Employee Privacy Notice - Germany

• Personal details and identification data such as name, personal and business address, personal and business telephone number, personal and business email address or any other contact details, date and country of birth. 

• Personal data related to family, lifestyle and social circumstances such as gender, age, marital and family status (including also the name and contact details of the next of kin).  

• Employment related personal data such as employee number, signature, employment status, social security and tax numbers, insurance number, country of residence, nationality, photo, emergency contacts and passport information, work and residence permit, immigration status and travel visa information. 

• Qualifications such as qualifications and certifications including current and previous positions, education and training courses, resume/CV, records of education and work achievements, in some cases: contact details of referees and results of capability assessments and interview assessment/feedback. 

• Job information and work metrics such as position, title, employment contract, payroll ID, line manager, job band, performance history, employment status, leave of absence information, working time logging, training records, performance targets and development goals. In some cases, we may also record results of capability assessments, safety reports and incidents, professional feedback. 

• Compensation, allowances, benefits and expense related information such as salary data, payroll data, pension plan number and contributions, non-salary benefits, bonus, compensation, share options, dependents, beneficiaries or health benefit nomination, bank statements, expense claims and receipts, bank account details, credit card data, phone expenses and insurance data. 

• Electronic identification data and information (where employee has access or is affected by such systems or applications) such as access logs, IT and internet usage, device identifiers (mobile device ID, PC ID etc.), registration and login credentials, IP address, geolocation data, tracking and analytics data, recordings (e.g. CCTV footage, voice mail/call recordings), posts on corporate platforms (e.g. Yammer), password recovery data, information obtained via IT security tools. 

• Financial and other details (notably where it concerns staff members with access to or control of ABB financial business accounts) such as account information, credit checks, payment details and transactions (the latter for Know Your Customer ("KYC")/ Anti Money Laundering ("AML") monitoring purposes as explained further in this Notice), investigation information. 

• Other personal data (which may include special categories of information as mentioned below) namely where you or others (such as your colleagues) may register these data on or in our systems, programs and application such as business documents containing personal information (e.g. queries, questions, complaints, orders and related records; emails; reports; contracts; presentations, minutes; work products), photos, images and/or videos. 

• human resources management including organization and personal administration, working hours management, improving and maintaining effective staff administration, internal workforce analysis, reporting and planning; 

• staff transfer management from different affiliates and succession planning; 

• payroll, compensation and benefits management including providing staff benefits and maintaining salary, compensations, allowances, benefits, insurances, pensions and performance reviews; 

• talent management and acquisition including recruitment, assessing suitability and working capacity, background checks and verification of qualifications, obtaining and providing references; 

• learning and development management including certifications, training staff and performing assessments and employee satisfaction surveys; 

• processes related to joining and leaving including internal moves and terminations; 

• sickness and other leave and vacations management; 

• internal health and safety programs including health and safety and accident records or reporting and managing process quality; 

• travel and expenses management and organization of business trips including monitoring of travelers to provide support during security or medical emergencies; providing travel security, health and safety training and on a voluntary basis assistance in giving security support during emergencies; 

• carrying out the obligations and exercising specific rights in the field of employment and social security law or a collective agreement; 

• internal and external communication of ABB’s organization and representation of ABB; 

• organizing ABB events and documentation of such events including managing and organizing internal non-marketing related campaigns, events and meetings; 

• managing ABB assets including pictures and videos depicting employees or other individuals available for download on the ABB intranet, ABB website, etc.; 

• finance and shared accounting services providing record to report, order to cash and purchase to pay services; 

• reorganization, acquisition and sale of activities, business units and companies; 

• business reporting, statistics and analytics; 

• monitoring and auditing compliance of employees’ activities in the workplace with ABB’s corporate policies, contractual obligations and legal requirements including disciplinary actions; 

• carrying out audits, reviews and regulatory checks to meet obligations to regulators; 

• governance, risk and compliance, including compliance with laws, law enforcement, court and regulatory bodies’ requirements (such as KYC, AML, customs and global trade compliance and security obligations) and prevention, detection, investigation and remediation of crime and fraud or prohibited activities or to otherwise protect legal rights and to establish, exercise or defend legal claims; 

