Source: https://www.stepstone.at/about-us/legal-information/privacy-statement/
Timestamp: 2020-07-08 06:28:50
Document Index: 745434812

Matched Legal Cases: ['Art. 21', 'Art. 20', 'Art. 6', 'Art. 45', 'Art. 46', 'Art. 6', 'Art. 6', '§ 212', 'Art. 6', 'Art. 6', 'Art. 6', 'Art. 6', 'Art. 6', 'Art. 6', 'Art. 45', 'Art. 6', 'Art. 22', 'Art. 21', 'Art. 6', 'Art. 9', 'Art. 21', 'Art. 21', 'Art. 8', 'Art. 9', 'Art. 9', 'Art. 89', 'Art. 6', 'Art. 9', 'Art. 6', 'Art. 78']

We provide you with a short version and a long version of our privacy policy. The short version gives you a quick overview of the essential aspects of data processing. The long version gives you a detailed insight.
Data Protection Policy – Short Version
Fon: +43/1/405 00 68-0
eMail: office@stepstone.at
and by e-mail datenschutz@stepstone.at
3. Purposes and legal basis of processing and duration of storage
the general use of ou platforms and our services, where we process data on the basis of a legitimate interest (pursuit of our business interests) or on the basis of your consent
Processing of information about businesses and their employees, where we process data in the context of a legitimate interest or a contract or due to a legal obligation.
We use data processors. These may therefore receive personal data, as described in detail in the long version of the Privacy Policy. Furthermore, we may also transmit or provide data to third parties within the scope of your consent or a contract with you, as described in particular in the long version, so that these can receive data as described there.
In certain cases, we transfer personal information to countries outside the EU or the EEA (so-called third countries). Essentially, this can be the case if you are applying for a job and the job provider is based in a third country. Furthermore, we use data processors or, within the scope of a legitimate interest, service providers that process data in some cases in third countries. More details can be found in the long version of the privacy policy.
7.Rights of data subjects
You have various rights related to the processing of personal data. You have (depending on the circumstances) the right to request access to the personal data (Article 15 GDPR), to rectification (Article 16 DGVO) or erasure(Article 17 GDPR), to restriction of processing (Article 18 GDPR), a right to object (Art. 21 DSGVO) and a right to data portability (Art. 20 DSGVO). If the processing is based on a consent, you can withdraw it at any time.
Further information can be found in the long version of our privacy policy under „Rights of the data subject„.
If you want to create a job agent or a MyStepStone account or if you would like to use our services as a business customer (you can find more details in the long version of the privacy policy), you have to provide certain data within the scope of the contract to be concluded. We will specify such data. In any other context, the provision of personal data is neither required by law nor by contract, nor are you required to provide personal information. However, the provision of personal data for the use of our services may also be partially required within the services we provide. In other words, if you do not provide us with the information we specify to be necessary, we may not be able to provide you with the full scope of services.
9. Modification of the privacy policy; change of purpose
We reserve the right to change th privacy policy in accordance with the data protection regulations. The current version can be found here at this point or another place on our website or app that can easily be found. If we intend to process your data for other purposes than those for which it was collected, we will inform you in advance in accordance with the law.
Data Protection Policy – Long Version
StepStone Österreich GmbH,
By email: datenschutz@stepstone.at
3.1. Data processing in the context of a general use of our Platforms and services
3.1.1. General access to our Platforms
3.1.2. Optimization of search and recommendation functions
3.1.3. Application form
3.1.4. Newsletter
You may object to all types of StepStone newsletters at any time without incurring any costs .
3.1.5. StepStone webinars
We offer webinars on our websites, these are seminars that are conducted online about our products and services and other topics about recruiting and job search. When you register for a StepStone webinar, we collect certain information to enable you to participate in the webinar. The legal basis here is your consent in accordance with Art. 6 (1) sentence 1 a GDPR. We will store the data for this purpose until the webinar has taken place. Furthermore we will use the information you have provided to us to provide you with marketing as described in section 3.1.4, which is included herein by reference. Some of these webinars are held, if these are directed at businesses, together with StepStone Deutschland GmbH, Völklinger Str. 1, 40219 Düsseldorf, which is an affiliated company with us. In this case StepStone Deutschland and we are joint controller under data protection laws. In this context we provide the electronic infrastructure to conduct the webinar. The exact content, time and date, and which of our employees shall present the webinar will be defined jointly by the parties on a case by case basis. The use of the personal data for the conduct of a webinar will be done jointly, while the use for marketing purposes will be done individually and separately from each other. In the latter case we will be provide with the personal data by StepStone Deutschland GmbH which will then use the data accordingly, if an Austrian address was provided. Further details about the processing of personal data at StepStone Deutschland GmbH can be found in the privacy policy of StepStone Deutschland GmbH at https://www.stepstone.de/ueber-stepstone/rechtliche-hinweise/data-protection-policy/#Webinars.
