Data protection information - Supplemental information for applicants

The General data protection information is intended to provide you with an overview of how we process your personal data and the rights you have under data protection law. What data in particular are processed in the context of the “application process, especially via the application portal” and in what manner they are used is specified additionally, more concretely and as a supplement to the general information by the following points. Moreover, when using the application portal, the data protection information “Supplemental information for online presence (website)” is also of relevance for you.

Data controller and contact data

See the general data protection information.

What sources and data do we use?

We process personal data which enable us to make a qualified selection based on the vocational/professional suitability of applicants. In detail, these include particulars concerning academic and/or professional qualifications, curriculum vitae, certificates and work references.

We will not request that you disclose special categories of personal data to us on the job page (such as data concerning race or ethnic origin, political opinions, religious or philosophical convictions, union membership, health or sex life). However, in the event that you provide us with such information without being requested to do so thus doing so of your own free will, you thereby actively consent to this information being processed and used for the purposes of K industries (in the following referred to as K industries for short) inasmuch as such a use is not prohibited by law. The withdrawal of consent has an effect for the future only and does not affect the legality of the data processing which took place up to the time of the withdrawal.

To enable us to recognize repeat applicants, we can store the “date of birth, first and last name, email address, username and calendar date of the application as well as the internal reasons for the conclusion of the previous application process”.

As a rule and via the application portal, we collect data directly from the data subject. In the case of referral via a personnel agency, the collection of data takes place only inasmuch as the applicant has consented to the transfer.

Why do we process your data (purpose of processing) and on what legal grounds?

We process personal data in compliance with the provisions of the EU General Data Protection Regulation (GDPR) in addition to the Austrian Data Protection Act and the German Federal Data Protection Act (BDSG):

a. For the fulfilment of contractual obligations (Art. 6(1) point (b) GDPR):

The processing of your personal data takes place in our IT systems for the evaluation of the qualification and suitability of the applicant. In the mandatory fields marked with *, we collect only such particulars as are organizationally indispensable for the specific application process. Additional application information can be entered in the remaining text fields as the applicant sees fit (and as is customary for application processes in the industry) and of the applicant’s own free will. The (pre-) selection of applicants can be based on any of the data provided in this context provided that such use is not prohibited by law. If additional data or certificates should prove necessary in the application process due to the context, we can request these data from the applicant concerned.

In the event of a successful application, the permissible, relevant data will continue to be used based on your employment relationship (see the separate data protection information for employees).

b. In the context of legitimate interests (Art. 6(1) point (f) GDPR):

To the extent necessary, we process your data beyond the actual fulfilment of the contract in order to safeguard our legitimate interests or those of third parties.

In particular:

Exercise of legal claims and defence in the case of legal disputes,
recognition of repeated applications of the same person to prevent misuse and for efficient processing,
the keeping of anonymised applicant statistics,
safeguarding of information security and the company’s business operations,
the prevention and investigation of criminal acts.

c. Based on your consent (Art. 6(1) point (a) GDPR):

You can consent to having your application data stored in the K industries application database beyond the purpose of the immediate application process so that they may be used for future job vacancies. This consent is completely independent of your individual application and does not affect your chances in the application process.

Consent that has been granted can be withdrawn at any time.This also applies for the withdrawal of declarations of consent which were granted to us before the GDPR went into effect. The withdrawal of consent has an effect for the future only and does not affect the legality of the data processing which took place up to the time of the withdrawal.

d. Based on legal obligations (Art. 6(1) point (c) GDPR) or in the public interest (Art. 6(1) point (e) GDPR):

No special processing is planned in this context.

Who gets my data?

Once you have applied for a specific position, only the personnel departments within the group and the department that placed the advertisement obtain access to your data. If you have applied on your own initiative, your particulars will be made accessible to those departments in which current vacant positions clearly correspond to your applicant profile.

It is also possible that service providers we engage in the context of order-processing circumstances and vicarious agents could process data for these purposes provided that they comply with the data protection regulations. These include especially our email service provider, Microsoft.

Further data recipients can be those offices for which you have granted us consent for the transfer of data or to which we are entitled to transfer personal data based on a legitimate interest.

Are data transferred to a third country or to an international organization?

The transfer of data to offices in countries outside of the European Union (referred to as third countries) takes place inasmuch as you have granted us your consent.

In the event that this should be required in individual cases, your personal data are transferred in compliance with the European level of data protection.

