Privacy Policy

Status: 15.05.2024

Information regarding the collection of personal data from applicants within Trenkwalder Personaldienste GmbH (Art. 13, Art. 14 GDPR)

This Data Protection Policy provides a framework for the processing of personal data by Trenkwalder Personaldienste GmbH in accordance with the provisions of the General Data Protection Regulation of the European Union (GDPR) and the Data Protection Act (DSG).

1. Contact details of the data protection officer

You are welcome to address any questions regarding the processing of your personal data within Trenkwalder Personaldienste GmbH to the Data Protection Officer:

Trenkwalder Personaldienste GmbH

Data Protection Officer

Rennweg 97-99, Kern 8/6th floor

1030 Vienna

Please use the following e-mail address for your data subject requests in accordance with the GDPR: datenschutzAT@trenkwalder.com

2. Which categories of data do we use and where do they come from?

The categories of personal data processed include in particular

·        Your basic data (such as first name, surname, name affixes)

·        Contact data (e.g. your private address, e-mail address, (mobile) telephone number)

·        This may also include special categories of personal data such as health data, if you include this in your CV

·        Professional career and educational background; list of projects

·        Language skills and other job-related skills

·        Social security number, national identification number or other identification number issued by the authorities

·        Date of birth

·        Gender

·        Bank account information

·        Nationality and work permit status

·        Benefits information

·        Tax information

·        Information from references and

·        Information in your resume or application, information you provide about your professional interests, and other information about your qualifications

and insofar as required by law or explicit consent has been given:

·        Disability and health-related information

·        Results of drug tests, criminal and other background checks. In addition, the following data may be collected and processed:

·        Username and password when you register on our websites

·        Information that you provide to us about friends or other persons in connection with your request that we contact them. (the data controller assumes that the other person has previously given consent for this transmission)

·        Other information that you provide to us, e.g. in surveys or via the "Contact" function on our pages.

If an employment or service contract is concluded with you, we will collect, process and store personal data that you have provided to us as an employee or independent consultant or that arises during your employment or service relationship, insofar as this is necessary to fulfill our contractual and/or legal obligations, in accordance with the provisions of the GDPR. Your personal data is generally collected directly from you as part of the application process.

In certain constellations, your personal data is also collected from other sources (in particular authorities) due to legal regulations. In addition, we may have received data from third parties (e.g. recruitment agencies).

If we do not collect your personal data directly from you in individual cases, we will inform you in advance. Data may also be processed electronically. This is particularly the case if an applicant submits corresponding application documents to us electronically, for example by e-mail or via a web form on the website.

3. Legal basis and purpose of data processing

We process, collect and store personal data for the following purposes in particular:

a. To provide you with job offers and projects and to offer you work;

b. to provide you with additional services such as training and further education measures, professional advice and support in professional reorientation

c. to determine your suitability as an applicant or freelancer and your job-related skills

d. to perform data analytics, such as (i) analyzing our database of applicants and employees; (ii) assessing individual performance and skills, including job-related skills assessment; (iii) identifying skill shortages; (iv) using information to highlight potential opportunities to individuals; and (v) analyzing pipeline trends in hiring practices;

e. to provide you with information about potential available positions;

f. to provide information about special events, promotions, programs, offers, surveys, contests and market research;

g. to respond to individual inquiries;

h. to operate, evaluate and improve our business (including developing, enhancing, analyzing and improving our services; managing our communications; performing data analysis; performing accounting, auditing and other internal functions)

i. to protect against fraud and other unlawful acts, claims and other liabilities; and

j. to comply with and enforce applicable legal requirements, relevant industry standards, contractual obligations and our policies.

We process your personal data in compliance with the provisions of the EU General Data Protection Regulation (GDPR), the Data Protection Act (DSG) and all other relevant laws (e.g. ArbVG, BeinstG, GlBG, etc.).

The primary purpose of data collection and processing is to handle the application process. The primary legal basis for this is Art. 6 para. 1 lit. b GDPR.

As part of your application - whether online via our portals, via e-mail or in person at the office - we obtain consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR for the processing of your data. Please refer to the following section.

Where necessary, we also process your data on the basis of Art. 6 para. 1 sentence 1 lit. f GDPR in order to protect our legitimate interests or those of third parties (e.g. authorities). This applies in particular to the investigation of criminal offenses or within the Group for the purposes of Group management, internal communication and other internal administrative purposes (so-called small group privilege).