We use LogMeIn, Inc., 333 Summer Street, Boston, MA 02210 USA to collect the registration data and provide the webinar as a data processor, and this party will be a recipient of your personal data in this context. Data will be transferred to the USA, i.e. into a country outside of the EU or the EEA. The transfer is permitted under Art. 45 GDPR as LogMeIn, Inc., is Privacy Shield certified and thus an adequate level of protection exists according to the Implementing Decision of the Commission (EU) 2016/1250 (http://eur-lex.europa.eu/legal-content/DE/TXT/HTML/?uri=CELEX:32016D1250&from=DE). The Privacy Shield notice can be accessed at https://www.logmeininc.com/de/legal/privacy-shield. Additionally, we have entered into the standard contractual clauses which are available at https://logmeincdn.azureedge.net/legal/20170201/DP/LMIDataProcessingAddendum2017.v1SAMPLE.pdf as a sample, so that a transfer is also permitted under Art. 46 (2) (c) GDPR.
3.1.6. Objections to marketing
3.1.7. Contact form and e-mail contact
3.1.8. StepStone surveys
3.1.9. StepStone salary planer
3.1.10. Use of data processors for hosting and securing our platforms, administrative, troubleshooting, and support services
Administrative, troubleshooting, and support services
We use StepStone Deutschland GmbH, Völklinger Str. 1, 40219 Düsseldorf and StepStone Services sp. z o.o., ul. Domaniewska 50, 02-672 Warsaw, Poland, for administrative, troubleshooting, and support services, and which may consequently also have access to your personal data. Generally StepStone Services sp. z o.o should not store any personal data. This will only be done in exceptional cases, e.g. if needed to rectify technical issues. In such cases personal data will only be stored to the extent and for the duration that is necessary.
Sending of e-mails and other messages
Proxy caching and web application firewall
3.2. Data processing if you register for a Job Agent or a MyStepStone account
StepStone offers a variety of services for your career development. StepStone aims to support you at all stages of your professional life. In particular, you can subscribe to a Job Agent and can create a MyStepStone account in which we process personal data. In this section 4 we inform you about the purpose, the respective legal basis as well as the storage duration of these processing operations.
3.2.1. Job Agent
3.2.2. MyStepStone account
Second we offer you the opportunity to enter into a contract for a MyStepStone account, where you can use additional functions and correspondingly define the scope of the contractual use. The purposes of the data processing under this contract are that
You can use additional functionalities of a JobAgent (see 2.1)
3.2.3. Facebook Connect
3.3. Data processing about businesses and their employees
3.3.1. Data processing for contract management and pre-contractual purposes
We process personal data for the purpose of contract management, that is, so that we can provide our customers with the contractual services and also for associated pre-contractual purposes. If the customer is a natural person, the legal basis is that the processing is required for the performance of a contract or for the performance of pre-contractual measures pursuant to Art. 6 (1) sentence 1 b GDPR. If we process personal data of employees of the customer, the legal basis is a legitimate interest pursuant to Art. 6 (1) sentence 1 f GDPR. The legitimate interest lies in the conduct of our business and that of the customer. There is no conflicting interest of the data subject because, from the point of view of our customer, the processing is necessary in the context of the existing employment relationship with the data subject or under legitimate interest. We store personal data for this purpose for the term of the contract.
Furthermore we store accounting records and business correspondence, i.e. every message that is used to prepare, execute or to revoke a business transaction in order to comply with statutory retention periods under § 212 UGB for the duration of seven years, whereby the term begins at the end of the calendar year in which the correspondence was sent or received or the accounting record came into existence. Legal basis for this purpose is Art. 6 Abs. 1 lit. c GDPR.
