Source: https://onestepahead.kapsch.net/data-protection
Timestamp: 2019-04-19 20:24:19+00:00

Document:
For its recruiting activities, Kapsch Aktiengesellschaft has implemented the recruiting tool “OneStepAhead” of eRecruiter GmbH, which offers you the opportunity to submit your application for a position at Kapsch Aktiengesellschaft or one of the group companies* of the Kapsch Group via this platform on the website www.kapsch.net and to enter your application information directly via a web interface. Kapsch Aktiengesellschaft is entrusted with central management of the incoming applications and the organization of the application process via this platform for the Kapsch Group. The respective application is then individually processed by the company to which you have applied.
The information below describes how we process your personal data within Kapsch Aktiengesellschaft and the respective company of the Kapsch Group to which you have applied.
The controllers of the processing of your application data are Kapsch Aktiengesellschaft, Am Europlatz 2, 1120 Vienna, E: info@kapsch.net, and the respective group company of the Kapsch Group (all group companies within the EU and the EEA are listed with address under (https://onestepahead.kapsch.net/data-protection-worldwide) if you have applied to one of these companies.
If you have applied to a Kapsch company that is registered outside of the EU or the EEA (these are listed under https://onestepahead.kapsch.net/data-protection-worldwide), please note that a lower level of data protection than in the EU/EEA may exist within countries that are not Member States of the EU and/or the EEA (see here item 1.5.).
In the course of creating an applicant profile, you can enter the following data: Name, address, date of birth, place of birth, nationality, email address, telephone number and an indication of whether you wish to receive emails about appropriate jobs. In addition, there is a free field in the applicant profile where various documents (such as a CV) can be uploaded.
You are free to decide which data you enter in the specified fields of the applicant profile and which documents you upload. It is also solely your responsibility to manage the data and therefore to update and/or delete the data.
Kapsch Aktiengesellschaft will store and host this data in its own IT infrastructure only on your behalf.
To fulfill the request, technical information and protocol data concerning the login to your user account (device, program, browser, IP address, date, time, session ID) will be processed automatically by our IT system.
The temporary storage of the technical information concerning the login is required to guarantee the security and availability of the IT infrastructure and therefore in order to properly fulfill the request, which is why our legitimate interest as defined by Art. 6 para. 1 point f GDPR forms the legal basis for our processing.
The data you enter into the applicant profile after your registration will be saved by us on our server within our IT infrastructure. The data entered in your applicant profile will be processed by Kapsch Aktiengesellschaft exclusively to provide the requested storage and hosting services. Kapsch Aktiengesellschaft will not process this data for any other purpose or in its own interest; in particular, it will not view nor correct the data nor delete it before the retention period expires.
Within the context of the request, we strive to ensure that you can access and manage this data as long as you do not revoke your request to us. Only you can manage the data in the applicant profile and therefore update or delete it, for example.
We collect the technical information and protocol data in order to ensure the functionality and IT security of the applicant platform.
Once you request deletion of your applicant profile, the data uploaded there by you will also be deleted. You also have the opportunity to individually delete or update any data and documents you have uploaded there.
We store the technical information and protocol data for a period of 3 weeks.
The applicant platform is operated by Kapsch Aktiengesellschaft. Kapsch Aktiengesellschaft utilizes eRecruiter GmbH as data processor for IT services, and this company also has access to applicant data under some circumstances in order to provide the IT services.
Specific personal data that Kapsch Aktiengesellschaft requires for the creation of the applicant profile and the further handling of your application, specifically: Title, first and last name, date of birth, address, telephone number, email address, education, desired employment (if not an unsolicited application) and password are required fields.
Nevertheless, your sharing of this data is voluntary; however, if you do not provide this data for fields marked as required, it may not be possible for us to process your application because certain information about your person is necessary to evaluate your suitability for a position.
All other information not designated as required fields can be filled out voluntarily; specifically, these are citizenship, academic title, CV, photo, how you learned about Kapsch, particularly sensitive information (e.g. religious affiliation) and profile data from Xing or LinkedIn. You can also voluntarily upload corresponding documents. Kapsch Aktiengesellschaft and the group company to which you have applied will then use this data for the same purpose as the required information.
