Applicant data processing notice
Bystronic provides this Applicant Data Processing Notice ("Notice") to describe our practices as the responsible controller regarding the processing of personal data relating to applicants in connection with their application at Bystronic.
1. Categories of Personal Data
Bystronic processes the following categories of personal data about you provided by you in connection with your application (collectively, "Application Data"):
- contact details, such as your name, home address, telephone number and email address;
- information about your professional experience and abilities, such as previous employments, language skills, performance reviews, evaluations and ratings;
- photo (if provided voluntarily).
It is not anticipated to process sensitive personal data, however, if you provide us with sensitive personal data, such as health data, we will also process such data.
2. Processing Purposes, Legal Basis, and Consequences
Application Data is processed for recruitment and hiring purposes to determine your ability and suitability for the position(s) for which you have applied (collectively, "Processing Purposes"):
Bystronic relies on the following legal bases for the processing of Application Data:
- Steps prior to entering into a contract at the request of the applicant (Art. 6 (1) lit. b GDPR);
- legitimate interest of Bystronic, Bystronic's affiliates or other third parties, where the legitimate interest is in particular application management (Art. 6 (1) lit. f GDPR);
- consent, if provided by you and to the extent permitted by applicable law (Art. 6 (1) lit. a GDPR);
- compliance with legal obligations to which we are subject (Art. 6 (1) lit. c GDPR).
The provision of such data is voluntary. Not providing the Applicant and Sensitive Applicant Data may prevent Bystronic on manage the recruiting process with you and may require Bystronic to not take into account your application.
3. Categories of Recipients
Bystronic will process your Applicant Data in its HR Department and other departments relevant for the position. Bystronic may transfer your Applicant Data to third parties for the Processing Purposes as follows:
- Within the group: To the extent necessary for the job you have applied for, Bystronic may share your personal data with other group companies. Any access to your Applicant Data is restricted to those individuals that have a need to know in order to fulfill their job responsibilities.
- To data processors: Certain third parties, whether affiliated or unaffiliated, may receive your personal data to process such data under appropriate instructions ("Data Processors") as necessary for the Processing Purposes. The Data Processors will be subject to contractual obligations to implement appropriate technical and organizational security measures to safeguard the personal data, and to process the personal data only as instructed.
4. Retention Period
Your Application Data is stored by Bystronic and/or our service providers, strictly to the extent necessary for the performance of our obligations and strictly for the time necessary to achieve the purposes for which the information is collected, in accordance with applicable data protection laws. If you applied, but we rejected your application, we will store your Application Data for six months. After six months your Application Data will be deleted, unless your personal data may be kept longer, e.g. due to an emerging lawsuit to exercise or defend our claims. If we want to add you to our applicant pool, we will ask for your consent to do so in our rejection mail. In such case your Application Data will be stored for one year for the purpose of re-evaluation and later or other vacancies at the Bystronic and based on your consent. After one year your Application Data will be deleted. The recruiting process for vocational training in Switzerland lasts up to three years. During this time, we reserve the right to retain your personal information. You can, however, take action independently to delete your candidate profile at any time (see 6. (iii)).
5. Automated decision-making
Bystronic does not engage in automated decision-making in the context of applications.
6. Your Rights
If you have declared your consent regarding certain types of processing activities, you can withdraw this consent at any time with future effect. Such a withdrawal will not affect the lawfulness of the processing prior to the consent withdrawal.
Pursuant to applicable data protection law you may have the right to: (i) request access to your personal data; (ii) request rectification of your personal data; (iii) request erasure of your personal data; (iv) request restriction of processing of your personal data; (v) request data portability; (vi) object to the processing of your personal data. Please note that these aforementioned rights might be limited under the applicable national data protection law.
(i) Right of access: You may have the right to obtain from us confirmation as to whether or not personal data concerning you is processed, and, where that is the case, to request access to the personal data. The access information includes – inter alia – the purposes of the processing, the categories of personal data concerned, and the recipients or categories of recipient to whom the personal data have been or will be disclosed. However, this is not an absolute right and the interests of other individuals may restrict your right of access.
You may have the right to obtain a copy of the personal data undergoing processing. For further copies requested by you, we may charge a reasonable fee based on administrative costs.
(ii) Right to rectification: You may have the right to obtain from us the rectification of inaccurate personal data concerning you. Depending on the purposes of the processing, you may have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
(iii) Right to erasure (right to be forgotten): Under certain circumstances, you may have the right to obtain from us the erasure of personal data concerning you and we may be obliged to erase such personal data.
(iv) Right to restriction of processing: Under certain circumstances, you may have the right to obtain from us restriction of processing your personal data. In this case, the respective data will be marked and may only be processed by us for certain purposes.
(v) Right to data portability: Under certain circumstances, you may have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and you may have the right to transmit those data to another entity without hindrance from us.
To exercise your rights please contact us as stated in the "Questions" section below.
You also have the right to lodge a complaint with the competent data protection supervisory authority.
Right to object pursuant to Art. 21 General Data Protection Regulation
You have the right to object on grounds relating to your particular situation, at any time to the processing of your personal data concerning you which is based on Art. 6 (1) lit. e and f GDPR and we can be required to no longer process your personal data. As Bystronic processes and uses your personal data primarily for purposes of carrying out the contractual employment relationship with you, [Bystronic] will in principle have a legitimate interest for the processing which will override your restriction request.
To exercise your right please contact us as stated in the "Questions" section below.
7. Questions
If you have any questions about this Notice or your rights, please contact the data protection officer of Bystronic: Ecoprotec GmbH, Pamplonastrasse 19, 33106 Paderborn, Germany. The data protection officer can be contacted at gdpr.de@bystronic.com