1. Introduction
This Recruitment Privacy Notice ("Notice") applies to the ABB Group of companies, which means ABB Asea Brown Boveri Ltd, Switzerland and each entity in which ABB Asea Brown Boveri Ltd, Switzerland, directly or indirectly, has a majority holding or owns or controls the majority of voting rights. The ABB company that is offering the job position that you are applying to (referred to as "ABB") is responsible for the processing of your personal data in accordance with this Notice. This Notice explains why and how we collect and process personal data about you in the course of your recruitment process and what rights you have regarding your personal data. The information contained in this Notice will be applicable to you until you actually join ABB and conclude an employment contract with us, in which case the Employee Privacy Notice will apply.
2. Who is responsible for the processing of your personal data?
ABB Asea Brown Boveri Ltd and its subsidiary companies are responsible for your personal data insofar as they receive and process your personal data as part of your recruitment process (hereinafter together with the recruitment process referred to as “recruitment”). For applicable privacy and data protection laws, the primary controller of your data is the ABB subsidiary company which is offering the job position that you are applying to.
In your case, ABB AG, Kallstadter Straße 1, 68309 Mannheim, Germany, or any respective company affiliated with ABB AG pursuant to §§ 15 ff. of the German Stock Corporation Act (Aktiengesetz - AktG), to which your application is addressed, decides as "controller" within the meaning of the EU General Data Protection Regulation (“GDPR”) and the Federal Data Protection Act (“Bundesdatenschutzgesetz - BDSG”) how and for which purpose your personal data will be used in accordance with this Notice (hereinafter: “ABB”, "we" or "us").
You can contact our data protection officer as follows:
ABB AG
Konzerndatenschutzbeauftragter
Kallstadter Str. 1
68309 Mannheim
privacy@abb.com
3. Which of your personal data do we collect and use?
We collect and use personal data that we receive from you in the course of or in connection with your recruitment at ABB, primarily via ABB’s career portal. In addition, and to the extent necessary for the purposes mentioned in this Notice, we process personal data which we may obtain from publicly accessible sources, such as employment- and business-orientated social networking services and career fairs, or which are legitimately transmitted by other third parties, such as background check providers, recruitment agencies through which you have applied for a job and other administration services providers.
We may use the following categories of your personal data, as applicable and necessary for the purposes of processing under this Notice:
- Personal details and identification data such as name, gender, age, citizenship, date and country of birth, marital and family status, personal and business address, personal and business telephone number, personal and business email address or any other contact details you choose to disclose to us as part of your job application.
- Skill and experience detailssuch as qualifications and certifications including current and previous positions, education and training courses, resume/CV, education records and work achievements. In some cases: contact details of referees and results of capability assessments and interview assessment/feedback and any other personal information you choose to disclose to us as part of your job application.
- Depending on the position, we are performing internal/external assessments, where we collect additional data such as assessment performance data, assessment score, phone interview recordings/notes, video interview recordings/notes.
- Employment related personal data of successful candidates only necessary for the employment contract conclusion and onboarding process such as photos, signature, passport information, country of residence, nationality, work and residence permit, immigration status and travel visa information, employee number, employment status, the applicable personal identity numbers (social security, insurance, tax or driving license numbers or possibly other type of individual number applicable for you), insurance data, bank account details, data of your related persons (name of spouse/partner, children, etc.), emergency contacts, training records, clothing and shoe size where necessary.
- Other personal data (which may include special categories of information as mentioned below) namely where you may register these data on or in our systems, programs and applications for recruitment containing personal information (e.g. queries, questions, complaints, emails, contracts, presentations, work products), photos, images and/or videos.
The below mentioned types of personal data are only collected and processed during the onboarding process, if at all, in accordance with applicable local laws, but we only do so when required by the local law or where this is necessary to secure legal requirements of equal opportunity and treatment for all candidates and employees in ABB. Respectively, any such personal data will not be processed, if such processing is prohibited according to applicable provisions of national law.
- Special categories of personal data such as:
- membership of religious congregations (e.g. if required for tax purposes);
- health and medical information, including disability status, special working conditions (such as use of a standing desk) and medical devices needed on the premises, work related injury and illness information, data for travel emergency support (blood type, medical history, allergies);
- race or ethnicity (e.g. where this is used for diversity purposes);
- in exceptional cases: trade union membership.