• managing the customer relationship, processing customer orders and providing customer support, processing, evaluating and responding to requests and inquiries;  

• managing the suppliers, contractors, advisers and other professional experts including contact interaction, processing and fulfilling purchases and invoices, and contract lifecycle management; 

• making use of work performance and products and for references on documents, such as drawings, purchase orders, sales orders, invoices, reports;  

• video surveillance or CCTV for the purposes of public and staff safety, building security and crime prevention and detection; 

• access control system providing electronically controlled ingress and/or egress for authorized individuals to locations that have access restrictions and a registry of personnel on site in case of emergencies; 

• intrusion detection including 3rd party monitoring of duress, perimeter, internal security points and ancillary supervisory monitors for site maintenance/automated systems; 

• maintaining and protecting the security of products, facilities, services, systems, networks, computers and information, preventing and detecting security threats, fraud or other criminal or malicious activities, and ensuring business continuity; and 

• managing IT resources, including infrastructure management including data back-up, information systems’ support and service operations for application management, end user support, testing, maintenance, security (incident response, risk, vulnerability, breach response), master data and workplace including user accounts management, software licenses assignment, security and performance testing and business continuity. 

• Primarily we process your personal data for the purpose of establishment, execution or termination of an employment relationship as well as for the enforcement of rights and fulfilment of obligations under your employment contract with us, the legal basis for such processing is § 26 (1) 1 BDSG (in conjunction with Art. 6 (1) b) GDPR). 

•  Additionally, if we process your personal data (including special categories of personal data) for the purpose of exercising of rights or fulfilment of legal obligations derived from labour law, social security and social protection law and you do not have an overriding legitimate interest in not processing the data, the legal basis for such data processing is § 26 (3) BDSG (in conjunction with Art. 6 (1) c) and 9 (2) b), f) and h) GDPR).  

• If we process your personal data (including special categories of personal data) for purposes of health care, occupational medicine or assessment of your ability to work and such processing is done by health professionals or other persons subject to an obligation of professional secrecy, the legal basis is § 22 (1) No. 1 b) BDSG (in conjunction with Art. 9 (2) lit. h) GDPR). 

• Insofar as an applicable collective agreement regulates the special processing of personal data of employees within the employment relationship (including special categories of personal data), this collective agreement is an additional legal basis for this data processing pursuant to § 26 (4) BDSG (in conjunction with Art. 88 GDPR). 

You may obtain a copy of the safeguards which we use to protect your personal data by submitting a request at www.abb.com/privacy.  

7. How long do we process and keep your personal data? 

In principle, we process and store your personal data only as long as this is necessary for the processing purposes mentioned in this Notice, until you withdraw your consent given in accordance with § 26 (2) BDSG or until you object to the use of your personal data in case of a legitimate interest being the legal basis for processing (Art. 6 (1) f) GDPR). 

However, based on mandatory legislation, ABB must keep certain personal data for a minimum period of time. For example, employment contracts, information about salary payments and reimbursements need to be kept for a minimum period based on local corporate and tax legislation.  

At the same time, applicable data protection laws require that we do not keep and process your personal data in an identifiable form for any longer than is necessary for the purpose for which the personal data has been collected and to perform regular reviews in this respect. Through the setting of IT applications and policies we ensure that your personal data is deleted when we no longer need it.  

The retention periods for the information that we hold can be found in our Directive Records Management GD/LI-44 (add link) or your local Directive Records. After an applicable retention period has lapsed, we will securely delete your personal data, unless there are specific circumstances that require us to keep such personal data, such as legal or regulatory obligations or to resolve potential disputes.  

For more information regarding specific retention periods that apply to your personal data, please submit a request at www.abb.com/privacy.  

ABB takes the security of its data very seriously, including your information and ABB's digital business assets. ABB sees this as a shared responsibility, where it takes the necessary steps to secure such data, and where it expects its staff members to do the same. You can read more about our security measures and your responsibilities [here/ End User Security Policy]. 

Monitoring of ABB's systems 

The use of corporate systems by employees, including telephone (mobile and fixed network) and computer systems (including e-mails and Internet access) is only permitted for business purposes at ABB and private use is therefore expressly prohibited. Information for personal use is collected, monitored and used for business purposes and to maintain IT security measures as required for the security of ABB systems and compliance with ABB Security Group Policy and applicable law. Therefore, your access data may be viewed by ABB when you log into ABB's IT and communications systems using passwords and user accounts for services. 

