Personal data processing information
for applicants (English*)
*for other language versions please click the respective links right below
German / French / Italian / Polish / Chinese
Introduction
These Personal Data Processing Information (“Information”) are for the information of applicants during the application process.
We may process personal data on other occasions, such as our website or when conducting business with you. In these cases, we will provide you with separate data protection information.
If you read this information you are about to send your personal data to a member company of the Exyte Group as an applicant for a position at the Exyte Group. If you do not know, who we are yet, you will find some useful information on our website www.exyte.net.
With these Information we would like to inform you about how we process personal data (“Personal Data”) which you transferred to Exyte, which rights you have as data subject, and provide you with other helpful material about data processing.
Please note that these Information do not constitute a contract or an offer for a contract but are for your information only.
1. Applicability of these Information and Controller
Firstly, you will want to know who you are actually sending your personal data to and who is processing your personal data as “controller”.
As you may already have seen on our website, Exyte is a company group with many members. You can find a list of all our locations and members under this link.
This Information is for your application process at European Exyte entities. If you are applying at another country outside the European Economic Area, we may have specific data protection information for this country, which you can find at the end of this document.
If you apply at a European entity the controller of your Personal Data will be the entity you apply to for a position at Exyte. You can find the contact data of the responsible person for the position you apply for on our career page under this link at the respective job (you will find all entities in the Exyte Group under the following link).
If you are applying to an entity outside of the European Union, Exyte Management GmbH is only forwarding your information to such entity. Please be aware that your data may not be subject to the laws of the European Union, if you are applying to an entity outside the European Union and some countries may have a lower standard of data protection.
Following we refer to the controller as “Exyte, we or us”.
2. Data Protection Officer
We have appointed a Data Protection Officer (“DPO”). You can reach the DPO under the following email address: privacy@exyte.net.
Please feel free to contact the DPO in case of any questions, complaints, inquiries or suggestions re-garding processing Personal Data at any Exyte entity.
3. Personal Data we process and sources of Personal Data
Please note that in general you are not obligated to provide any Personal Data to us. However, if you do not provide Personal Data to us, we may not be able to process or consider your application or we may miss important information, which could be to your disadvantage.
In general, we only collect personal data directly from you. In this regard, we process all Personal Data you provide to us per communication, in the forms you fill out or documents you load up, such as your CV, motivation letter, certificates and diplomas, photos and others.
In addition we may collect and process information about you which you made public on the internet or on social networks (such as LinkedIn).
Please note that we may also collect other personal data about you, depending on the way you interact with us. For this purpose, we provide specific data protection declarations or additional information.
As part of our employment process, we also ensure that you are not listed on a sanctioned person list. We receive such lists from the institutions, which issue the sanctions.
If you have found us through our website and our career portal and interact with us through our career portal for example, we may use cookies to track your interaction on our website. You will find our data protection information for our website under the following link.
For the purpose of the application, we usually process the following Personal Data about you, however, if you provide additional data, we may also process such additional Personal Data:
- Name, work and contact details as well as address;
- Date of birth and place of birth;
- National Identifier (e.g. ID Card No; Passport No etc.);
- Nationality, citizenship, resident status, work permit;
- Whether you attended military or civil service;
- Your previous employers;
- Your reporting and management relationships, as provided by you;
- Training, education, academic background and certificates;
- Languages you speak;
- Other information on your CV;
- Details about how you intend to work at Exyte (e.g. full time, part time, home office);
- Your career plans;
- Your training and education plans;
- Your past and expected remuneration;
- Expenses (e.g. travel expenses for your travel to an interview);
- Assessment results (in case you attended an assessment, e.g. "OPQ Candidate Assessment Exyte Central Europe/Exyte Europe Holding");
- Photos (including meta data contained in the photo);
- Bank data;
- Gender (m/w/d) and how you wish us to address you;
- Marital status;
- Details you provided to us in relation to our code of conducts (possible conflict of interests, accounts, trade body relationships),
- Whether you are listed on a sanctioned list
- In rare cases: Personality profiles. However, we will inform you separately in such cases;
- In rare cases, if you apply to sensitive areas, we may process your criminal record or financial status. We will discuss this matter with you, before we obtain such information.
Usually, we process the following special categories personal data for the application process:
- Health information (e.g. disabilities);
- Religion;
- Special category of data you provide us in relation to our code of conduct;
Please note that we may not collect all the information above for each application or may require additional information during the application process for specific countries or special positions. We will ask for such information accordingly.
