Candidates Data Protection Declaration

Preamble
To cut a long story short: we treat your personal data in confidence and conform with the statutory data protection regulations.

We would now like to give you some information regarding the personal data that we collect in the event of you registering with our candidates portal or you applying for a certain job position by email or post; why we require them, what we use them for, and who you can contact should you have any questions.

The declaration is aimed at persons (hereafter also referred to as candidates) that wish to create a free user account in the scope of our candidates portal at epunkt, either when submitting an application for a particular position by email or post, or an unsolicited application.

We are the company epunkt GmbH (hereafter referred to as “epunkt“) which has its headquarters in Linz. We are the market leader in the recruiting sector in Austria and specialise in the placement and consultation of specialist and executive staff.

epunkt GmbH, FN 210991g
Harrachstraße 6, A-4020 Linz
T: +43 732 611 221
F: +43 732 611 221 -20
datenschutz@epunkt.com

We are also to be found at the following locations: www.epunkt.com/u/standorte-oes...

Our company includes subsidiaries and franchise partners, that have occasion-related access to your data or are provided with these for the following purposes:

• A franchise partner exists in Germany (see under www.epunkt.com/en/loca...) that is active in the field of negotiation and the consultation of specialists and executive staff and have occasion-related access to your data for the placing of positions in this market.
• There are the subsidiaries Talentor International GmbH and Talentor Austria GmbH (company seat: Universitätsring 8/6, 1010 Wien (Vienna) that operate under the Talentor brand and are active in the field of Executive Search in the Austrian market (see www.talentor.com/l/talentor-austria). These companies are granted occasion-related access to your data for the placement of national and international executive positions.

As a candidate, you can assert your data protection rights (see Clause 9) centrally with the epunkt GmbH data protection officer. All of the affiliated companies are subjected to a confidentiality and adherence to the applicable data protection provisions obligation.

We use your data for the purpose of career advice and the filling of job vacancies. You can create a user account on our website https://www.epunkt.com/ without the existence of a specific job vacancy. An epunkt employee shall then contact you by email or telephone in order to discuss the other steps with you.

As a candidate, you can create a user account and therefore apply for a specific job vacancy direct. It is also the case here that an epunkt employee shall then contact you by email or telephone so that he or she can discuss further steps with you. It is unfortunately the case that the first application that you have actively submitted is not always successful. Subject to you providing your consent (see clause 5), epunkt shall contact you again as soon as there are other job vacancies that match your profile.

We process your personal data for the purpose of creating a candidate profile and a user account in addition to the related recommendation of job positions exclusively on the basis of your explicit consent (Art 6 para. 1 letter a). A processing of your personal data in order to place you in specific job positions is carried out in connection with this on the basis of the implementation of pre-contractual measures pursuant to Art 6 para. 1 letter b GDPR.

When applying for a specific job vacancy (e.g. by mail or post), a user account is created exclusively on the basis of the data you have sent us. This is necessary for the recruiting process and is carried out on the basis of the implementation of pre-contractual measures upon your request, this therefore being the applying for one or more specific job vacancies (Art 6 para. 1 letter b GDPR). You can use the user account to keep your data up to date at all times (Art 5 para. 1 letter d GDPR). In this case, a candidate profile shall not be created however, and you shall also not receive a recommendation regarding other job vacancies (the exception being if you grant your consent to this – see the first paragraph of Clause 5).

Furthermore, your data shall also be processed on the grounds of an overriding interest (Art 6 para. 1 letter f GDPR) and in order to meet legal obligations (Art 6 para. 1 letter c GDPR), especially in connection with the assertion, exercising or defending, of legal claims (e.g. claims on the basis of the Equal Treatment Act). If necessary, your data shall merely be stored to a restricted extent for this purpose.

Neither are you subjected to a statutory obligation to disclose your personal data, nor are you under a contractual one. It is however not possible for us to accept any applications without your personal data, and we are also unable to inform you of appropriate vacancies, even if you have requested us to do so.

We wish to draw your attention to the fact that health data, information concerning your racial or ethnic origin, political, religious, trade union memberships or your sexual orientation are all data that are especially to be protected (special categories of personal data pursuant to Art 9 GDPR). We therefore request you to not send us such data, neither in the form of curricula vitae, nor in the form of other documents.

