Privacy Statement on data processing pursuant to Art 13 and Art 14 General Data Protection Act (GDPR)
We are pleased that you wish to apply for a job at K-Businesscom AG or one of the companies of the K-Businesscom. Transparency and trustworthy handling of your personal data is an important basis for good cooperation. We therefore attach great importance to making the processing of your personal data transparent and would like to inform you with this Privacy Statement about our handling of your data and your rights in this context.
K-Businesscom AG has implemented the career site for your job application. On this platform, you have the possibility to enter your application data through the tool of eRecruiter GmbH. By application we mean your application for a position at K-Businesscom AG or one of our group companies (K-Businesscom). K-Businesscom AG is entrusted with managing the receipt of applications and organising the application process via this platform centrally for the K-Businesscom. The respective application is then handled in detail by the company for which you have applied.
1. Responsible for data processing (Controller)
Responsible and therefore the controller for processing your personal data are K-Businesscom AG and the respective company of the K-Businesscom (if you have applied to a specific one).
The contact details of the data protection officer or contact person on data protection issues for the respective companies are:
c/o Data Protection Officer
Wienerbergstraße 53, 1120 Vienna, Austria
T +43 50 822 0
F +43 50 822 9995
K-Converged Services GmbH
c/o Data Privacy Manager
Wolfganggasse 58-60, 1120 Vienna, Austria
c/o Data Protection Officer
Sperberweg 8, 41468 Neuss (Düsseldorf), Germany
T +49 2131 9526 0
2. Personal Data
“Personal data” means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier.
3. Data Processing "Application Process" - Applicant Profile Creation
3.1 Scope of data processing
When creating your applicant profile you can enter the following data:
Form of address, title, first name, last name, eMail-address, telephone number, date of birth, address (street, house number, postcode, city, country), nationality.
Additionally, the applicant profile covers a free field, that can be used for uploading various documents (CV, photo, additional documents).
It is up to you which data you enter into the applicant profile and which document you upload. Furthermore, it is your sole responsibility to manage the data and therefore to update and/or delete it.
K-Businesscom AG will only store and host this data on your behalf in its own IT infrastructure.
3.2 Legal basis of data processing
The legal basis for the processing of applicant data is Art. 6 (1) lit. b of the GDPR and therefore the processing for the fulfilment of a contract or the implementation of pre-contractual measures. When you registered via https://jobs.kapsch.net/ and created an applicant profile, you gave a corresponding order to us to process your application data within our IT infrastructure.
The temporary storage of technical login information is necessary to ensure the security and availability of the IT infrastructure and therefore to be able to fulfil the order accordingly, which is why the legal basis for the processing is our legitimate interest within the meaning of Art. 6 (1) lit. f of the GDPR.
3.3 Purpose of data processing
The data that you enter in the applicant profile after your registration will be stored by us on our server within our IT infrastructure. The data entered in your applicant profile will be processed by K-Businesscom AG exclusively for the provision of the commissioned storage and hosting services. K-Businesscom AG will not process this data for any other purpose or in its own interest and, in particular, will not view or correct it or delete it before the expiry of the retention period.
Within the scope of the order, we will ensure that you can access and manage your data as long as you do not revoke the order placed with us. You yourself can manage the data in the applicant profile and therefore, for example, update or delete it.
We process technical information and log data to ensure the functionality and IT security of the job application platform.
3.4 Data retention
As soon as you request the deletion of your applicant profile, the data you uploaded there will also be deleted. You also have the option of individually deleting or updating all data and documents uploaded there.
We store the technical information and log data for a period of 3 weeks.
3.5 Recipients of your personal data
The job application platform is operated by K-Businesscom AG. In the course of operating activities, K-Businesscom AG uses eRecruiter GmbH as a processor for IT services, which may therefore also have access to the applicants' data in order to be able to provide the IT services.
4. Data Processing „Application Process“ – Handling
4.1 Scope of data processing
Certain personal data that we require for the creation of the applicant profile and the further processing of your application, namely: Form of address, first name(s), last name(s), e-mail address, telephone number, address (street, house number, postcode, city, country), nationality, and password, are mandatory fields.
The provision of this data by you is nevertheless voluntary; however, if you do not provide this data, which is marked as mandatory, we may not be able to process your application, as certain information about you is required to assess your suitability for a position.
All other information that is not marked as mandatory fields, namely title (first and last), date of birth, additional documents (e.g. photo) as well as profile data from LinkedIn can be filled in voluntarily and/or corresponding documents can be uploaded. If applicable, we and the respective K-Businesscom company for which you have applied will then also treat any particularly sensitive data you have provided (such as religious confession within the CV) as well as any data you have provided voluntarily for the same purpose as the mandatory data.
We automatically process login details to your user account and log data (device, programme, browser, IP address, date, time, session ID) as well as information on the applicant source.
