Recruitment Privacy Notice

1. Introduction

This Recruitment Privacy Notice ("Notice") applies to the ABB Group of companies, which means ABB Asea Brown Boveri Ltd, Switzerland and each entity in which ABB Asea Brown Boveri Ltd, Switzerland, directly or indirectly, has a majority holding or owns or controls the majority of voting rights. The ABB company that is offering the job position that you are applying to (referred to as "ABB") is responsible for the processing of your personal data and controls how it is used, in accordance with this Notice.

At ABB respecting your data protection rights is a top priority. This Notice explains how we use personal data about you and what rights you have regarding your personal data.

2. Who is responsible for the processing of your personal data?

ABB Asea Brown Boveri Ltd and its subsidiary companies are responsible for your personal data. For applicable privacy and data protection laws, the primary controller of your data is the ABB subsidiary company which is offering the job position that you are applying to (hereinafter together with the recruitment process referred to as “recruitment”). Other subsidiary companies of ABB may also receive and process your personal data, either in the capacity of controller or processor, and this Notice applies equally to them.

In your case, ABB AG, Brown-Boveri-Straße 3, 2351 Wiener Neudorf, Austria, or any respective company affiliated with ABB AG, having an employment relationship with you, decides as "controller" within the meaning of the EU General Data Protection Regulation (“GDPR”) and the Austrian Data Protection Act (Datenschutzgesetz – “DSG”) how and for which purpose your personal data will be used in accordance with this Notice (hereinafter: “ABB”, "we" or "us").

3. Which of your personal data do we collect and use?

We collect and use personal data that we receive from you in the course of or in connection with your recruitment at ABB, primarily via ABB’s career portal. In addition, and to the extent necessary for the purposes mentioned in this Notice, we process personal data which we may obtain from publicly accessible sources, such as employment- and business-orientated social networking services and career fairs, or which are legitimately transmitted by other third parties, such as background check providers, recruitment agencies through which you have applied for a job and other administration services providers.

We may use the following categories of your personal data, as applicable and necessary for the purposes of processing under this Notice:

  • Personal details and identification data such as name, gender, age, citizenship, date and country of birth, marital and family status, personal and business address, personal and business telephone number, personal and business email address or any other contact details you choose to disclose to us as part of your job application.
  • Skill and experience detailssuch as qualifications and certifications including current and previous positions, education and training courses, resume/CV, education records and work achievements. In some cases: contact details of referees and results of capability assessments and interview assessment/feedback and any other personal information you choose to disclose to us as part of your job application.
  • Depending on the position, we are performing internal/external assessments, where we collect additional data such as assessment performance data, assessment score, phone interview recordings/notes, video interview recordings/notes.
  • Employment related personal data of successful candidates only necessary for the employment contract conclusion and onboarding process such as photos, signature, passport information, country of residence, nationality, work and residence permit, immigration status and travel visa information, employee number, employment status, the applicable personal identity numbers (social security, insurance, tax or driving license numbers or possibly other type of individual number applicable for you), insurance data, bank account details, data of your related persons (name of spouse/partner, children, etc.), emergency contacts, training records, clothing and shoe size where necessary.
  • Other personal data (which may include special categories of information as mentioned below) namely where you may register these data on or in our systems, programs and applications for recruitment containing personal information (e.g. queries, questions, complaints, emails, contracts, presentations, work products), photos, images and/or videos.
  • In case of employment contract conclusion, on your request we can also process your data as required for performance of the contract in scope of some employment related services (e.g. relocation services or obtaining required or visa and work permit).
  • carrying out audits, reviews and compliance checks to monitor the quality recruitment process, including compliance with ABB’s corporate policies and legal requirements including disciplinary actions as well as responding to complaints and process related questions, on the basis of on legitimate interest of ABB or a joint venture of ABB and a third party .

The below mentioned types of personal data are only collected and processed during the onboarding process, if at all, in accordance with applicable local laws, but we only do so when required by the local law or where this is necessary to secure legal requirements of equal opportunity and treatment for all candidates and employees in ABB. Respectively, any such personal data will not be processed, if such processing is prohibited according to applicable provisions of national law.

  • Special categories of personal data such as:
    • membership of religious congregations (e.g. if required for tax purposes);
    • health and medical information, including disability status, special working conditions (such as use of a standing desk) and medical devices needed on the premises, work related injury and illness information, data for travel emergency support (blood type, medical history, allergies);
    • race or ethnicity (e.g. where this is used for diversity purposes);
    • in some cases: trade union membership.
  • If we run a background check on you as a part of the recruitment process, we will only process such data in accordance with applicable law. Data about criminal convictions and offences such as criminal background information and sanction list information will only be processed to the extent required for the purposes of criminal background screening and KYC and AML or other legal obligations.