Furthermore, in individual cases we are obliged under the European anti-terrorism regulations 2580/2001 and 881/2002 to check your data against the so-called "EU terror lists" in order to ensure that no funds or other economic resources are made available for terrorist purposes.

Should we wish to process your personal data for a purpose not mentioned above, we will inform you in advance.

4. Consent

As described above, as part of your application - whether online via our portals, via email or in person at the office - we will obtain consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR for the processing of your data. The text of the consent reads:

"I consent to the processing, storage and transfer of my personal data, including the special categories of personal data provided by me in accordance with Art. 9 GDPR (e.g. information on my marital status or health data) by the Trenkwalder Group and its subsidiaries and affiliated companies mentioned above for the purpose of providing temporary, fixed-term or permanent job and employment opportunities, for the purpose of sending out job advertisements about vacancies and for the purpose of evaluating (including by automated means) profiles and professional skills to assess individual development and career plans. My data will be stored for a period of thirty-six months and then deleted, unless I again expressly agree to further storage. If absolutely necessary in individual cases, I also consent to the transfer of my personal data outside the European Union and/or within the subsidiaries and affiliated companies of the Trenkwalder Group. I can refuse my consent without giving reasons and revoke my consent at any time for the future. The revocation does not affect the legality of the processing carried out up to that point. Further information can be found in the privacy policy on the homepage."

You can revoke this consent at any time without giving reasons in text form by sending an e-mail to datenschutzAT@trenkwalder.com.

Please note that we will no longer be able to consider your application after you have withdrawn your consent.

5. Data access

We will only share personal data that we have collected about you in accordance with this Privacy Policy and generally applicable data protection requirements.

We will disclose your information on a case-by-case basis: (i) to subsidiaries and affiliates; (ii) if you are a candidate or freelancer, to clients who have vacancies or projects or who are interested in placing our candidates or freelancers; and (iii) to other persons, such as recruitment consultants and subcontractors, with whom we work to find you a job or project.

In addition, we may disclose your personal information (i) if we are required to do so by law or legal process; (ii) to law enforcement or other government officials pursuant to a lawful disclosure request; and (iii) if we believe disclosure is necessary or appropriate to prevent physical harm or financial loss, or in connection with an investigation of suspected or actual fraudulent or illegal activity. We also reserve the right to transfer any personal data we hold about you if we sell or transfer all or part of our business or assets (including in the event of a reorganization, dissolution or liquidation).

In addition, we sometimes use different service providers to fulfill our contractual and legal obligations. If necessary, you can request a list of the contractors and service providers we use with whom we have more than a temporary business relationship.

6. Rights of data subjects

As a data subject, you can assert the following rights in accordance with Art. 15 - Art. 22 GDPR:

a) The right of access: data subjects have the right to request information about the personal data concerning them that we process in order to check whether their personal data is being processed in accordance with the law.

b) The right to rectification: Data subjects have the right to request the rectification of inaccurate or incomplete data stored about them in order to protect the accuracy of this information and to adapt it to the data processing.

c) The right to erasure: Data subjects have the right to request that the data controller erases information about them and no longer processes this data.

d) The right to restriction of processing: Data subjects have the right to request that the data controller restricts the processing of their data.

e) The right to data portability: Data subjects have the right to request data portability, which means that the data subject can receive the personal data originally provided in a structured and commonly used format or that the data subject can request the transfer of the data to another data controller.

f) The right to object: Data subjects who provide personal data to a data controller have the right to object to data processing at any time for a number of reasons as set out in the General Data Protection Regulation, without having to justify the decision.

g) The right not to be subject to automated individual decision-making: Data subjects have the right not to be subject to a decision based solely on automated processing, including profiling, where such profiling produces legal effects concerning the data subjects or similarly significantly affects them.

h) The right to lodge a complaint with a supervisory authority: Data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work or place of the alleged infringement if the data subjects consider that the processing of their personal data infringes the GDPR.

If the processing is based on consent in accordance with Art. 7 GDPR, data subjects can withdraw their consent at any time.

If you require further information about the processing of your personal data or wish to assert your rights as a data subject, please contact datenschutzAT@trenkwalder.com.