The extent of data collection may need to be assessed according to the position to be filled. If, for example, your desired position is associated with the assumption of increased personnel and/or financial responsibility, supplementary data collection may take place (sending/performing a test for the purpose of creating an analysis and, if applicable, a personality profile). In these cases, an application outside of eRecruiter is used (Metis products from Master Human Resources Consulting GmbH).
4.2 Legal basis of data processing
The legal basis for the processing of applicant data is Art. 6 (1) lit. b of the GDPR and therefore the processing for the performance of a contract or for the implementation of pre-contractual measures. By applying, you make a corresponding request to us to process your applicant data in the context of the application, which requires the described data processing.
As far as the processing of voluntarily provided data (including special categories of data) is concerned, we base the processing on your express consent within the meaning of Art. 6 (1) a in conjunction with Art. 9 (2) a of the GDPR, which you have given in the course of the online form.
In the case of a unsolicited application and therefore without reference to a specific advertised position, we also process your data only after consent (Art. 6 para. 1 lit. a the GDPR).
You can revoke your consent at any time with effect for the future and without giving reasons verbally, in writing or electronically to K-Businesscom AG or the respective group company. The lawfulness of the processing of your data up to the time of the revocation remains unaffected.
4.3 Purpose of data processing
The platform is managed and organised by K-Businesscom AG. The further handling of data in the application process is divided between the respective K-Businesscom company to which you have applied and K-Businesscom AG as a service provider in personnel matters, within the K-Businesscom.
The data entered in your applicant profile via the platform will be used by K-Businesscom AG exclusively in the event of your application for a job for the purpose of assigning you to the respective K-Businesscom company and passing it on to them. If you upload your data in the applicant profile without applying for a job at the same time, we will only organise the storage of the data in the applicant profile for you, but will not otherwise process the data.
Insofar as you apply to K-Businesscom AG or another K-Businesscom company, your applicant data will be processed by the respective company for the purpose of handling your application and considering you in the application process, as well as for the purpose of deciding whether to fill the position for which you have applied (for details, see chapter 5.).
In the event of an unsolicited application, K-Businesscom AG will store your applicant data in an applicant pool for a period of 6 or 24 months in accordance with your consent and pass it on to the respective K-Businesscom company when a position becomes available.
4.4 Data retention
Once we have responded to your application, we will process your data for the duration of the application process. If the application process ends with your employment with a K-Businesscom company, by rejection of our offer of employment, by withdrawal of your application or by rejection on our part, we will store your applicant data for 6 or 24 months in accordance with your consent after the end of the month in which the application process ends for one of the aforementioned reasons. After this period has expired, we will irretrievably delete your data. The period of six months results from the defence of any claims under the Equal Treatment Act. Insofar as you have given your consent for the processing of certain data, we will delete your data earlier with the revocation of your consent, if applicable.
In connection with sending/carrying out a test for the purpose of creating an analysis and, if applicable, a personality profile, your data will be stored for a period of 36 months in accordance with your consent. This is due to the intended non-repeatability and may facilitate a possible future application for similar positions. After this period has expired, we will irretrievably delete your data. The data will be deleted correspondingly earlier if you revoke your consent.
If the application process leads to your employment, we will transfer your relevant applicant data to your personnel file.
You may revoke your consent at any time with effect for the future and without giving reasons orally, in writing or electronically to K-Businesscom AG or the respective K-Businesscom company.
As far as the data managed by you in the applicant profile without you having sent a concrete application to us is concerned, we do not keep these separately. As soon as you request the deletion of your applicant profile, the data you uploaded there will also be deleted. You also have the option of individually deleting or updating all data and documents uploaded there.
4.5 Recipients of your personal data
The job application platform is operated by K-Businesscom AG. In the course of this, K-Businesscom AG uses eRecruiter GmbH as a processor for IT services, which may therefore also have access to the data of the applicants in order to be able to provide the IT services. Furthermore, K-Businesscom AG uses products from Master Human Resources Consulting GmbH (MHRC) via Metis. This means that responsible specialists as well as technically and organisationally competent and authorised employees of the technical service providers of MHRC have access to your data in order to be able to provide your services.
Your data will only be passed on by K-Businesscom AG to the respective K-Businesscom company to which you have applied. Only with your consent will your application also be made available to other K-Businesscom companies.
As far as the transfer of your applicant data to a K-Businesscom company outside the EU/EEA is concerned, we would like to draw your attention to the fact that no data is currently transferred to third countries.
The respective group company has commissioned K-Businesscom AG with the provision of personnel services and therefore also with consulting regarding recruiting. K-Businesscom AG therefore uses the applicant data according to the order and instructions of the respective K-Businesscom company that has advertised a position or, in the case of a unsolicited application, on behalf of K-Businesscom AG. The place of data storage and hosting is Vienna.
