Individual processing actions
1. Data processing for the “application process”
1.1. Scope of the processing of personal data
In the course of creating an applicant profile, you can enter the following data: Name, address, date of birth, place of birth, nationality, email address, telephone number and information on whether you wish to receive emails about fitting jobs. The applicant profile also contains an open field where you can upload various documents (e.g. CV).
You are free to decide which data you would like to enter into the provided fields in the applicant profile and which documents you wish to upload. It is also solely your responsibility to manage the data and therefore to update and/or delete the data.
Kapsch Partner Solutions GmbH. will store and host this data in its own IT infrastructure or in the Workday data center in Dublin, Ireland, exclusively on your behalf.
To fulfill this order on your behalf, our IT system will also process technical information and protocol data on the login to your user account (device, software, browser, IP address, date, time, session ID).
1.2. Legal basis for the processing of personal data
The legal basis for the processing of the applicant data is Art. 6(1)(b) GDPR and therefore concerns processing for the performance of a contract or prior to entering into a contract. When you registered via www.kapsch.net/en/career and created an applicant profile, you issued a corresponding order to us to process your applicant data in our IT infrastructure.
The temporary saving of the technical information concerning the login is required to ensure the security and availability of the IT infrastructure and therefore to be able to fulfill the order appropriately, which is why our legitimate interest as defined by Art. 6(1)(f) GDPR forms the legal basis for our processing.
1.3. Purpose of the data processing
The data that you enter into the applicant profile after your registration will be saved by us on our server within our IT infrastructure or in the Workday data center in Dublin, Ireland. The data entered into your applicant profile will be processed by Kapsch Partner Solutions GmbH. exclusively to provide the ordered storage and hosting services. Kapsch Partner Solutions GmbH. will not process this data for any other purpose or in its own interest; in particular, it will not view nor correct the data nor delete it before the retention period expires.
In executing the order, we ensure that – as long as you do not revoke the order – you can access and manage your data. You can manage the data in the applicant profile yourself and therefore update or delete it, for example. Under MyWorkday, it is possible for HR Recruiting to initiate a process for deletion of the applicant profile.
We collect the technical information and protocol data to ensure the functionality and IT security of the applicant platform.
1.4. Storage duration
Once you request deletion of your applicant profile, the data uploaded there by you will also be deleted. You also have the opportunity to individually delete or update any data and documents you have uploaded there.
We store the technical information and protocol data for a period of three weeks.
1.5. Data recipients
The applicant platform is operated by Kapsch Partner Solutions GmbH.. Kapsch Partner Solutions GmbH. utilizes Workday Inc. as data processors for IT services, and these companies also have access to applicant data under some circumstances in order to provide the IT services.
2. Data processing for the “application process”
2.1. Scope of the processing of personal data
Specific personal data that Kapsch Partner Solutions GmbH. requires for the creation of the applicant profile and the further handling of your application, specifically: Title, first and last name, date of birth, address, telephone number (potentially), email address, education (potentially), desired employment (if not an unsolicited application) and password are required fields.
Nevertheless, your sharing of this data is voluntary; however, if you do not provide this data for fields marked as required, it may not be possible for us to process your application because certain information about your person is necessary to evaluate your suitability for a position.
All other information not designated as required fields can be filled out voluntarily; specifically, these are citizenship, academic title, CV, photo, how you learned about Kapsch, particularly sensitive information (e.g. religious affiliation) and profile data from Xing or LinkedIn. You can also voluntarily upload corresponding documents. Kapsch Partner Solutions GmbH. and the group company to which you have applied will then use this data for the same purpose as the required information.
Information on the login for your user account and protocol data (device, software, browser, IP address, date, time, session ID) as well as information on the applicant source is processed automatically.
2.2. Legal basis for the processing of personal data
The legal basis for the processing of the applicant data is Art. 6(1)(b) GDPR and therefore concerns processing for the performance of a contract or prior to entering into a contract. By submitting your application, you send to us a corresponding inquiry for processing of your applicant data within the framework of the application, which requires the described data processing.
With regard to the processing of the voluntarily provided (including particularly sensitive) data, we base the processing on your explicit consent according to Art. 6(1)(a) in connection with Art. 9(2)(a) GDPR, which you gave as part of the online form.