7. Storage of your data

We process and store your personal data as long as this is necessary for the fulfillment of our contractual and legal obligations. With regard to the storage of applicant data, the following also applies:

·        If we or a customer conclude an employment contract with an applicant, the transmitted data will be stored for the purpose of processing the employment relationship in compliance with the statutory provisions.

·        If no employment contract is concluded with the applicant or if the applicant is not placed, the application documents will be automatically deleted no later than thirty-six months after notification of the rejection decision, unless deletion conflicts with any other legitimate interests of the controller. Other legitimate interest in this sense is, for example, a burden of proof in proceedings under the Equal Treatment Act (GlBG).

·        In order to be able to submit further job or project offers suitable for the applicant's qualifications and skills even after the end of the first application phase, in which the applicant could not be placed, the applicant's consent to longer storage is obtained. After completion of the first application phase and in the event of a suitable offer, we will of course contact you beforehand and obtain your consent. If consent is given for longer storage, the data will not be deleted until this period has expired, unless the applicant gives us renewed consent for further storage. You can revoke your consent at any time for the future without giving reasons.

8. Data transmission

The GDPR guarantees the same high level of data protection within the European Union. When selecting our service providers, we therefore rely on European partners wherever possible if your personal data is to be processed. Only in exceptional cases will we have data processed outside the European Union as part of the use of third-party services. We will only allow your data to be processed in a third country if the special requirements of Art. 44 et seq. GDPR are fulfilled. This means that your data may then only be processed on the basis of special guarantees, such as the EU Commission's officially recognized determination of a level of data protection corresponding to the EU or compliance with officially recognized special contractual obligations, the so-called "standard data protection clauses"

9. Obligation to provide data

As part of the application process, you must provide the personal data that is required to establish the employment relationship or that we are legally obliged to collect. In individual cases, the applicant is legally obliged to provide certain data (e.g. health certificate, criminal record certificate, etc.). Without this data, we or our clients, for whom the placement is carried out, will not be able to execute the employment contract with you.

10. Automated decision-making

Automated decision-making, including profiling, does not take place.

11. Online application procedure

11.1 General information/voluntary nature

In addition to face-to-face interviews in the offices, we also offer our applicants the opportunity to conduct an interview online. We use the Microsoft solutions Skype, Teams, Zoom or WhatsApp for this purpose.

Participation in the online interviews is voluntary. You have the option to cancel an interview at any time, refuse further interviews and withdraw your consent to participate in the online interview without incurring any disadvantages. The online interviews are not recorded or saved.

It is expressly pointed out that Trenkwalder Personaldienste GmbH offers you the option of conducting the interview in the form of a personal interview on site or by telephone. Should you decide in favor of a personal interview on site or a telephone interview, this will have no negative impact on your application.

The interview will only be conducted by persons who are responsible for filling vacancies within Trenkwalder Personaldienste GmbH. These persons ensure that the confidentiality of your personal data is maintained within the scope of the intended purpose. It is important to the company to guarantee the highest possible protection of your personal data. All personal data collected and processed by us as part of an application is protected against unauthorized access and manipulation by technical and organizational measures.

11.2 Processed data/ legal basis/ revocation

The categories of personal data processed as part of the team interview include Name, transmission of the image (and thus the transmission of your person), transmission of your voice. The online interview is not recorded and/or stored.

Furthermore, the following personal data is collected by the system when using Microsoft Teams / Skype: IP addresses, e-mail addresses, names, log files, protocol data, metadata (e.g. IP address, time of participation, etc.), profile data (e.g. your user name, if you provide this of your own accord).

Data processing in the context of the Teams interview is based on the consent you have given, which can be revoked at any time for the future, Art. 6 para. 1 sentence 1 lit. a GDPR.

You have the option at any time to cancel an interview, refuse further interviews and withdraw your consent to participate in the Team or Zoom interview without incurring any disadvantages. You can submit your withdrawal by e-mail.

We also process the data collected by the system on the basis of a legitimate interest in accordance with Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interest in data processing is: conducting online interviews.

11.3 Data transmission

We use Teams to conduct the online interviews. Microsoft Teams is part of Microsoft Office 365. Microsoft Teams is a productivity, collaboration and exchange platform for individual users, teams, communities and networks that is used across companies. Among other things, it includes a video conferencing function.