5. Data Processing „Application Process“ – Applicant-Pool
5.1 Scope of data processing
We store your applicant data (see point 3.1.) in an applicant pool (eRecruiter), in which K-Businesscom AG can search for suitable applications, in the event of a vacancy within one of the K-Businesscom companies.
5.2 Legal basis of data processing
In this case, the legal basis of the processing is Art. 6 para. 1 lit. a of the GDPR and therefore your consent.
5.3 Purpose of data processing
If you separately consent to your applicant data being kept on record in the applicant pool, the storage of your applicant data is necessary in order to be able to inform you about a suitable vacancy in one of the K-Businesscom companies at a later date.
K-Businesscom AG will pass on your applicant data to the respective group company where a suitable position has been found, which will then contact you.
5.4 Data retention
We store your data in an applicant pool for a period of 6 or 24 months in accordance with your consent, unless you revoke your consent at an earlier point in time.
You may revoke this consent at any time with effect for the future and without giving reasons orally, in writing or electronically to K-Businesscom AG.
5.5 Recipients of your personal data
The applicant platform is operated by K-Businesscom AG. In the course of operating activities, K-Businesscom AG uses eRecruiter GmbH as a processor for IT services, which may therefore also have access to the applicants' data in order to be able to provide the IT services.
We will pass on your applicant data to the respective group company when a vacancy becomes available with your consent. Otherwise, your data will not be passed on.
As far as the transfer of your applicant data to a group company outside the EU/EEA is concerned, we would like to draw your attention to the fact that no data is currently transferred to third countries.
6. Your Rights
6.1 Right to information
Pursuant to Art. 15 of the GDPR, you have the right to obtain information from us about all personal data that we process. In detail, you can request information from us about the following:
- The purposes for which the personal data are processed;
- The categories of personal data which are processed;
- The recipients or categories of recipients to whom the personal data concerning you have been or will be disclosed;
- The planned duration of the storage of the personal data concerning you or, if concrete information on this is not possible, criteria for determining the storage period;
- The existence of a right to rectification or erasure of the personal data concerning you, a right to restriction of processing by the controller or a right to object to such processing;
- The existence of a right of appeal to a supervisory authority;
- Any available information about the origin of the data, if the personal data is not collected from the data subject;
- The existence of automated decision-making, including profiling, pursuant to Article 22(1) and (4) of the GDPR and, at least in these cases, meaningful information about the logic involved and the scope and intended effects of such processing for the data subject.
You have the right to request information on whether personal data concerning you is transferred to a third country or to an international organisation. In this context, you may request to be informed about the appropriate safeguards pursuant to Art. 46 of the GDPR in connection with the transfer.
6.2 Right to rectification and right to restriction of processing
If we process data relating to you that is inaccurate or incomplete, you have the right to rectification and the right to restriction in accordance with Article 16 of the GDPR. In certain circumstances, for example, if the accuracy of data is in dispute until the accuracy has been verified, you may request a restriction on the processing of data to the effect that it may only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person, or for reasons of substantial public interest.
6.3 Right to data portability
You may request that K-Businesscom AG sends you - or, if technically feasible, a third party designated by you - a copy of your data in a structured, common and machine-readable format. In addition, you have the right to transfer this data to another controller without hindrance by the controller to whom the personal data was provided, provided that
- the processing is based on consent pursuant to Art. 6 (1) lit. a of the GDPR or Art. 9 (2) lit. a of the GDPR or on a contract pursuant to Art. 6 (1) lit. b of the GDPR, and
- the processing is carried out with the help of automated procedures.
In exercising this right, you also have the right to have your personal data transferred directly from us to another controller, insofar as this is technically feasible. The freedoms and rights of other persons must not be affected by this.
6.4 Right to erasure
You have the right to have data deleted under certain circumstances, for example if it is not processed in accordance with data protection requirements. The so-called "right to be forgotten" does not apply to you because K-Businesscom AG will not make your personal data public under any circumstances.
If you have asserted the right to rectification, erasure or restriction of processing against K-Businesscom AG, we are obliged to notify all recipients to whom the personal data relating to you has been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or involves a disproportionate effort.
6.5 Right to object
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data relating to you which is carried out on the basis of Article 6(1)(e) or (f) of the GDPR.
In this case, K-Businesscom AG will no longer process your personal data unless we can demonstrate compelling legitimate bases for the processing which override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.
6.6 Right to revoke the declaration of consent under data protection law
You have the right to revoke your declaration of consent under data protection law at any time without giving reasons. The revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.
7. Right of complaint and supervisory authority
Notwithstanding the option of an action in regional court according to Section 29 para. 2 Data Protection Act 2018 and any other legal remedy, you have the right to lodge a complaint with the national supervisory authority of your place of residence if unlawful processing of personal data is presumed. In Austria, the Data Protection Authority is responsible.
8. Updates and amendments