Monitoring will only be performed if and to the extent permitted or required by applicable law and justified for business purposes. The minimum storage periods set forth in Section 7 shall also apply to the resulting log files. This is necessary to detect attempted data misuse and other security incidents and to permit subsequent investigations and actions.  

Where permitted by applicable law and internal policies, disciplinary action may be taken. For this purpose, it may be necessary to transfer such personal data to the police or other law enforcement agencies. Investigations and the transfer of information to the relevant authorities will only take place in accordance with applicable law. 

CCTV 

As explained in this Notice, some ABB buildings and sites use CCTV video surveillance systems to monitor the indoor and outdoor areas of their corporate locations for security and operational purposes. We generally do not retain the footage for more than 14 days unless necessary, e.g. due to a security incident. In general collective agreements are concluded for the respective sites and regulate further details.  

9. Which data protection rights do you have with regards to your personal data? 

You are entitled to certain data protection rights regarding your personal data, of which you find a summary in the table below. 

If you want to access your personal data, make use of any of your other rights mentioned above or if you have any questions or concerns about how ABB processes your personal data, please contact your Data Protection Officer at privacy@abb.com, or submit your complaint at www.abb.com/privacy.  

Should you not be satisfied with our response or believe we are processing your personal data against the law, you have the right to file a complaint in accordance with Art. 77 GDPR with the competent Data Protection Authority in your country of residence or work, or seek a remedy through the courts where you believe an infringement of data protection laws (and your rights) may have taken place.  

Date of publication: August 23, 2019 

Annex to the Data Protection Notice: Your rights as a data subject 

1) Right of access 

You have the right to receive from us at any time upon request (text form) information about your personal data processed by us within the scope of Art. 15 GDPR.  

This right is limited by the statutory exceptions of § 34 BDSG, according to which the right of access is excluded, in particular if the data is stored on the basis statutory retention and documentation periods or for the purposes of data security and data protection control, the provision of information would require a disproportionate effort and a misuse of the data processing is prevented by suitable technical and organizational measures.

2) Right to rectification 

You have the right, pursuant to Art. 16 GDPR, to obtain from us the immediate rectification of personal data concerning you, should it be incorrect.

3) Right to erasure 

You have the right to obtain from us, under the conditions set out in Art. 17 GDPR, the deletion of any personal data relating to you.  

These conditions apply in particular if a) the respective processing purpose has been achieved or otherwise ceases to apply, b) we have unlawfully processed your personal data, c) you have withdrawn your consent without another legal basis applying to the data processing, d) you have successfully objected to the data processing or e) in cases where there is an obligation to delete personal data on the basis of EU law or the law of an EU member state to which we are subject.  

This right is limited by the statutory exceptions of § 35 BDSG, according to which the right to erasure may in particular be excluded if, in case of non-automated data processing, there is a disproportionately high expenditure for the deletion and your interest in the deletion is to be regarded as low. 

4) Right to restriction of processing 

In accordance with Art. 18 GDPR, you can request us to process your personal data only to a restricted extent.  

This right exists in particular if a) the correctness of your personal data is disputed, b) you request limited processing instead of deletion under the conditions of a justified right of erasure, c) the data is no longer required for the purposes pursued by us, but you need the data to assert, exercise or defend legal claims or d) the success of an objection is still disputed. 

5) Right to data portability 

In accordance with Art. 20 GDPR, you have the right to receive from us personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format, as well as the right to request us to forward this personal data to another controller. 

6) Right to object 

In accordance with Art. 21 GDPR, you have the right to object at any time, for reasons arising from your particular situation, to the processing of your personal data, which is either based on a public interest pursuant to Art. 6 (1) e) GDPR or a legitimate interest pursuant to Art. 6 (1) f) GDPR.  

Upon receipt of your objection notice, we will then cease processing your personal data unless we can prove that there are compelling legitimate reasons for the processing which outweigh your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. If you object to the processing of your personal data for marketing purposes, we will cease such processing in any case.