If your application was successful, we will process several of the Personal Data you provided during the application process for implementing our labor relationship. We will provide you with separate data protection information as well.
4. Purpose of processing Personal Data
We process personal data as listed in No 3 of this Information for the following purposes:
- Processing the application for employment including considering other suitable positions for you within the Exyte Group;
- Creating a candidate profile for you and assessing the profile;
- Determining whether you are a matching candidate for the position at Exyte respectively which applicant to choose;
- Creating and maintaining employment records;
- To improve our services and performance;
- To ensure that you are not listed as a sanctioned person;
- To inform you about other suitable positions for you at the Exyte group;
- To contact you to obtain your consent for keeping you in our talent pool for future possible positions for you;
- To investigate or assess breaches of laws or our code of conduct.
- Conducting other processing activities as in order to process your application, evaluation, assessment and initiate or implement an employment relationship;
- Other processing activities as indicated in our communication with you or on forms you fill out;
If your application was successful, we will process several of the Personal Data you provided during the application process for implementing our labor relationship. We will provide you with separate data protection information for the labor relationship.
5. Legal basis
We are processing your Personal Data generally based on the following legal basis:
- General legal basis
We are processing your Personal Data based on Art. 6 Sect I lit b General Data Protection Regulation (“GDPR”; EU Regulation 679/2016), i.e. for pre contractual measures. If you are applying at a German entity in addition, we are processing your Personal Data based on Art 88 Sect I GDPR i.c.w § 26 Sect. I Federal Data Protection Act (Bundes Datenschutz Gesetz,“BDSG”).
Otherwise, we are processing personal data based on our legitimate interests Art 6 Sect I Lit f GDPR, whereas our legitimate interests are to identify the most suitable candidate for a position and to avoid unsuitable or unqualified candidates as well as discrimination of any kind.
- Special category of Personal Data
For special categories of Personal Data for which processing is necessary for the purposes of carrying out the obligations and exercising specific rights in the field of employment and social security and social protection law the legal basis is Art. 9 Sect II lit. b) GDPR in case of a German entity i.c.w. Art. 26 Sect. 3 BDSG.
For other special categories of Personal Data, we process based on your consent according to Art. 9 Sect 2 Lit a) GDPR. We will ask you for your consent when processing such additional special categories of Personal Data. In addition, we may process special categories of Personal Data based on Art 9 Sect 2 Lit f) for the defense from or assertion of legal claims.
6. Consent
In case we are processing your personal data based on your consent, you may revoke your consent at any time, in which case we will stop processing your Personal Data. Processing of Personal Data until your revocation of consent remains legal.
The easiest way to revoke your consent is by specifying in an email, which consent you wish to revoke and send it to TalentAcquisition@exyte.net and identify yourself accordingly.
7.Transfer of Personal Data
We may transfer Personal Data between Exyte affiliates within the Exyte Group.
Generally, Exyte Group entity you apply at will process to Personal Data, however other Group member companies may access your personal data in the frame of the Group organization, especially the Exyte Management GmbH, if required to process your Personal Data for the purposes as listed above.
The Exyte Management GmbH provides most of the technical and personnel support as processor. We may ask you for your permission to transfer and store personal data in the talent pool at the Exyte Management GmbH. However, we will inform you about processing and your consent separately.
We may further transfer your Personal Data to other entities of the Exyte Group in order to consider you for other positions, which your profile might fit for. In addition, we may transfer your Personal Data within the Group, either based on your express consent – e.g. in our talent pool – or based on our legitimate interest (Art. 6 Sect I, Lit f GDPR), whereas it is our legitimate interest to organize our company group efficiently and to find the most suitable candidate for positions within the Exyte Group.
Other Exyte Group Entities or third-party service providers may process your Personal Data as our processors based on our instructions.
All group members are subject to a Data Protection Policy to ensure a constant level of data protection.
Some Exyte Group members may be located outside the European Economic Area (“EEA”) in countries for which the European Commission (“EC”) did not decide that such countries provide an adequate level of data protection.
All Exyte Group members therefore signed a Data Processing and Joint Controller Agreement (“DPJCA”) which includes the standard contractual clauses as approved by the EC to safeguard the processing of Personal Data outside the EEA, i.e. all Exyte Group members are contractually obligated to comply with an adequate data protection level.
Please find a list of all Exyte entities belonging to the Exyte Group under this link.
