Privacy policy for job candidates

Date of publication: October 15th, 2024

1) Processing activity

Recruitment

2) Responsible party

hi.health GmbH

Mariahilfer Straße 117/2/23, 1060 Vienna, Austria

privacy@hi.health

3) Contact details of the data protection officer

Wolfgang Renzl, Rechtsanwalt

PARLAW Rechtsanwalts-Partnerschaft

Hegelgasse 19/5+6, 1010 Vienna, Austria

office@parlaw.at

4) Purposes of data processing

On the legal basis of contract preparation

a) Management of the application process

b) Selection of suitable employees

c) Documentation of the fair, lawful selection process

5) Legal basis for data processing

a) Contract preparation (Art 6 Abs 1 lit b DSGVO)

b) Consent (Art 6 para 1 lit a GDPR): In the event that his/her application is unsuccessful, the Job candidate can voluntarily give his/her consent for the employer to store his/her personal data for a period of 5 years after the end of the current year of application and to return to it if necessary. Furthermore, the Job candidate can voluntarily give his/her consent for his/her personal data to be transferred to Group companies if he/she is considered for a position there.

6) Assessments of personal aspects of the employer (“profiling”)

The employer does not undertake any profiling measures as part of the employment relationship.

7) Obligation to provide data

Job candidates are obliged to provide their personal data correctly.

8) Automated decision making

The Job candidate is not subject to any automated decision that has any legal effect on him/her.

9) Types of data processed

a) provided by the Job candidate:

• Name

• Home address

• E-mail address

• Telephone Number

• Citizenship

• Date of birth

• Place/country of birth

• Gender

• Photo

• Video

• Marital status

• Religious confession

• Social security number

• Social media profiles

• Salary information

• CV information

• Communications data

• Social media profile

b) additionally collected by the employer:

• References

• Data from interviews and assessments

10) Data sources (if not collected from the Job candidate) 

References: Previous co-workers, managers, clients, partners, public profiles

Data from interviews and assessments: phonecall, video call, e-mail and other messaging options

11) Internal recipients of data

• Management

• Human resources

• Hiring team

12) External recipients of data

a) Google LLC (e-mail and file management)
1600 Amphitheatre Parkway Mountain View, CA 94043, USA
dpf-core-team@google.com

b) Teamtailor AB (Job candidate management system)
Östgötagatan 16, 11621 Stockholm, Sweden
support@teamtailor.com

c) Remote Europe Holding B.V. (EOR provider, in case the Job candidate wants to work from a country other than Austria)
Kraijenhoffstraat 137A, 1018RG Amsterdam, The Netherlands
https://remote.com/contact-data-protection

All external recipients can be contacted and reached in a standardized manner regarding data protection issues via the controller or its data protection officer.

13) Third country transfer

The following data is transferred to countries outside the EU in the course of data processing:

a) Google LLC; Country: USA; Types of data: All in 9) mentioned data points

14) Storage period

a)Legal basis for contract preparation:

The data will be processed by the employer on the basis of the above-mentioned legal basis for up to 10 months after the position has been filled (= 6 months for possible pre-contractual claims for damages + max. 4 months for service of a lawsuit) and then deleted (at least the personal reference). 

b) Legal basis for consent:

If the Job candidate has given consent for his/her application to be stored, the data will be kept until revoked, but for no longer than 3 years after the end of the current year of the application and then deleted.

15) Rights of the Job candidate

a) Art 15 DSGVO “Right of access by the data subject“ - The Job candidate has the right to request information as to whether personal data relating to him/her is being processed.

b) Art 16 DSGVO “Right to rectification“ - The Job candidate has the right to demand the immediate correction of incorrect personal data or the completion of such data. 

c) Art 17 DSGVO “Right to erasure“  - The Job candidate has the right to demand that the personal data be deleted immediately, provided that the reasons stated in Art. 17 para. 1 GDPR are fulfilled.  

d) Art 18 DSGVO “Right to restriction of processing“ - The Job candidate has the right to request that the processing of personal data be restricted if the reasons stated in Art. 18 para. 1 GDPR are fulfilled. 

e) Art 21 DSGVO “Right to object“ - The Job candidate has the right to object at any time to the processing of his/her personal data on the legal basis of Art. 6 (1) (e) (processing in the public interest) or (f) (processing on the basis of a legitimate interest).  

f) Art 20 DSGVO „Right to data portability” - The Job candidate has the right to receive the personal data provided in a structured, commonly used and machine-readable format.

g) Art 77 GDPR and §24 Data protection act (Austria) - Every Job candidate has the right to lodge a complaint with the supervisory authority if he or she considers that the processing of personal data relating to him or her infringes this Regulation.

16) Supervisory authority

Austrian Data Protection Authority

Barichgasse 40-42, A- 1030 Vienna, Austria

Telephone: +43 1 531 15

E-mail: dsb@dsb.gv.at

17) Updates to this privacy policy

This privacy policy may be subject to change over time. We recommend that you check the privacy policy regularly for changes.