In case you would like to be provided with information about a specific personal data processing activity, you can request that by submitting a request at www.abb.com/privacy.

4. Why do we need and use your personal data?

We primarily process your personal data to fulfil and perform our recruitment processes with regards to the current and future job positions for which you apply. As part of the recruitment process, we need to process your personal data which are required by us to assess whether you are the right candidate for an open job position, to potentially enter into an employment relationship with you, to perform the contractual and legal obligations associated with the recruitment or which we are required by law to collect and process (mainly based on labor laws).

Without processing of certain of such personal data, ABB will generally not be able to perform your recruitment, establish and maintain an employment relationship with you or to take any contractual or legal action on your request. Where it concerns processing operations related to your recruitment, ABB will not be able to adequately perform such operation at your request without certain personal data and you may not be able to exercise your related rights if you do not provide the personal data requested. Your job application may also be rejected in case that the personal data you provided during the recruitment is incomplete and/or inaccurate.

We may use your personal data as listed above in particular for the following purposes:

  • talent management and acquisition including recruitment, assessing suitability and working capacity, background checks and verification of qualifications, obtaining and providing references;
  • processes related to joining and leaving including internal moves and terminations;
  • carrying out the obligations and exercising specific rights in the field of employment and social security law or a collective agreement;
  • internal health and safety programs including health and safety and accident records or reporting and managing process quality;
  • human resources management including organization and personal administration, working hours management, improving and maintaining effective staff administration, internal workforce analysis, reporting and planning;
  • managing IT resources, including infrastructure management including data back-up, information systems’ support and service operations for application management, end user support, testing, maintenance, security (incident response, risk, vulnerability, breach response), master data and workplace including user accounts management, software licenses assignment, security and performance testing and business continuity.

and additionally, in case of conclusion of an employment contract or defined claims deriving from the recruiting process, in particular:

  • payroll, compensation and benefits management including providing staff benefits and maintaining salary, compensations, allowances, benefits, insurances, pensions and performance reviews;
  • learning and development management including certifications, training staff and performing assessments and employee satisfaction surveys;
  • sickness and other leave and vacations management;
  • travel and expenses management and organization of business trips including monitoring of travelers to provide support during security or medical emergencies; providing travel security, health and safety training and on a voluntary basis assistance in giving security support during emergencies;
  • internal and external communication of ABB’s organization and representation of ABB;
  • managing ABB assets including pictures and videos depicting employees or other individuals available for download on the ABB intranet, ABB website, etc.;
  • reorganization, acquisition and sale of activities, business units and companies;
  • business reporting, statistics and analytics;
  • monitoring and auditing compliance of employees’ activities in the workplace with ABB’s corporate policies, contractual obligations and legal requirements including disciplinary actions;
  • governance, risk and compliance, including compliance with laws, law enforcement, court and regulatory bodies’ requirements (such as KYC, AML, customs and global trade compliance and security obligations) and prevention, detection, investigation and remediation of crime and fraud or prohibited activities or to otherwise protect legal rights and to establish, exercise or defend legal claims;
  • video surveillance or CCTV for the purposes of public and staff safety, building security and crime prevention and detection;
  • access control system providing electronically controlled ingress and/or egress for authorized individuals to locations that have access restrictions and a registry of personnel on site in case of emergencies; and
  • intrusion detection including 3rd party monitoring of duress, perimeter, internal security points and ancillary supervisory monitors for site maintenance/automated systems.

We only collect the personal data from you that we need for the above purposes described. The use of your personal data provided during your job application will be limited to a need-to-know basis and shared only with the employees and third parties that are directly involved in the recruitment processes for the specific position. Whenever you are asked to provide us with your personal data, we will indicate which personal data is required and which personal data may be provided voluntarily and on which legal basis such personal data is required to be processed.

For certain assessments or decision-making processes, we may use automated methods of processing your personal data to build a profile and to make a recruitment decision based on personal data that we have obtained as described in this Notice. If this is the case we will inform you about such processing of your personal data, giving you information about the involved logic and the possible consequences of such automated methods of processing. In general, the logic used to make this decision is based on the minimum requirements of the job description and if your experience and background is matching these requirements and the potential consequences of this automated decision making are that your application may be rejected in case your profile does not meet these requirements. In case we use automated methods, you have a right to obtain human intervention or to express your point of view and to contest the decision by submitting a data subject request at www.abb.com/privacy. You also have the right to object to profiling activities by submitting a data subject request or to withdraw a consent given by you to such processing at www.abb.com/privacy.