Beside the transfer within the Exyte Group a transfer of Personal Data to third parties does not take place, with the exception of:
- Transfer with your express permission (Art 6 para. I lit a GDPR or Art 9 para I GDPR);
- Transfers to third parties to which we are legally obliged, for example to the tax office or other governmental authorities (Art. 6 para I c GDPR) or Art. 9 Section 2g GDPR in case of special categories of personal data;
- Transfers to third parties to fulfill our commercial and tax obligations, for example to our tax auditor according to Art. 6 para I c GDPR i.c.w with the respective individual legal obligation, if we are legally obliged to transfer such data or Article 6 para I f GDPR, if the transfer is not mandatory, but required for our legitimate interest to efficiently communicate and proceed with authorities and comply with our obligations;.
- In order to assert legal claims, conduct investigation about legal claims or to defend against legal claims we may transfer data to authorities or to lawyers, agents, experts, authorities etc. based on Art. 6 para I lit f GDPR, whereas it is our legitimate interest to assert or defend from legal claims. In case of special categories of Personal Data we may transfer such data based on Art. 9 para II lit f GDPR to assert or defend against a legal claim.
Please note that a transfer for the above purposes may also be based on another legal basis, where applicable.
Any transfer of data to a third country outside the EU, which is also not a party to the EEA is subject to requirements in compliance with the GDPR.
Please note that in case you are applying for a position at an Exyte Group Member outside the EEA, the Exyte Management GmbH will transfer your application to such entity. The entity as controller is subject to the laws and regulations applicable for the entity you apply at. Thus, in these cases the local data protection laws apply and not the GDPR.
8. Duration of processing
We will process your Personal Data for the time only, which is necessary to complete the purpose.
In case your application was not successful we will usually delete or anonymize your Personal Data from the application after six month upon informing you that your application was not successful or receiving notice from you that you do not intend to proceed with the application, unless you have provided us with your consent to keep your application in our talent pool.
In case we process your personal data to assert or defend from a legal claim, we will process your Personal Data as long as necessary for this purpose.
In some cases or for some personal data, we may have to store your Personal Data longer, e.g. in case of compliance investigations, security logs in our system (usually 1 year) or systematic automated deletion of emails. We may also store your data longer for purposes, such as tax or compliance documentation, e.g. in case we provided you with travel expenses to visit us for an interview as well as if we processed personal data in other occasions, such as visiting our website. On such other occasions we provide you with separate information.
9. No automated decision making
We do not base decisions which produce legal or similar significant affects to you solely on automated decision making, such as automated profiling. Your application profile is assembled by natural persons.
In some cases, we may assemble profiles on scientific basis to assess indications for specific abilities or attributes for an important position. We will discuss this with you separately as the case may be and will expressly indicate such profiling in advance.
10. Your rights
Upon request we will inform you whether Exyte processes any Personal Data about you, and if yes which.
If we process your Personal Data in order to advertise, you have the right to object to the processing of your Personal Data for the purpose of advertising at any time. If you object to the processing for purposes of advertising, your Personal Data will no longer be processed for this purpose.
The easiest method to object to advertisement is to send an email to info@exyte.net. However, we accept any other form of objections to advertisement, which allows us to clearly identify you.
Furthermore, you have the right to object against processing of your Personal Data, based on your particular situation, which is processed based on Article 6 para. I lit. f GDPR, i.e. legitimate interest, or Art 6 para. I lit e GDPR, i.e. processing based on necessity for the performance of a task carried out in the public interest or in the exercise of official authority vested in Exyte including if we use your personal data for profiling for that purpose. In case you object to processing based on the aforementioned legal basis due to your particular situation, we will only proceed processing, if our compelling legitimate grounds to process your data overrides your interest, rights or freedoms to stop processing your Personal Data or for the exercise or defense of legal claims. This also applies to profiling based on the aforementioned.
Under the conditions as set out in the GDPR, according to Art. 16 GDPR you also have the right to correct your incorrect or incomplete Personal Data as well as a right to deletion according to Art. 17 GDPR and a right to restrict the processing of your Personal Data under Art. 18 GDPR.
You also have the right to receive from us Personal Data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format. You have the right to transmit (or have transmitted) the Personal Data to another controller.
If the processing of Personal Data concerning you is based on your consent, you have the right to revoke your consent at any time. The lawfulness of the processing on the basis of the consent until the revocation is not affected.
You also have the right to lodge a complaint with the competent supervisory authority for data protection matters. Unless stated otherwise, the competent authority is the “Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg” in Baden-Württemberg, Germany.
You can always lodge a complaint at the data protection officer or commissioner at the location of the Exyte Group entity you are applying