3.3.2. Customer services
3.3.3. StepStone Recruiter Space
If the customer is a natural person, the legal basis is that the processing is required for the performance of a contract or for the performance of pre-contractual measures pursuant to Art. 6 (1) sentence 1 b GDPR. If we process personal data of the customer’s employees, the legal basis is a legitimate interest pursuant to Art. 6 (1) sentence 1 f GDPR. The legitimate interest lies in the conduct of our business and that of the customer. There is no conflicting interest of the data subject because, from the point of view of our customer, the data processing is necessary in the context of the existing employment relationship with the data subject or under legitimate interest. Personal data will be stored for this purpose for the term of the contract for the use of the StepStone Recruiter Space.
3.3.4. Data processing when publishing advertisement products
If our customers publish advertising products or company portraits on our Platform, we process personal data of the customer where the customer is a natural person. If our customer specifies an employee’s contact data in an advertisement product, we process this employee’s personal data to provide the relevant data to our users as part of the advertisement on our Platform and to ensure that the advertisement can be found via the search functionality on our Platforms. To increase the reach of the advertisement by submitting it to our co-operation partners, we may, in whole or in part, submit the advertisement content to our co-operation partners who provide the advertisement or a preview on their web site. If the customer is a natural person, the legal basis is that the processing is necessary for the performance of a contract pursuant to Art. 6 (1) sentence 1 b GDPR. If the advertisement contains contact details of employees of the customer, the legal basis is a legitimate interest pursuant to Art. 6 (1) sentence 1 f GDPR. The legitimate interest lies in the conduct of our business and that of the customer. There is no conflicting interest of the data subject because, from the point of view of our customer, the processing is necessary in the context of the existing employment relationship with the data subject or under legitimate interest. We will store the data for this purpose for the contractual term during which the job advertisement is available on our Platforms.
3.3.5. Online ordering
3.3.6. Data processing for general marketing purposes
3.3.7. StepStone webinars
Reference is made to section 3.1.5 above.
4.2. Cookies and technologies that we use via third party providers
Security analysis techniques from Akamai
On our websites we use services provided by ADITION technologies AG, Oststraße 55, 40211 Dusseldorf, who acts as data processor. ADITION uses cookies to control and optimize the display of advertising material that we display for the user. This concerns, for example, the maximum display frequency of advertising material that a user sees. In addition, ADITION occasionally uses stored cookie information for statistical surveys. By setting cookies, ADITION does not store personal data such as name, e-mail address or other personal information. All information is purely anonymous and contains technical information such as the frequency of advertising and the date of the advertisement, the browser used or the operating system installed. A storage of personal data does not take place. ADITION works strictly in accordance with German data protection law in all processes of data collection. All stored data is stored on servers in the Federal Republic of Germany. In addition, ADITION meets all P3P requirements (Privacy Preferences Project). For information on ADITION’s privacy policy, please visit www.adition.com/contact/data-protection/. Clicking on the following link will stop the collection of anonymous data: www.adition.com/contact/data-protection/?optout=trueAdTraxx.
The legal basis for the use of Adition is a legitimate interest under Art. 6 para. 1 sentence 1 f GDPR. Our legitimate interest is the user-friendly design of our services.
Our websites use ScorecardResearch Beacon, a service by Full Circle Studies, Inc., 11950 Democracy Drive, Reston, VA 20190, USA. Among other things, ScorecardResearch Beacon uses cookies that are saved on your computer and enable an analysis of your use of the website. During use, data such as in particular the IP address and users’ activities may be transmitted to a server of Full Circle Studies, Inc. and stored there in anonymous form, personal data is not stored. Full Circle Studies, Inc. may transfer this information to third parties to the extent that this is prescribed by law or where third parties process the data. You may prevent the collection and forwarding of personal data (in particular your IP address) and the processing of the data by deactivating JavaScript in your browser or installing a tool such as NoScript (www.noscript.net). You can find further information on data protection when using ScorecardResearch Beacon under the following link: http://www.fullcirclestudies.com/privacy.aspx. You can access an opt-out option under the following link: http://www.scorecardresearch.com/optout.aspx.
You IP address is transferred to the USA and thus to a country outside the EU and the EEA. This is permissible under Art. 45 GDPR because Full Circle Studies, Inc.is Privacy Shield certified and thus an adequate level of protection exists according to the Implementing Decision of the Commission (EU) 2016/1250 (http://eur-lex.europa.eu/legal-content/DE/TXT/HTML/?uri=CELEX:32016D1250&from=DE). The certification can be viewed at https://www.privacyshield.gov/participant?id=a2zt0000000PC0qAAG&contact=true.
