protection Officer. For questions regarding data protection at MEDWING or the data stored about you, please contact us by post or email:

heyData GmbHSchützenstr. 510117 BerlinEmail: datenschutz@medwing-international.com

2. Notes on the Processing of Personal Data During the Placement Process and the Provision of Related Services
‍
If you wish to use MEDWING's services as an international applicant, it is necessary to conclude a placement agreement with MEDWING. For the establishment and performance of this agreement, we collect, use, and process certain personal data from you. Further information on concluding the placement agreement can be found in our General Terms and Conditions for international applicants.

For our service, the following personal data is processed and shared:
- Master and contact data: Name, first name, address, email, phone/mobile, date of birth, nationality, passport numbe
- Career data: Education, work experience, professional preferences, language skills
- Documents: CV, profile photo, employment/internship references, educational certificates, diplomas, and other contextually relevant documents (e.g. for recognition & visa purposes)
- Other voluntary information: Marital status or other interest-related aspects

The data listed above is collected for the purpose of placing you in a job in Germany. We reserve the right to share this data with cooperation partners or employers in Germany who offer positions matching your applicant profile and support you during the migration and relocation process. We will only transmit your applicant profile and the required personal data to the respective cooperation partner if you give your consent during our consultations. The legal basis for the data processing in connection with the transmission of this data and the provision of our services under the placement agreement is Art. 6(1)(1)(b) GDPR.

The data may only be accessed and processed by authorized persons. If additional data is required, separate consent from the candidate must be obtained. The data is stored for as long as the placement agreement has not been terminated (see Section 4).

Where applicants have given their express consent during the application process, we will share their personal data (in particular contact details, CV, and qualifications) with our sister company, Careloop GmbH. This serves the purpose of presenting applicants to Careloop's partner employers for suitable job vacancies. The legal basis for this data transfer is the applicant's express consent (Art. 6(1)(1)(a) GDPR). This consent may be revoked at any time without formality and with effect for the future.

3. Notes on the Processing of Selected Health Data
‍
As part of the placement process, employers request information on the vaccination status regarding vaccinations required for work in the German healthcare sector. This information constitutes health data, which is considered particularly sensitive data within the meaning of Art. 9(1) GDPR. The relevant health data for the provision of our services relates to vaccination status and includes the number of doses, vaccine type, and date of the relevant vaccinations against the following diseases:

- Corona / COVID-19
- MMR (Measles-Mumps-Rubella)
- Other vaccinations required for deployment in certain wards or facilities (e.g. pediatric wards)

MEDWING requests the necessary documents to verify the vaccination status against current requirements (e.g. regarding the facility-based COVID-19 obligation) and to provide proof to the future employer. The processing results in the storage of data in a digitally maintained profile in order to verify the currency of the vaccination status during placement and at the time of entry into Germany.

The data listed above is collected for the purpose of placing you in and commencing employment in Germany, and is used exclusively as proof of vaccinations required by law or by the future employer.

The data may only be accessed and processed by authorized persons. If additional data is required, separate consent from the candidate must be obtained. The data is stored for as long as the placement agreement has not been terminated (see Section 4).

4. Sub-processors

As part of contractual or pre-contractual measures, we process your personal data within MEDWING International Recruiting GmbH. Only those persons who require it to fulfill our contractual and legal obligations will have access to your personal data.

In addition, we use the following service providers to handle your inquiry or registration:
- Ankaadia GmbH, Clara-Schumann-Str. 3, 61440 Oberursel, Germany
- Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
- WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland

The transfer of your personal data to third countries or to an international organization cannot be excluded due to the service providers used — particularly in the context of international recruitment. Additional recipients may include, for example, authorities and financial institutions.

Any transfer of personal data to and subsequent processing by our sister company Careloop GmbH takes place exclusively on the basis of a separate consent from the applicant, as described in Section 2 of this Privacy Notice. The legal basis for the data transfer is Art. 6(1)(b) GDPR and, in the case of government institutions, Art. 6(1)(c) GDPR.
‍‍
5. Termination
‍
In the event of termination of the placement agreement, we will delete all personal data, including the aforementioned health data, no later than 30 days after the end of the agreement, or, where we are contractually or legally obliged to retain the relevant data, block it and restrict its processing until final deletion. Where processing of personal data is necessary to fulfill a legal obligation to which our company is subject, Art. 6(1)(c) GDPR serves as the legal basis.
‍
6. Rights of Data Subject

The signatory is a data subject within the meaning of the General Data Protection Regulation (GDPR) and has the following rights against the controller:

a. Right of Access
The signatory has the right, pursuant to Art. 15 GDPR, to request information about the personal data processed about them.

b. Right to Object
The signatory has the right, without stating reasons, to object at any time to the processing of their personal data carried out on the basis of Art. 6(1)(f) GDPR, in accordance with Art. 21(1) GDPR. An email is sufficient for this purpose. The lawfulness of the processing carried out on the basis of consent up to the point of revocation is not affected by the revocation. The controller will then no longer process the personal data unless it can demonstrate compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the signatory, or unless the processing serves the establishment, exercise, or defense of legal claims. The collection of data for the provision of the website and the storage of log files are strictly necessary for the operation of the website.

c. Right to Rectification
Should the data stored about the signatory be inaccurate or no longer accurate, rectification may be requested pursuant to Art. 16 GDPR. Where data is incomplete, the right to have it completed exists.

d. Right to Erasure
The signatory may request the deletion of their personal data pursuant to Art. 17 GDPR.

e. Right to Restriction of Processing
Pursuant to Art. 18 GDPR, the signatory has the right to request the restriction of the processing of their personal data.Where processing has been restricted, such data may — apart from storage — only be processed with the consent of the signatory or for the establishment, exercise, or defense of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or a Member State. The signatory will be informed before any such restriction is lifted.

f. Right to Lodge a Complaint
Pursuant to Art. 77(1) GDPR, the signatory has the right to lodge a complaint with a data protection supervisory authority of their choice if they believe that the processing of their personal data violates data protection law.The competent supervisory authority is, among others, the Berlin Commissioner for Data Protection and Freedom of Information (Email: mailbox@datenschutz-berlin.de).

g. Right to Data Portability
Where the conditions of Art. 20(1) GDPR are met, the signatory has the right to receive data they have provided to the controller, which is processed automatically on the basis of their consent or for the performance of a contract, and to have it transmitted to themselves or to a third party.The collection of data for the provision of the website and the storage of log files are strictly necessary for the operation of the website and are therefore not based on consent pursuant to Art. 6(1)(a) GDPR or on a contract pursuant to Art. 6(1)(b) GDPR, but on Art. 6(1)(f) GDPR. The conditions of Art. 20(1) GDPR are therefore not fulfilled in this regard.

7. Consequences of Non-Signature

The signatory has the right not to consent to this Privacy Notice. Since the collection, sharing, and processing of the data described above is strictly necessary for the services provided within the scope of placement and migration support, failure to sign excludes the use of the offered services.
‍‍
8. Currency and Amendments to this Privacy Notice
‍
This Privacy Notice is current as of April 2026.