- If we run a background check on you as a part of the recruitment process, we will only process such data in accordance with applicable law. Data about criminal convictions and offences such as criminal background information and sanction list information will only be processed to the extent required for the purposes of criminal background screening and KYC and AML or other legal obligations, which are directly related to the specific position you are applying for.
In case you would like to be provided with information about a specific personal data processing activity, you can request that by submitting a request at www.abb.com/privacy.
4. Why do we need and use your personal data?
We primarily process your personal data to fulfil and perform our recruitment processes with regards to the job positions for which you apply. As part of the recruitment process, we need to process your personal data which are required by us to assess whether you are the right candidate for an open job position, to potentially enter into an employment relationship with you, to perform the contractual and legal obligations associated with the recruitment or which we are required by law to collect and process (mainly based on labor laws).
Without processing of certain personal data, ABB will generally not be able to perform your recruitment, establish and maintain an employment relationship with you or to take any contractual or legal action on your request. Where it concerns processing operations related to your recruitment, ABB will not be able to adequately perform such operation at your request without certain personal data and you may not be able to exercise your related rights if you do not provide the personal data requested. Your job application may also be rejected in case that the personal data you provided during the recruitment is incomplete and/or inaccurate.
We may use your personal data as listed above in particular for the following purposes:
- talent management and acquisition including recruitment, assessing suitability and working capacity, background checks and verification of qualifications, obtaining and providing references in order to confirm that you meet internal and legal requirements relevant to the position;
- assessment of your job application for potential future recruitment possibilities within ABB and information on suitable job positions on the basis of your consent;
- onboarding processes related to joining ABB and the conclusion of an employment relationship with you, which includes all steps necessary to fulfill obligations resulting from the employment contract and applicable legal provisions such the creation and signing of the employment contract and other employment documentation, including notifications to governmental authorities, as well as the provision of all employment related services such as necessary accounts in our information systems, ID cards to access the ABB premises, work uniforms, personal protection equipment, training and information required for the position you will be recruited for;
- carrying out the obligations and exercising specific rights in the field of employment and social security law or a collective agreement;
- human resources management including organization and personal administration, working hours management, improving and maintaining effective staff administration, internal workforce analysis, reporting and planning;
- managing IT resources, including infrastructure management including data back-up, information systems’ support and service operations for application management, end user support, testing, maintenance, security (incident response, risk, vulnerability, breach response), master data and workplace including user accounts management, software licenses assignment, security and performance testing and business continuity.
- governance, risk and compliance, including compliance with laws, law enforcement, court and regulatory bodies’ requirements (such as KYC, AML, customs and global trade compliance and security obligations) and prevention, detection, investigation and remediation of crime and fraud or prohibited activities or to otherwise protect legal rights and to establish, exercise or defend legal claims;
- video surveillance or CCTV for the purposes of public and staff safety, building security and crime prevention and detection;
- access control system providing electronically controlled ingress and/or egress for authorized individuals to locations that have access restrictions and a registry of personnel on site in case of emergencies.
We only collect the personal data from you for the above purposes described. The use of your personal data provided during your job application will be limited to a need-to-know basis and shared only with the employees and third parties that are directly involved in the recruitment processes for the specific position. Whenever you are asked to provide us with your personal data, we will indicate which personal data is required and which personal data may be provided voluntarily and on which legal basis such personal data is required to be processed.
For certain assessments and evaluations in the hiring decision-making processes, we may additionally use automated methods of processing your personal data to build a profile and to make a recruitment decision based on personal data that we have obtained as described in this Notice. If this is the case, we will inform you about such processing of your personal data, giving you information about the involved logic and the possible consequences of such automated methods of processing. In general, the logic used is based on the minimum requirements of the job description and if your experience and background is matching these requirements and the potential consequences of this automated processing are that your application may be rejected in case your profile does not meet these requirements. In case we solely use automated methods for decisions in the hiring process, you have a right to obtain human intervention or to express your point of view and to contest the decision by submitting a data subject request at www.abb.com/privacy. You also have the right to object to profiling activities by submitting a data subject request or to withdraw a consent given by you to such processing at www.abb.com/privacy.
We may also anonymously collect your personal information so that we can no longer (in)directly identify you or single you out as an individual by that information and then use that information for further processing purposes, including statistical purposes, improvement of our services and testing of our IT systems.