We may also anonymously collect your personal information so that we can no longer (in)directly identify you or single you out as an individual by that information and then use that information for further processing purposes, including statistical purposes, improvement of our services and testing of our IT systems.

5. On which legal basis do we process your personal data?

We process your personal data for the purposes described above (in section 4) in accordance with the provisions of the GDPR and the DSG, in particular according to the following legal bases, as applicable:

  • Primarily we process your personal data for the purpose of establishment, execution or termination of an employment relationship as well as for the enforcement of rights and fulfilment of obligations under your employment contract with us, the legal basis for such processing is 6 (1) b) GDPR.
  • Additionally, if we process your personal data (including special categories of personal data) for the purpose of exercising of rights or fulfilment of legal obligations derived from labour law, social security and social protection law, the legal basis for such data processing is 6 (1) c) and 9 (2) b), f) and h) GDPR).
  • If we process your personal data (including special categories of personal data) for purposes of health care, occupational medicine or assessment of your ability to work and such processing is done by health professionals or other persons subject to an obligation of professional secrecy, the legal basis is 9 (2) lit. h), (3) GDPR.
  • In some cases and where necessary, we process your personal data within the employment relationship in order to safeguard legitimate interests of us or third parties. This requires a weighing of interests pursuant to 6 (1) f) GDPR, according to which a processing of personal data is permissible if it is necessary to safeguard the legitimate interests and does not outweigh the interests or fundamental rights and freedoms of the data subject which require the protection of personal data. Such legitimate interests may include the:
    • monitoring (for example through CCTV or IT systems), investigating and ensuring compliance with legal, regulatory, standard and ABB internal requirements and policies;
    • prevention of fraud and criminal activity including investigations of such activity, misuse of ABB assets, products and services, and as strictly necessary and proportionate for ensuring network and information security;
    • if otherwise necessary for establishment, exercise and defense of legal claims of and against ABB related to your recruitment at ABB; and
    • transmitting personal data within the ABB group for internal administrative purposes as necessary, for example to provide centralized recruitment services.

You may obtain a copy of our assessment regarding our legitimate interest to process your personal data, including a documented balancing of interests, by submitting a request at www.abb.com/privacy.

  • In some cases and if we process your personal data on the basis of statutory requirements, for example, on the basis of tax or reporting obligations, cooperation obligations with authorities or statutory retention periods in order to carry out our contractual and legal responsibilities as an employer, the legal basis for such processing is 6 (1) c) GDPR);
  • In exceptional circumstances and if we process your personal data (including special categories of personal data) for purposes which are not covered by the aforementioned legal bases we may ask your consent in accordance with Art. 6 (1) a) and 9 (2) a) GDPR) as a legal basis for such data processing, for example if we want to keep and process your personal data for other or future job positions and recruitements, surveys related to the recruitment process or recruitment newsletters regarding future job positions. If and to the extent we send you electronic mail in this regard, we may also require your consent according to 107 (2) Austrian Telecommunication Act (Telekommunikationsgesetz – TKG). Your consent is always on a voluntary basis, so that you are not obliged to provide personal data for such purposes of processing. You can also withdraw your consent at any time in accordance with Art. 7 (3) GDPR without stating reasons with effect for the future. If we ask you for consent in order to use your personal data for a particular purpose, we will remind you that you are free to withdraw your consent at any time and we will tell you how you can do this.

With regard to personal data concerning criminal convictions and offences, we will only process such data where such processing is permitted by applicable (local) law.

6. Which parties do we share your personal data with (in and outside the EEA)?

We only share your personal data with other ABB affiliates or third parties as necessary for the purposes described in the table below. Where we share your personal data with an affiliate or third party so that it transfers to or becomes accessible from outside the European Union (“EU”) and European Economic Area ("EEA") or outside the country where your employer is located, we always put adequate safeguards in place to protect your personal data. Examples of these safeguards are an adequacy decision of the European Commission or Standard Contractual Clauses. We have taken additional measures for the transfer of data from within to outside the EU, EEA and outside the country where your employer is located to protect your personal data. If you would like an overview of the safeguards which are in place, please submit a request at www.abb.com/privacy.