So that we can efficiently suggest matching job vacancies to you, we index candidate profiles -subject to your consent- so that they can be found more easily in the candidates database. The indexing includes data from the application documents, skills, qualifications, desired salary, place of employment, the readiness to travel or the professional career. In the case of new jobs, these indexed terms are used in the candidate profiles so that the data that are stored in the candidate profile can be compared with the respective job requirements.

Our recruiting processes do not include any automatisms that result in candidates being fully automatically excluded from the application process or in an employer being automatically recommended. The decision as to which candidates are contacted concerning with positions or which are to be forwarded to one of our clients, is always made by the responsible epunkt recruiting partner. Automatic decision-making as defined in Art. 22 GDPR does not therefore take place.

The responsible epunkt employees have access to all of the data stated under Clause 6 in addition to such also being granted to the companies affiliated with epunkt if necessary (see Clause 3), in order to fulfil the purpose.

We suggest suitable job vacancies to you in the scope of the recruiting process. After you have had an interview at epunkt, consultations have been held, and you have granted your consent, we forward your data for a specific vacancy to individual clients. The client is hereby not granted unrestricted access to your data, a so-called candidate report is generated in the form of a PDF document. This report is generated on a position basis and includes your master data (personal data, address data and contact data), your professional requirements (e.g. desired salary or periods of notice) and the assessment of the epunkt recruiting partner on the basis of the interviews and memos. Our clients have been subjected to a contractual duty of confidentiality and discretion.

We also use service providers so that we are able to provide our services (referred to as processors). Examples for these are the providers of our recruiting software (OTYS B.V. that has its registered office in the Netherlands) or the hosting provider (Sentia in Belgium), that makes servers available to us for software operations. These service providers only have a case-to-case access to your data for maintenance and support purposes. They have been subjected to a contractual confidentiality and data security measures in the form of a processor agreement pursuant to Art. 28 GDPR, whereby the adherence to the data security measures is regularly checked by us. A processing of personal data in non-EU member states does not take place in this regard.

It may be possible that we shall have to grant public authorities, courts of law or legal representatives access to your data for the purpose of meeting legal obligations or in order to defend ourselves against legal claims.

The EU General Data Protection Regulation (Articles 15 to 22), you have a right to inform, erase, restrict, of data portability, rectification, revocation and objection. We would like to provide you with detailed explanations regarding some of these rights:

• Your right of access and rectification
  You are obviously entitled to be provided with information regarding your personal data that we store and process. Should your data no longer be correct or should they be incomplete, you can demand a rectification or supplementation.
• Your right to revoke and erase your personal data
  You can revoke your consent at all times and exercise your erasure right. In this case, we are obliged to erase your personal data in as far as we are not entitled or obliged to continue to store your data or parts thereof. The revocation of your consent does not affect the lawfulness of the processing that has been carried out on the basis of the consent until such time as the revocation has been received.
• Your restriction, data portability and objection rights in addition to measures that are adopted in connection with the automated making of decisions
  Subject to certain conditions, you can also demand that we restrict the processing or provision of your data within the scope of the data portability rights in addition to you also being able to object to the processing of your data.

You also have the right to file a complaint with the data protection authority should you be of the opinion that your personal data is not being processed conform with the provisions of the data protection law. You shall find the contact data for the Austrian data protection authority here: https://www.dsb.gv.at/ueber-die-website/kontakt.html.

Your personal data are basically stored as long as they are required in order to fulfil the aforementioned purposes (e.g. defence against legal claims pursuant to sections 15  subsection 1, 29 of the Equal Treatment Act). Your data shall then be automatically erased without delay. In the case of you providing your consent, the processing shall always only take place until such time as you revoke your consent.

In the case of candidates who we are unable to suggest any suitable job vacancies to over a longer period of time, we reserve the right to automatically erase the profile despite the fact that the consent had been granted. Should a job vacancy exist later that would be of interest to you, you can always create a new user account.

Please contact our data protection department should you have any questions regarding this Data Protection Declaration or the exercising of your rights:

epunkt GmbH
Datenschutzbeauftragter
Harrachstraße 6
A-4020 Linz
Email: datenschutz@epunkt.com