Information on the login for your user account and protocol data (device, software, browser, IP address, date, time, session ID) as well as the information on the applicant source is processed automatically.
The legal basis for the processing of the applicant data is Art. 6 para. 1 point b GDPR and therefore concerns processing for the performance of a contract or prior to entering into a contract. By submitting your application, you send to us a corresponding inquiry for processing of your applicant data within the framework of the application, which requires the described data processing.
With regard to the processing of the voluntarily provided (including particularly sensitive) data, we base the processing on your explicit consent according to Art. 6 para. 1 point a in connection with Art. 9 para. 2 point a GDPR, which you gave as part of the online form.
In the case of an unsolicited application, which therefore has no reference to a specifically advertised position, we also process your data only after consent (Art. 6 para. 1 point a GDPR).
The management and organization of the platform are performed by Kapsch Aktiengesellschaft. The further handling of the data in the application process is divided within the Kapsch Group between the respective group company*, to which you have applied, and Kapsch Partner Solutions as service provider in human resources matters.
In the case of an application for a position, the data entered via the platform in your applicant profile is used by Kapsch Aktiengesellschaft exclusively for the purposes of associating the application with the respective group company and forwarding the data to this company. If you upload your data to the applicant profile without applying for a position at the same time, we will organize the saving of the data in the applicant profile for you without any other processing of the data.
If you apply to Kapsch Aktiengesellschaft or another Kapsch company, your applicant data will be processed by the respective company for handling of your application and consideration within the application process as well as for the decision on filling the position to which you have applied.
In the case of an unsolicited application, Kapsch Aktiengesellschaft will store your applicant data in an applicant pool according to your consent for a period of 6 or 24 months and, upon opening of a position, send this data to the respective group company.
After a response to your application on our part, we will in all cases process your data for the duration of the application process. If the application process ends with your hiring at a Kapsch company, with declining of our job offer, with retraction of your application by you or with a rejection on our part, we will store your applicant data according to your consent for 6 or 24 months after the end of the month in which the application process ended for one of the above reasons. After expiration of this period, your data will be irrevocably deleted. The period of six months arises due to the defense against any claims according to the Equal Treatment Act. The period of 24 months arises in the case of your express consent.
If the application process ends in your hiring, we will transfer the relevant applicant data into your personnel file.
If you have granted your consent for the processing of specific data, we will erase your data earlier, if necessary, upon revocation of your consent.
You can revoke your consent at any time with effect for the future without specifying reasons by communicating this wish orally, in writing or electronically to Kapsch Aktiengesellschaft or the respective group company.
As concerns the data managed in your applicant profile, without you having sent us a specific application, we do not retain this data separately. Therefore, once you request the deletion of your applicant profile, the data uploaded there by you will also be deleted. You also have the opportunity to individually delete or update any data and documents you have uploaded there.
Your data is shared by Kapsch Aktiengesellschaft only with the respective group company to which you have applied. Only with your consent is your application also made available to another group company.
As concerns the sharing of your applicant data with a Kapsch company outside of the EU/EEA, please note that risks may arise from the necessary transmission of data. This is the case because no adequacy decision exists with respect to these countries and no specific guarantees can otherwise be provided to compensate for deficits with respect to the level of data protection. No or insufficient statutory regulations and standards for the protection of your personal data exist in these countries. Because the processing of your data is a precontractual measure for the establishment of an employment relationship for which you have applied, the forwarding of your applicant data to this company registered outside of the EU/EEA is justified (Art. 49 para. 1 point a GDPR) since your application could not be properly handled otherwise.
We will therefore share your data with this company only if you have applied to this company in awareness of this lower level of data protection.
The respective group company has tasked Kapsch Partner Solutions GmbH with the provision of personnel services and therefore also with consulting services in regard to recruiting. Kapsch Partner Solutions GmbH therefore uses the applicant data on behalf of and at the instruction of the respective group company that advertised the position or, in the case of an unsolicited application, on behalf of Kapsch Aktiengesellschaft. The location of the data storage and hosting of the data is Vienna.