5. On which legal basis do we process your personal data?
We process your personal data for the purposes described above (in section 4) in accordance with the provisions of the EU General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG), in particular according to the following legal bases, as applicable:
- Primarily we process your personal data for the purpose of establishment, execution or termination of an employment relationship as well as for the enforcement of rights and fulfilment of obligations under your (future) employment contract with us, the legal basis for such processing is 26 (1) 1 BDSG (in conjunction with Art. 6 (1) b) GDPR).
- Additionally, if we process your personal data (including special categories of personal data) for the purpose of exercising of rights or fulfilment of legal obligations derived from labour law, social security and social protection law and you do not have an overriding legitimate interest in not processing the data, the legal basis for such data processing is 26 (3) BDSG (in conjunction with Art. 6 (1) c) and 9 (2) b), f) and h) GDPR).
- If we process your personal data (including special categories of personal data) for purposes of health care, occupational medicine or assessment of your ability to work and such processing is done by health professionals or other persons subject to an obligation of professional secrecy, the legal basis is 22 (1) No. 1 b) BDSG (in conjunction with Art. 9 (2) lit. h) GDPR).
- Insofar as an applicable collective agreement regulates the special processing of personal data of employees within the employment relationship (including special categories of personal data), this collective agreement is an additional legal basis for this data processing pursuant to 26 (4) BDSG (in conjunction with Art. 88 GDPR).
- In some cases and where necessary, we process your personal data within the employment relationship in order to safeguard legitimate interests of us or third parties. This requires a weighing of interests pursuant to 6 (1) f) GDPR, according to which a processing of personal data is permissible if it is necessary to safeguard the legitimate interests and does not outweigh the interests or fundamental rights and freedoms of the data subject which require the protection of personal data. Such legitimate interests may include the:
- monitoring (for example through CCTV or IT systems), investigating and ensuring compliance with legal, regulatory, standard and ABB internal requirements and policies;
- prevention of fraud and criminal activity including investigations of such activity, misuse of ABB assets, products and services, and as strictly necessary and proportionate for ensuring network and information security;
- if otherwise necessary for establishment, exercise and defense of legal claims of and against ABB related to your recruitment at ABB; and
- transmitting personal data within the ABB group for internal administrative purposes as necessary, for example to provide centralized recruitment services.
You may obtain a copy of our assessment regarding our legitimate interest to process your personal data, including a documented balancing of interests, by submitting a request at www.abb.com/privacy.
- In some cases and if we process your personal data on the basis of statutory requirements, for example, on the basis of tax or reporting obligations, cooperation obligations with authorities or statutory retention periods in order to carry out our contractual and legal responsibilities as an employer, the legal basis for such processing is 6 (1) c) GDPR);
- In exceptional circumstances and if we process your personal data (including special categories of personal data) for purposes which are not covered by the aforementioned legal bases we may ask your consent in accordance with § 26 (2) BDSG (in conjunction with Art. 6 (1) a) and 9 (2) a) GDPR) as a legal basis for such data processing, for example if we want to keep and process your personal data for other or future job positions and recruitements, surveys related to the recruitment process or recruitment newsletters regarding future job positions. If and to the extent we send you electronic mail in this regard, we may also require your consent according to 7 (2) No. 3 Competition Act (Gesetz gegen den unlauteren Wettbewerb - UWG). Your consent is always on a voluntary basis, so that you are not obliged to provide personal data for such purposes of processing. You can also withdraw your consent at any time in accordance with Art. 7 (3) GDPR without stating reasons with effect for the future. If we ask you for consent in order to use your personal data for a particular purpose, we will remind you that you are free to withdraw your consent at any time and we will tell you how you can do this.
With regard to personal data concerning criminal convictions and offences, we will only process such data where such processing is permitted by applicable (local) law.
6. Which parties do we share your personal data with (in and outside the EEA)?
We only share your personal data with employees and third parties that are directly involved in the recruitment process, especially in the country where the job position for which you have applied is located or in countries that are directly involved in the relevant recruitment process. As part of a global group, we have business relationships with ABB Group companies and external service providers, both within and outside the European Economic Area (EEA), which we may also use to process your personal data as necessary for the purposes described in this Notice. We only share your personal data with other ABB affiliates or third parties as necessary for the purposes described in the table below. In addition, when processing your personal data for these purposes through the use of external service providers as data processors (e.g. computer centers, software companies, etc.) these data processors are engaged within the framework of an existing contractual relationship, bound by instructions, and receive your personal data only to the extent and for the period required for the provision of the service.