Recipient name or category

Recipient location

Purpose

Safeguards in place to protect your personal data

ABB Ltd
(EU ABB affiliate)

CH, Zürich

Storing the personal data on our servers.

This affiliate is located in Switzerland, which is considered to provide adequate protection for personal data as per the EU Commission decision

ABB affiliate inside Europe

EU

Share your application with the affiliates that are directly involved in the recruitment process for the specific position and any future recruitment processes based on your consent. In case of employment contract conclusion, we need to share your data with entities responsible for creation of necessary accounts in our information systems, maintaining servers and systems used for storing and sharing employees personal data in scope of purposes described in this notice.

This affiliate is located in EU, where the GDPR directly applies and therefore considered to provide adequate protection for personal data

ABB affiliate outside Europe

Non-EU

This affiliate is within the ABB organization and the legal mechanism for the transfer are EU Model Clauses and Binding Corporate Rules when they become effective

Third parties inside EU (including ABB business partners and joint ventures with third parties, software providers, HR assessment providers, law firms and governmental agencies)

EU

Share your application with the third parties that are directly involved in the recruitment process for the specific position to carry out assessments, issue work permits, visas and other legally required documents.

In case of employment contract conclusion, we need to share your data with entities responsible for enabling you the access to ABB premises, providing mandatory notifications to governmental authorities arranging medical examination of prospective employees and conducting background check on our behalf.

This third party is located in EU, where the GDPR directly applies and therefore considered to provide adequate protection for personal data

Third parties outside EU (including ABB business partners and joint ventures with third parties, software providers, HR assessment providers, law firms and governmental agencies)

Non-EU

This third party is located outside EU, where the GDPR does not apply directly and which is not considered to provide adequate protection for personal data. Hence the legal mechanisms for the transfer are EU Model Clauses or their equivalent.

Potential or current acquirers of ABB businesses or assets

EU and non-EU

For evaluation of the business or assets in question

Where the potential or current acquirer is located outside EU, which is not considered to provide adequate protection for personal data, the legal mechanisms for the transfer are EU Model Clauses or their equivalent.

7. How long do we process and keep your personal data?

In principle, we process and store your personal data only as long as this is necessary for the processing purposes mentioned in this Notice, until you withdraw your consent (Art. 6 (1) a) GDPR) or until you object to the use of your personal data in case of a legitimate interest being the legal basis for processing (Art. 6 (1) f) GDPR).

However, based on mandatory legislation, ABB must keep certain personal data for a minimum period of time. For example, employment contracts, information about salary payments and reimbursements need to be kept for a minimum period based on local corporate and tax legislation. Furthermore, local anti-discrimination laws such as the Equal Treatment Act (Gleichbehandlungsgesetz) giving you concrete rights as to the recruitment process require us to keep your personal data for the time limit applicable to your rights to defend legal claims based on those local laws.

At the same time, applicable data protection laws require us not to keep and process your personal data in an identifiable form for any longer than is necessary for the purpose for which the personal data has been collected and to perform regular reviews in this respect.

In general, although there may be limited exceptions due to local legal requirements (such as tax or commercial law), your personal data will be processed for the following retention periods:

  • If and to the extent your job application has been rejected the recruitment process ends with the notification of rejection and your personal data will be processed and kept for a maximum of 6 months thereafter, unless you have given us your consent to consider you for further job positions and to process and keep your personal data for these purposes.
  • In case of a successful job application, the recruitment process ends with the conclusion of your employment contract and we will continue to process your personal data for the term of this contract and/or the retention periods specified in the employee privacy notice applicable to you and your working contract.
  • If and to the extent you have given us your consent to consider you for further job positions and to process and keep your personal data for these purposes, we will process and keep your personal data for a maximum retention period of 24 months after your last log-in to your account.

After the applicable retention period has lapsed, we will securely delete your personal data, unless there are specific circumstances that require us to keep such personal data, such as legal or regulatory obligations or to resolve potential disputes. Through the setting of IT applications and policies we ensure that your personal data is deleted when we no longer need it.

For more information regarding specific retention periods that apply to your personal data, please submit a request at www.abb.com/privacy.

8. Which data protection rights do you have with regards to your personal data?

You are entitled to certain data protection rights regarding your personal data, of which you find a summary in the table below.

Data protection rights

What it means

The right to access your data

You are entitled to ask ABB for an overview of or to obtain a copy of the personal data we hold about you.

The right to have your data corrected

You may request immediate correction of inaccurate or incomplete personal data we hold about you.