Microsoft Office365 is a software of the company

Microsoft Ireland Operations Limited

One Microsoft Place

South County Business Park

Leopardstown

Dublin 18

D18 P521

Ireland

Microsoft Teams is part of the cloud application Office 365, for which a user account must be created.

Data processing with Office 365 takes place on servers in data centers in the European Union in Ireland and the Netherlands.  For this purpose, we have concluded an order processing agreement with Microsoft in accordance with Art. 28 GDPR. Accordingly, we have agreed extensive technical and organizational measures with Microsoft for Office 365 that correspond to the current state of the art in IT security, e.g. with regard to access authorization and end-to-end encryption concepts for data lines, databases and servers.

In the event of access by Microsoft from outside the European Union in individual cases approved by us, Microsoft participates in the EU-US Data Privacy Framework (DPF). In order to guarantee an appropriate level of data protection when transferring personal data to a third country such as the USA in this specific case, we have implemented additional measures as described above in the form of state of the art technical and organizational measures such as access authorization and encryption concepts for data lines, databases and servers.

Microsoft reserves the right to process customer data for its own legitimate business purposes. We have no control over this data processing by Microsoft. To the extent that Microsoft Teams processes personal data in connection with its legitimate business purposes, Microsoft is an independent controller for these data processing activities and as such is responsible for compliance with all applicable data protection laws. If you require information about the processing by Microsoft, please refer to the relevant Microsoft statement.

14. Application via WhatsApp (PitchYou)

If you use our application-per-WhatsApp function, the legal basis for the communication is your consent, which can be revoked at any time (Art. 6 para. 1 a GDPR). The application-per-WhatsApp function is provided to us by the IT service provider PitchYou GmbH in Germany (Campusallee 9, D-51379 Leverkusen), which can access your data for this purpose as a processor. An order processing contract has been concluded with PitchYou in accordance with Art. 28 GDPR.

PitchYou provides for a multi-stage deletion concept in order to protect the rights of the data subject. However, we would like to point out that we have no influence on data processing by WhatsApp. Processing is subject to WhatsApp's privacy policy, which you must agree to in advance. We would like to point out that the information you provide will be stored and processed in the USA. WhatsApp LLC participates in the EU-US Data Privacy Framework (DPF).

The legal basis for the processing is the voluntary consent given within the meaning of Art. 6 para. 1 sentence 1 lit. a GDPR to carry out the application process.

You can revoke the consent expressly given above at any time with effect for the future by sending us a message via WhatsApp. The legality of the processing carried out on the basis of the consent until the revocation is not affected by the revocation.

Information on data protection at WhatsApp:

https://www.whatsapp.com/legal/privacy-policy-eea

Further information on data protection at PitchYou can be found at: https://www.pitchyou.de/datenschutz and https://www.pitchyou.de/pitchyou-dsgvo

Information on consent to the use of WhatsApp can be found at: https://www.pitchyou.de/datenschutz-whatsapp

15. MessengerPeople

We use a tool from MessengerPeople GmbH to communicate with you via a messenger service (WhatsApp). Communication only takes place if the person applying to us sends a corresponding start message and is voluntary. By sending a start message, you agree to the validity of our data protection provisions. In particular, you consent to your personal data (surname and first name, telephone number, messenger ID, IP address, profile picture and message history) being stored, processed and used as part of the use of the respective messenger service (WhatsApp) in order to send messages to you.

We use MessengerPeople GmbH, Seidlstraße 8, 80335 Munich, Germany, as a technical service provider and processor to provide this communication service. Further information can be found in the respective privacy policies of the messenger service (WhatsApp, www.whatsapp.com/legal/privacy-policy-eea) and MessengerPeople GmbH

(https://www.messengerpeople.com/de/datenschutzerklaerung/).

The legal basis for the processing is the voluntary consent given within the meaning of Art. 6 para. 1 sentence 1 lit. a GDPR for carrying out the application process. Communication and document exchange via WhatsApp is always voluntary and is only one possible option. It is always possible to communicate via other communication channels (e.g. email). Consent can be revoked at any time with effect for the future directly via the respective WhatsApp chat.

Information on data protection when using MessengerPeople and WhatsApp

https://www.messengerpeople.com/de/whatsapp-datenschutz-alles-was-du-wissen-musst/

You can find MessengerPeople's privacy policy at: https://www.messengerpeople.com/de/datenschutzerklaerung/