We save your applicant data (see item 1.1.) in an applicant pool in which Kapsch Aktiengesellschaft can search for suitable applicants if a position opens up within one of the group companies of the Kapsch Group.
The legal basis for the processing is in this case Art. 6 para. 1 point a and point b GDPR and therefore your consent and the handling of your application by us.
If you separately provide consent for your applicant data to remain on file in the applicant pool after your unsuccessful application, the storage of your applicant data is necessary in order to inform you of a suitable job opening arising at a later time in one of the group companies.
Kapsch Aktiengesellschaft will share your applicant data with the respective group company if an appropriate position is found, and you will then be contacted by this company.
We save your data in an applicant pool over a period of 6 or 24 months, according to your consent, unless you revoke your consent at an earlier point in time.
You can revoke this consent at any time with effect for the future without specifying reasons by communicating this wish orally, in writing or electronically to Kapsch Aktiengesellschaft.
With your consent, we share your applicant data with the respective group company* if a position opens up. Otherwise, your data is not shared.
Talent Solutions GmbH, Kölblgasse 2/II, 1030 Vienna, operates a web platform called MyVeeta with the objective of supporting job-seekers and companies before, during and after the recruiting process. With your participation in MyVeeta, you have the opportunity to allow Talent Solutions GmbH to provide your data to us for an application.
We therefore process the following information about you, which Talent Solutions GmbH has shared with us based on your consent, specifically: name, title, address and date of birth, email address and telephone number, CV (including education, work experience, skills, language skills, etc.), advanced training and certifications, military service, professional expectations (desired job, work location, salary expectations, etc.), information about interests and personal activities, photo and Xing or LinkedIn profile. We process the data only if and to the extent that you voluntarily provide it via the online talent pool MyVeeta and insofar as you have consented to its transmission to us.
In addition, Talent Solutions GmbH, the operator of MyVeeta also provides to us the following data in the event of your application: the communication exchange between Talent Solutions GmbH and you (via email, SMS, WhatsApp), a text comment and one or more categorizations (e.g. tags).
We process your data exclusively for the purpose of handling your application, as described in (item 1.3).
You have shared your personal data on a voluntary basis, and you can delete it again at any time. In this case, we will not delete any data whatsoever.
Your data will be shared only with Kapsch Partner Solutions GmbH as the processor contracted to perform human resources services, which requires access to the data for fulfillment of this contract.
The existence of automated decision-making including profiling according to Art. 22 para. 1 and 4 GDPR and – at least in these cases – an informative description of the logic involved and the desired effects of such processing for the data subject.
You have the right to demand information about whether your personal data is transferred to a third country or an international organization. In this regard, you can demand to be informed of the appropriate safeguards according to Art. 46 GDPR in connection with this transfer.
You can demand the rectification or completion of inaccurate or incomplete data. Under certain circumstances, such as if the accuracy of data is disputed, you can demand a restriction of the processing of data until the accuracy has been checked in that this may only be processed with your consent or for establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest.
In exercising this right, you further have the right to have the personal data about you transmitted directly from us to another controller, where technically feasible. The freedoms and rights of other persons may not be adversely affected by this.
You have the right to the erasure of data under certain circumstances, such as when it is not being processed according to the data protection requirements.
The so-called “right to be forgotten” does not apply to you because Kapsch Aktiengesellschaft does not make your personal data public under any circumstances.
If you have asserted your right to rectification, erasure or restriction of processing with respect to Kapsch Aktiengesellschaft, we are obligated to inform all recipients to whom your personal data has been disclosed of this rectification or erasure of the data or restriction of the processing unless this proves to be impossible or involves disproportionate effort.
You have the right, on grounds relating to your particular situation, at any time to object to the processing of personal data concerning you that takes place on the basis of Art. 6 para. 1 point e or f GDPR.
Kapsch Aktiengesellschaft will in this case no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or the processing serves for the establishment, exercise or defense of legal claims.
You have the right to revoke your declaration of consent at any time without specifying reasons. The revocation of consent shall not effect the legality of the processing that took place based on the consent up to the time of revocation.

References: Art. 6
 Art. 6
 Art. 6
 Art. 9
 Art. 6
 Art. 22
 Art. 46
 Art. 6