Where we share your personal data with an affiliate or third party outside the European Economic Area ("EEA"), we always put adequate safeguards in place to protect your personal data. Examples of these safeguards are an adequacy decision of the European Commission (read more here), Standard Contractual Clauses (read more here) and the Binding Corporate Rules that some of our suppliers have adopted (read more here). We have taken additional measures for the transfer of data outside the EEA to protect your personal data. If you would like an overview of the safeguards which are in place, please submit a request at www.abb.com/privacy.
|
Recipient name or category
|
Recipient location
|
Purpose
|
Safeguards in place to protect your personal data
|
|
ABB Ltd
(EU ABB affiliate)
|
CH, Zürich
|
Storing the personal data on our servers.
|
This affiliate is located in Switzerland, which is considered to provide adequate protection for personal data as per the EU Commission decision (read more here)
|
|
ABB affiliate inside Europe
|
EU
|
Share your application with the affiliates that are directly involved in the recruitment process for the specific position and any future recruitment processes based on your consent. In case of employment contract conclusion, we need to share your data with entities responsible for creation of necessary accounts in our information systems, maintaining servers and systems used for storing and sharing employees personal data in scope of purposes described in this notice.
|
This affiliate is located in EU, where the GDPR directly applies and therefore considered to provide adequate protection for personal data
|
|
ABB affiliate outside Europe
|
Non-EU
|
This affiliate is within the ABB organization and the legal mechanism for the transfer are EU Model Clauses and Binding Corporate Rules when they become effective
|
|
Third parties inside EU (including ABB business partners and joint ventures with third parties, software providers, HR assessment providers, law firms and governmental agencies)
|
EU
|
Share your application with the third parties that are directly involved in the recruitment process for the specific position to carry out assessments, issue work permits, visas and other legally required documents.
In case of employment contract conclusion, we need to share your data with entities responsible for enabling you the access to ABB premises, providing mandatory notifications to governmental authorities arranging medical examination of prospective employees and conducting background check on our behalf.
|
This third party is located in EU, where the GDPR directly applies and therefore considered to provide adequate protection for personal data
|
|
Third parties outside EU (including ABB business partners and joint ventures with third parties, software providers, HR assessment providers, law firms and governmental agencies)
|
Non-EU
|
This third party is located outside EU, where the GDPR does not apply directly and which is not considered to provide adequate protection for personal data. Hence the legal mechanisms for the transfer are EU Model Clauses or their equivalent.
|
|
Potential or current acquirers of ABB businesses or assets
|
EU and non-EU
|
For evaluation of the business or assets in question
|
Where the potential or current acquirer is located outside EU, which is not considered to provide adequate protection for personal data, the legal mechanisms for the transfer are EU Model Clauses or their equivalent.
|
7. How long do we process and keep your personal data?
In principle, we process and store your personal data only as long as this is necessary for the processing purposes mentioned in this Notice, until you withdraw your consent given in accordance with § 26 (2) BDSG or until you object to the use of your personal data in case of a legitimate interest being the legal basis for processing (Art. 6 (1) f) GDPR). In accordance with applicable data protection laws, we ensure through regular reviews that personal data is not stored and processed in an identifiable form for any longer than is necessary for the purpose for which such personal data has been collected.
However, based on mandatory legislation, ABB must keep certain personal data for a minimum period of time, even if you have withdrawn your consent or exercised your objection rights. For example, employment contracts, information about salary payments and reimbursements need to be kept for a minimum period based on local corporate and tax legislation. Furthermore, local anti-discrimination laws such as the General Equal Treatment Act (Allgemeines Gleichbehandlungsgesetz) require us to keep your personal data for the time limit applicable to your rights based on those local laws to defend such legal claims.
In general, although there may be limited exceptions due to local legal requirements (such as tax or commercial law), your personal data will be processed for the following retention periods:
- If and to the extent your job application has been rejected the recruitment process ends with the notification of rejection and your personal data will be processed and kept for a maximum of 6 months thereafter, unless you have given us your consent to keep and continue the processing of your personal data.