On our websites the SalesViewer® technology from SalesViewer® GmbH, Nikolaistr. 2 44866 Bochum is used to collect and store data for marketing, market research and optimization purposes in the course of data processing.A javascript-based code is used to collect business-related data and use. The data collected with this technology is encrypted via a one-way hashing. The data is immediately pseudonymised and not used to personally identify the visitor to this website.
Data collection and storage can be objected to at any time with effect for the future, by clicking on this link HERE, in order to prevent the collection by SalesViewer® within this website in the future. An opt-out cookie for this website is then stored on your device. If you delete your cookies in this browser, you must click this link again.
SalesViewer ® uses the subcontractor Hetzer Online GmbH, Industriestr. 25, 91710, Gunzenhausen for server hosting (Infrastructure SalesViewer®) and Host Europe GmbH, Welserstraße 14, 51149 Cologne for the provision of the DNS server for SalesViewer®.The legal basis is a legitimate interest under Art. 6 (1) sentence 1 f GDPR, namely pursuance of our business purposes for the demand-driven structuring of our offerings. No conflicting interest is apparent, especially because you may opt out at any time and no personal data is stored.
the recipient or categories of recipient to whom the personal data concerning you has been or will be disclosed;
the envisaged period for which the personal data concerning you will be stored or, if no concrete information about this is possible, criteria used to determine that period;
the existence of a right to rectification or erasure of the personal data concerning you, a right restrict the processing of the data by the controller or a right to object to this processing;
any available information about the origin of the data if the personal data was not collected from the data subject;
the existence automated decision-making including profiling in accordance with Art. 22 (1) and (4) GDPR and – at least in these cases – meaningful information about the logic involved and the scope and the intended effects of such processing for the data subject.
The right to receive the copy must not affect the rights and freedoms of others.
if you contest the accuracy of the personal data relating for you for a that enables us to review the accuracy of the personal data;
the processing is unlawful and you oppose the erasure of the personal data and instead request a restriction of the use of the personal data;
we no longer require the personal data for the purposes of the processing, but you need it to establish, exercise, or defend legal claims, or
if you have objected to the processing in accordance with Art. 21 (1) GDPR and it has not yet been verified whether our legitimate reasons override yours.
You withdraw your consent upon which the processing was based pursuant to Art. 6 (1) (a) or Art. 9 (2) (a) GDPR, and no other legal ground for the processing applies.
You object to the processing in accordance with Art. 21 (1) GDPR and no overriding legitimate grounds for the processing apply, or you raise an objection to the processing under Art. 21 (2) GDPR.
The erasure of the personal data concerning you is required in order to comply with a legal obligation under EU law or the law of the Member States to which we are subject.
The personal data concerning you is collected in the context of information society services pursuant to Art. 8 (1 )
for the exercise of the right to the freedom of expression and information;
to satisfy a legal obligation that requires the data to be processed under the law of the EU or the Member States to which the data controller is subject, or to perform a task that is carried out in the public interest or in the exercise of official authority vested in the data controller;
on grounds of the public interest in the area of public health in accordance with Art. 9 (2) (h) and (i) as well as Art. 9 (3) GDPR;
for archiving purposes in the public interest, academic or historical research purposes or statistical purposes pursuant to Art. 89 (1) GDPR, provided the right specified under section a) is likely to render impossible or seriously impair the achievements of the objectives of this processing or
the data processing is based on consent under Art. 6 (1) (a) GDPR or Art. 9 (2) (a) GDPR or on a contract pursuant to Art. 6 (1) (b) GDPR and
the processing is being performed using automated means.
7.7. Right to withdraw the declaration of consent under data-processing law
7.9. Right to lodge a complaint with a supervisory authority
The supervisory body to which the complaint was submitted will notify the complainant of the status and outcomes of the complaint including the option of a judicial remedy under Art. 78 GDPR. Responsible supervisory authority for us is the state commissioner for data protection North Rhine-Westphalia, https://www.ldi.nrw.de/
7.10. Is there an obligation to provide personal information?
7.11. Amendment of the data protection policy; amendment of purpose
[Version 1; Date 19.04.2018]