In the case of an unsolicited application, which therefore has no reference to a specifically advertised position, we also process your data only after consent (Art. 6(1)(a) GDPR).
2.3. Purpose of the data processing
The management and organization of the platform are performed by Kapsch Partner Solutions GmbH.. The further handling of the data in the application process is divided within the Kapsch Group between the respective group company*, to which you have applied, and Kapsch Partner Solutions as service provider in human resources matters.
In the case of an application for a position, the data entered via the platform in your applicant profile is used by Kapsch Partner Solutions GmbH. exclusively for the purposes of associating the application with the respective group company and forwarding the data to this company. If you upload your data to the applicant profile without applying for a position at the same time, we will organize the saving of the data in the applicant profile for you without any other processing of the data.
If you apply to Kapsch Partner Solutions GmbH. or another Kapsch company, your applicant data will be processed by the respective company for handling of your application and consideration within the application process as well as for the decision on filling the position to which you have applied.
In the case of an unsolicited application, Kapsch Partner Solutions GmbH. will store your applicant data in an applicant pool according to your consent for a period of 6 or 24 months and, upon opening of a position, send this data to the respective group company.
2.4. Storage duration
After a response to your application on our part, we will in all cases process your data for the duration of the application process. If the application process ends with your hiring at a Kapsch company, with declining of our job offer, with retraction of your application by you or with a rejection on our part, we will store your applicant data according to your consent for 6 or 24 months after the end of the month in which the application process ended for one of the above reasons. After this period has ended, we will irrevocably erase your data. The period of six months arises due to the defense against any claims according to the Equal Treatment Act. The period of 24 months arises in the case of your express consent.
If the application process ends in your hiring, we will transfer the relevant applicant data into your personnel file.
If you have granted your consent for the processing of specific data, we will erase your data earlier, if necessary, upon revocation of your consent.
You can revoke your consent at any time with effect for the future without specifying reasons by communicating this wish orally, in writing or electronically to Kapsch Partner Solutions GmbH. or the respective group company.
As concerns the data managed in your applicant profile, without you having sent us a specific application, we do not retain this data separately. Therefore, once you request the deletion of your applicant profile, the data uploaded there by you will also be deleted. You also have the opportunity to individually delete or update any data and documents you have uploaded there.
2.5. Data recipients
The applicant platform is operated by Kapsch Partner Solutions GmbH.. Kapsch Partner Solutions GmbH. utilizes Workday Inc. as data processors for IT services, and these companies also have access to applicant data under some circumstances in order to provide the IT services.
Your data is shared by Kapsch Partner Solutions GmbH. only with the respective group company to which you have applied. Only with your consent is your application also made available to another group company.
As concerns the sharing of your applicant data with a Kapsch company outside of the EU/EEA, please note that risks may arise from the necessary transmission of data. This is the case because no adequacy decision exists with respect to these countries and no specific guarantees can otherwise be provided to compensate for deficits with respect to the level of data protection. No or insufficient statutory regulations and standards for the protection of your personal data exist in these countries. Because the processing of your data is a precontractual measure for the establishment of an employment relationship for which you have applied, the forwarding of your applicant data to this company registered outside of the EU/EEA is justified (Art. 49(1)(a) GDPR) since your application could not be properly handled otherwise.
We will therefore share your data with this company only if you have applied to this company in awareness of this lower level of data protection.
The respective group company has tasked Kapsch Partner Solutions GmbH with the provision of personnel services and therefore also with consulting services in regard to recruiting. Kapsch Partner Solutions GmbH therefore uses the applicant data on behalf of and at the instruction of the respective group company that advertised the position or, in the case of an unsolicited application, on behalf of Kapsch Partner Solutions GmbH.. The location of the data storage and hosting of the data is Vienna or in the Workday data center in Dublin, Ireland.
3. Data processing of “applicant pool”
3.1. Scope of the processing of personal data
We save your applicant data (see item 1.1.) in an applicant pool in which Kapsch Partner Solutions GmbH. can search for suitable applicants if a position opens up within one of the group companies of the Kapsch Group.