- In case of a successful job application, the recruitment process ends with the conclusion of your employment contract and we will continue to process your personal data for the term of this contract and/or the retention periods specified in the employee privacy notice applicable to you and your working contract.
- If and to the extent you have given us your consent to consider you for further job positions and to process and keep your personal data for these purposes, we will process and keep your personal data for a maximum retention period of 24 months after your last log-in to your account.
After the applicable retention period has lapsed, we will securely delete or anonymize your personal data, unless there are specific circumstances that require us to keep such personal data, such as legal or regulatory obligations or to resolve potential disputes. Through the setting of IT applications and internal policies we ensure that your personal data is deleted when we no longer need it.
For more information regarding specific retention periods that apply to your personal data, please submit a request at www.abb.com/privacy.
8. Which data protection rights do you have with regards to your personal data?
As a data subject in terms of the GDPR, you are entitled to certain data protection rights regarding the processing of your personal data by us, which we have described in detail in the Annex to the Notice "Your rights as a data subject”.
Please note that the rights described above are not absolute, and that your request cannot always be met entirely. If you want to know more about your data protection rights as well as the conditions and restrictions under which they are available to you, you may want to refer to the Annex to this Notice.
You may request to enforce any of your data protection rights at www.abb.com/privacy.
9. Remedies, contact and further information
If you want to access your personal data, make use of any of your other rights mentioned above or if you have any questions or concerns about how ABB processes your personal data, please contact our Data Protection Officer at privacy@abb.com, or submit your complaint at www.abb.com/privacy.
Should you not be satisfied with our response or believe we are processing your personal data against the law, you have the right to file a complaint in accordance with Art. 77 GDPR with the competent Data Protection Authority in your country of residence or work, or seek a remedy through the courts where you believe an infringement of data protection laws (and your rights) may have taken place.
Date of publication: February 09, 2021
Annex to the Data Protection Notice: Your rights as a data subject
1. Right of access
You have the right to receive from us at any time upon request (text form) information about your personal data processed by us within the scope of Art. 15 GDPR.
This right is limited by the statutory exceptions of § 34 BDSG, according to which the right of access is excluded, in particular if the data is stored on the basis statutory retention and documentation periods or for the purposes of data security and data protection control, the provision of information would require a disproportionate effort and a misuse of the data processing is prevented by suitable technical and organizational measures.
2. Right to rectification
You have the right, pursuant to Art. 16 GDPR, to obtain from us the immediate rectification of personal data concerning you, should it be incorrect.
3. Right to erasure
You have the right to obtain from us, under the conditions set out in Art. 17 GDPR, the deletion of any personal data relating to you.
These conditions apply in particular if a) the respective processing purpose has been achieved or otherwise ceases to apply, b) we have unlawfully processed your personal data, c) you have withdrawn your consent without another legal basis applying to the data processing, d) you have successfully objected to the data processing or e) in cases where there is an obligation to delete personal data on the basis of EU law or the law of an EU member state to which we are subject.
This right is limited by the statutory exceptions of § 35 BDSG, according to which the right to erasure may in particular be excluded if, in case of non-automated data processing, there is a disproportionately high expenditure for the deletion and your interest in the deletion is to be regarded as low.
4. Right to restriction of processing
In accordance with Art. 18 GDPR, you can request us to process your personal data only to a restricted extent.
This right exists in particular if a) the correctness of your personal data is disputed, b) you request limited processing instead of deletion under the conditions of a justified right of erasure, c) the data is no longer required for the purposes pursued by us, but you need the data to assert, exercise or defend legal claims or d) the success of an objection is still disputed.
5. Right to data portability
In accordance with Art. 20 GDPR, you have the right to receive from us personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format, as well as the right to request us to forward this personal data to another controller.
6. Right to object
In accordance with Art. 21 GDPR, you have the right to object at any time, for reasons arising from your particular situation, to the processing of your personal data, which is either based on a public interest pursuant to Art. 6 (1) e) GDPR or a legitimate interest pursuant to Art. 6 (1) f) GDPR.
Upon receipt of your objection notice, we will then cease processing your personal data unless we can prove that there are compelling legitimate reasons for the processing which outweigh your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. If you object to the processing of your personal data for marketing purposes, we will cease such processing in any case.