The right to have your data erased

You may request that personal data be erased when it is no longer needed, where applicable law obliges us to delete the data or the processing of it is unlawful.

The right to restrict data processing

You have the right to restrict the processing of your personal data in specific circumstances.

The right to data portability

You have the right to receive your personal data in a structured, machine-readable format for your own purposes, or to request us to transfer it to a third party.

The right to object to data processing

You have the right to object at any time, for reasons arising from your particular situation, to our processing of your personal data based on the legitimate interests.

The right to withdraw consent

Where ABB has asked for your consent to process personal data, you may withdraw your consent at any time.

Please note that the rights described above are not absolute, and that your request cannot always be met entirely. If you want to know more about your data protection rights as well as the conditions and restrictions under which they are available to you, you may want to refer to the Annex to this Notice.

You may request to enforce any of your data protection rights at www.abb.com/privacy.

9. Remedies, contact and further information

If you want to access your personal data, make use of any of your other rights mentioned above or if you have any questions or concerns about how ABB processes your personal data, please contact our Group Data Protection Officer at privacy@abb.com, or submit your complaint at www.abb.com/privacy.

Should you not be satisfied with our response or believe we are processing your personal data against the law, you have the right to file a complaint in accordance with Art. 77 GDPR with the competent Data Protection Authority in your country of residence or work, or seek a remedy through the courts where you believe an infringement of data protection laws (and your rights) may have taken place.

10. Join our Recruitment Newsletter

With your consent, we would like to use your name and email address to inform you about open job positions at ABB, specified to the country and area you are interested in. If you do no longer wish to receive such communication by email, you may withdraw your consent at any time with effect for the future by clicking on the „unsubscribe“ link integrated in the respective e-mail (newsletter) or completing the form at www.abb.com/privacy.

Date of publication: November 17, 2021

Annex to the Data Protection Notice: Your rights as a data subject

  • Right of access

You have the right to receive from us at any time upon request (text form) information about your personal data processed by us within the scope of Art. 15 GDPR.

This right is limited by the statutory exceptions of § 4 (6) DSG, according to which the right of access is excluded, in particular if the access to personal data and the provision of this information would endanger a business or company secret of the controller or third parties.

  • Right to rectification

You have the right, pursuant to Art. 16 GDPR, to obtain from us the immediate rectification of personal data concerning you, should it be incorrect.

This right is limited by the statutory exceptions of § 4 (2) DSG, according to which in case that the rectification of personal data processed by automated means cannot be carried out immediately because this is only possible at certain times for economic or technical reasons, the processing of the relevant personal data is to be restricted up to this point in time with effect pursuant to Art. 18 (2) GDPR.

  • Right to erasure

You have the right to obtain from us, under the conditions set out in Art. 17 GDPR, the deletion of any personal data relating to you.

These conditions apply in particular if a) the respective processing purpose has been achieved or otherwise ceases to apply, b) we have unlawfully processed your personal data, c) you have withdrawn your consent without another legal basis applying to the data processing, d) you have successfully objected to the data processing or e) in cases where there is an obligation to delete personal data on the basis of EU law or the law of an EU member state to which we are subject.

This right is limited by the statutory exceptions of § 4 (2) DSG, according to which in case that the rectification of personal data processed by automated means cannot be carried out immediately because this is only possible at certain times for economic or technical reasons, the processing of the relevant personal data is to be restricted up to this point in time with effect pursuant to Art. 18 (2) GDPR.

  • Right to restriction of processing

In accordance with Art. 18 GDPR, you can request us to process your personal data only to a restricted extent.

This right exists in particular if a) the correctness of your personal data is disputed, b) you request limited processing instead of deletion under the conditions of a justified right of erasure, c) the data is no longer required for the purposes pursued by us, but you need the data to assert, exercise or defend legal claims or d) the success of an objection is still disputed.

  • Right to data portability

In accordance with Art. 20 GDPR, you have the right to receive from us the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format, as well as the right to request us to forward this personal data to another controller.

  • Right to object

In accordance with Art. 21 GDPR, you have the right to object at any time, for reasons arising from your particular situation, to the processing of your personal data, which is either based on a public interest pursuant to Art. 6 (1) e) GDPR or a legitimate interest pursuant to Art. 6 (1) f) GDPR.

Upon receipt of your objection notice, we will then cease processing your personal data unless we can prove that there are compelling legitimate reasons for the processing which outweigh your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. If you object to the processing of your personal data for marketing purposes, we will cease such processing in any case.