Furthermore, a transfer to offices in third countries is envisioned in the following cases:

The group uses Office 365 Cloud Services by Microsoft for its communication and collaboration services. The storage (data at rest) of personal data, e.g. in emails, Sharepoint, etc. takes place as a matter of principle within the European Union, whereby for support purposes (Azure Active Directory) and maintenance services, data can be transferred to other Microsoft locations outside of the EU. In all cases, the contracts and locations for these services are subject to the EU standard contractual clauses (as per Art. 29 Working Party) and in the case of the USA, alternatively, to the U.S.-EU Privacy Shield treaty. The information on the guarantees is available for public viewing on the Microsoft website (and is stored alternatively by the data controller). No transfer of personal data from Microsoft to other companies takes place

With the consent of the data subject or based on legal provisions, especially for the purpose of investigation of criminal offences as well as in the context of a legitimate interest, in individual cases, personal data may be transferred subject to compliance with the data protection level of the European Union.

How long are my data stored?

We process your personal data for as long as a corresponding basis for processing exists and there is a legitimate interest in the continued processing. Once the data are no longer required, they are erased regularly.

The erasure periods for the aforementioned processing are determined as follows:

For carrying out the application process: The reason for processing ceases to exist after a final decision concerning the establishment of an employment relationship or rejection of the applicant. At the latest, however, at the end of the 6th calendar month after the last transfer of information by the applicant to the data controller.

If you have voluntarily decided to be retained in our pool of applicants, we will erase your personal data at the end of the second calendar year after your application.

In order to recognize repeat applicants, we process the aforementioned data for a maximum of 20 years from the end of the year of the last application activity.

For the fulfilment of commercial and tax-law storage obligations which can result from, among other things: Commercial laws and tax codes, etc. The periods specified there for the storage of documentation are typically two to ten years.

Preservation of evidence in the context of the legal statutes of limitation. This can, in particular, be potential claims arising from the application process according to equal opportunity laws or similar. In Germany, the period is regularly measured from the end of the 3rd calendar month after the rejection, provided there is no indication for an exercise of any possible rights.

What data protection rights do I have?

Every data subject has a right to:

Information according to Article 15 GDPR
Correction according to Article 16 GDPR
Erasure according to Article 17 GDPR
Restriction of processing according to Article 18 GDPR
Objection according to Article 21 GDPR
Data portability according to Article 20 GDPR
Make an appeal to a responsible data protection supervisory authority (Article 77 GDPR in conjunction with Par. 19 Federal Data Protection Act (BDSG) in Germany)

With regard to the rights to information and erasure, the restrictions as per pars. 34 and 35 BDSG apply for our German companies.

In the interest of protecting personal data, a data subject must prove their identity to us in a suitable manner (e.g. with a copy of a personal identity card) to exercise their rights. Moreover, in the case of obviously unfounded requests or excessively frequent repetitions, we can demand a reasonable fee or refuse to take action. (Art. 12(5) GDPR).

Consent you have granted to the processing of personal data can be withdrawn at any time.This also applies for the withdrawal of declarations of consent which were granted to us before the GDPR went into effect, meaning before 25 May 2018. Please bear in mind that the withdrawal of consent only takes effect for the future. Processing that took place before the withdrawal is not affected. (Please also see the last section.)

Am I obligated to provide data?

In the context of our applications, you must provide the personal data that are indispensable for conducting the process or which we are required by law to gather. We recommend the provision of those personal data as well which are appropriate for a legally compliant evaluation concerning the suitability of the applicant for the position. Without the last-mentioned data, the chances for the desired position can be reduced.

Does profiling take place?

We do not conduct automated processing of your application data for the creation of profiles.

To what extent does automated decision making take place?

As a matter principle, we do not use any fully automated decision making processes in terms of Article 22 GDPR concerning the selection of applicants.

Information concerning your right of objection according to Article 21 GDPR

Right of objection in individual cases

For reasons which arise from your special situation, you have the right to object at any time to the processing of personal data concerning you which is based on Article 6(1) point (e) GDPR (data processing in the public interest) or Article 6(1) point (f) GDPR (data processing based on a legitimate interest); this also applies for profiling in terms of Article 4(4) GDPR which is based on this provision.

If you object, we will no longer process your personal data except if we are able to adduce compulsory legitimate grounds for the processing which outweigh your interests, rights and freedoms or the processing serves the purpose of enforcing, exercising or defending legal claims.

Right of objection to processing of data for purposes of direct advertising

In individual cases, we process your personal data in order to engage in direct advertising. You have the right to object at any time to the processing of personal data concerning you for the purpose of advertising of this nature; this also applies for profiling inasmuch as it is connected with such direct advertising.

If you object to the processing for the purpose of direct advertising, we will no longer process your personal data for this purpose.

Addressee for submitting an objection

The objection can be submitted without form requirements using the subject line “Objection” and including your name, your address and your date of birth and should be addressed to:

K industries GmbH
Krestastraße 1, 9433 St. Andrä, Austria
Tel.: +43 4358 3811-0
E-Mail: info@k-industries.at

K industries Group

Data privacy statement