3.2. Legal basis for the processing of personal data
The legal basis for the processing is in this case Art. 6(1)(a) GDPR and therefore your consent.
3.3. Purpose of the data processing
If you separately provide consent for your applicant data to remain on file in the applicant pool, the storage of your applicant data is necessary in order to inform you of a suitable job opening arising at a later time in one of the group companies
Kapsch Partner Solutions GmbH. will share your applicant data with the respective group company if an appropriate position is found, and you will then be contacted by this company.
3.4. Storage duration
We save your data in an applicant pool over a period of 6 or 24 months, according to your consent, unless you revoke your consent at an earlier point in time.
You can revoke this consent at any time with effect for the future without specifying reasons by communicating this wish orally, in writing or electronically to Kapsch Partner Solutions GmbH..
3.5. Data recipients
With your consent, we share your applicant data with the respective group company* if a position opens up. Otherwise, your data is not shared.
4. Rights of the data subject
4.1. Right to information
You have the right to request from us information on all data about your person that is processed by Kapsch Partner Solutions GmbH.. In detail, you can request the following information:
- The purposes for which the personal data is processed;
- The categories of personal data that are processed;
- The recipients and categories of recipients to whom your personal data has been or will be disclosed;
- The planned duration of the storage of your personal data or, if no concrete statements are possible in this regard, the criteria for determination of the storage duration;
- The existence of a right to rectification or erasure of your personal data, a right to restriction of the processing by the controller or a right to object to this processing;
- The existence of a right of complaint to a supervisory authority;
- All available information about the origin of the data if the data in question is not collected from the data subject;
- The existence of automated decision-making including profiling according to Art. 22 para. 1 and 4 GDPR and – at least in these cases – an informative description of the logic involved and the desired effects of such processing for the data subject.
You have the right to demand information about whether your personal data is transferred to a third country or an international organization. In this regard, you can demand to be informed of the appropriate safeguards according to Art. 46 GDPR in connection with this transfer.
4.2. Right to rectification and right to restriction of the processing
You can demand the rectification or completion of inaccurate or incomplete data. Under certain circumstances, such as if the accuracy of data is disputed, you can demand a restriction of the processing of data until the accuracy has been checked in that this may only be processed with your consent or for establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest.
4.3. Right to data portability
You can demand that Kapsch Partner Solutions GmbH. send to you – or, if technically feasible, to a third party designated by you – a copy of your data in a structured, commonly used and machine-readable format. You also have the right to send this data to another controller without hindrance from the controller to which the personal data has been provided, where:
- The processing is based on consent pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR or on a contract pursuant to Art. 6(1)(b) GDPR, and
- The processing is carried out by automated means.
In exercising this right, you further have the right to have the personal data about you transmitted directly from us to another controller, where technically feasible. The freedoms and rights of other persons may not be adversely affected by this.
4.4. Right to erasure
You have the right to the erasure of data under certain circumstances, such as when it is not being processed according to the data protection requirements.
The so-called “right to be forgotten” does not apply to you because Kapsch Partner Solutions GmbH. does not make your personal data public under any circumstances.
If you have asserted your right to rectification, erasure or restriction of processing with respect to Kapsch Partner Solutions GmbH., we are obligated to inform all recipients to whom your personal data has been disclosed of this rectification or erasure of the data or restriction of the processing unless this proves to be impossible or involves disproportionate effort.
4.5. Right to object
You have the right, on grounds relating to your particular situation, at any time to object to the processing of personal data concerning you that takes place on the basis of Art. 6(1)(e) or (f) GDPR.
Kapsch Partner Solutions GmbH. will in this case no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or the processing serves for the establishment, exercise or defense of legal claims.
4.6. Right to revocation of the declaration of consent
You have the right to revoke your declaration of consent at any time without specifying reasons. The revocation of consent shall not affect the legality of the processing that took place based on the consent up to the time of revocation.
5. Supervisory authority
Notwithstanding the option of an action in regional court according to Section 29(2) Data Protection Act 2018 and any other legal remedy, you have the right to lodge a complaint with the national supervisory authority of your place of residence if unlawful processing of personal data is presumed. In Austria, the Data Protection Authority is responsible.