We take the protection of your personal data very seriously. That is why we process your personal data exclusively in compliance with the provisions of the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG), and all other relevant legislation; in particular, the Austrian Labour Constitution Act (ArbVG). Below, you'll find exact information about how we use your data when you apply for a position with us.

1. Controller

woom GmbH
Inkustraße 1–7, Halle 14, Top 5, 3400 Klosterneuburg, Austria
Telephone number: +43 2243 23923
Email address: [email protected]

(Hereinafter referred to as "woom", "we" and "us")

No data protection officer has been appointed as there is no obligation to do so. However, Kristin Thomseth will be pleased to answer any questions you may have ([email protected]).

1. Types of data processed, purposes and legal bases
   1. Categories of processed data

The following types of data supplied personally by the applicant are processed:

• Master data (surname, form of address, email address, telephone number, street address, date of birth, citizenship)
• Qualification data (cover letter, letter of motivation, CV, previous employment, professional qualifications and skills)
• Optional information, such as application photo, severely disabled status or other information that you voluntarily provide to us in your application or upload voluntarily
• Additional position-specific information (e.g. driver's license, citizenship)
• Any communications between you and us, including any comments or reviews written about you as part of your application process
• Other data/data categories, such as publicly accessible, job-related data, e.g. profiles on professional social media networks such as XING or LinkedIn
• Special categories of personal data: If you provide information in your application documents that contains special categories of personal data as defined by Article 9 (1) GDPR (e.g. information that reveals your sexual orientation; information about your health; information that reveals your ethnic origin or religion), we will only process this data within legally established guidelines.

1. Contract fulfilment or pre-contractual measures (Art. 6 (1) (b) GDPR)

We process this data for the purpose of managing your application and selecting personnel to fill vacancies; that is, in the context of initiating an employment contract. You are not required by law or contract to provide personal data, nor do you have any obligation to provide such personal data. However, the provision of personal data is necessary for the application process. This means that if you do not provide us with personal information when you apply, we will not be able to carry out the application process.

The scope of the data processed specifically depends on the position that is being filled.

1. Consent (Art. 6 (1) (a) GDPR)

If you provide us with relevant information and give your consent, we will also process data pertaining to your religious beliefs (in order to be able to process certain holiday entitlements), your union affiliation (in order to deduct your contributions) and data related to COVID-19 (e.g. vaccination or recovery status) as part of the storage of your application documentation for a certain period of time (inclusion in the pool of applicants, storage beyond the current application process for consideration in subsequent application processes).

Insofar as we base our data processing on your consent, you have the right to withdraw your consent with immediate effect at any time without providing a reason. The withdrawal of consent can be sent by e-mail to [email protected]. The legality of processing your data until the time of withdrawal remains unaffected. Your consent is voluntary and may be withdrawn at any time without providing reasons.

1. Legitimate interest (Art. 6 (1) (f) GDPR)

In certain cases, we process your data to protect our or a third party's legitimate interest. A legitimate interest exists when your data is required for the assertion, exercise or defence of legal claims in the context of the application process (e.g. claims under the Austrian Equal Treatment Act) for instance. Should a legal dispute arise, we have a legitimate interest in processing the data for evidentiary purposes.

In addition, an automated workflow is in place to remind applicants if the application process has not been completed. If this happens, you will receive a reminder at the email address you provided in the application process. This is done based on the legitimate interest of keeping the application process up to date and completing it if necessary.

1. Feedback questionnaire

In order to optimise our application processes and improve as an employer, we give you the opportunity to provide your personal feedback. For this purpose, we will send you a feedback questionnaire to the email address you provided. If you voluntarily participate in the survey and fill out the questionnaire, processing of this data is based on our legitimate interests. For this purpose, our service provider Prescreen (see item 4) collects the feedback, position title as well as location and job category of the position applied for and, if applicable, the type of employment for which you have applied. This information is then transmitted to kununu GmbH and possibly to other verified evaluation platforms, where it is published anonymously. kununu cannot make any reference to your person. Please note, however, that third parties, such as your employer, may be able to identify you based on the information you provide in the published feedback.

1. No automated decision making or profiling

You will not be subject to automated decisions with legal consequences for you or a similar significant adverse effect on you. Furthermore, we do not engage in any profiling activities.

1. What happens if you do not complete your online profile?

You can break off the online application process at any time and resume it at a later time. For this purpose, the platform uses technically necessary cookies. During the application process, data is transferred to jobbase.io; that is, data that you provide to create your user account and uploaded documents are collected at jobbase.io. The data is saved, even if you interrupt and/or do not complete your application. If this is the case, your application will be marked as incomplete and our company will have limited access to the data.

You can view, edit or update the data you entered in your candidate profile during the online application process at any time.

If you do not make any further changes to your candidate profile, that is if, for instance, you complete a current application, start a new application, or change the information in an existing application, your data will be deleted within six months of the end of the last active application process.

You can request the deletion of your candidate profile and your application documents at any time. Once you have made the deletion request, you will be informed of the exact deletion date and your data will be automatically deleted according to the terms and conditions set forth in this Privacy Policy.

1. External data recipients

We share your personal data with the following external service providers (data processors) where necessary:

• Applicant management and e-recruiting service providers (e.g. Prescreen International GmbH, Mariahilfer Straße 17, 1060 Vienna);
• IT service providers and/or providers of services such as data hosting, data processing or similar services, including mobile phone operators;
• Other service providers and providers of software solutions and tools (e.g. newsletter sending services, survey tools, marketing service providers) that we commission to support us in providing our services.

All our commissioned data processors only ever process data on our behalf and on the basis of our instructions for providing the services specified above.

We also share personal data with the following recipients where necessary:

• Third parties we rely upon to fulfil our obligations to you (e.g. with banks for payroll accounting, with personnel administration providers, or with pension and employee benefit funds);
• Other external third parties as required, based on our legitimate interests (e.g. auditors, pension and employee benefit funds, insurance providers, legal representatives), and on a case-by-case basis with labour-market services, trade unions, other third parties involved in the fulfilment of the contract with the data subject or the provision of services by the data controller to the data subject and third parties otherwise involved in the employmentrelationship, e.g. travel agencies, online booking portals, event, trade fair and conference organisers, insurance companies, tax consultants, IT infrastructure operators, etc.).
• Courts, authorities and other government offices to the extent required by law (e.g. social insurance institutions, labour inspectors and job centres, tax authorities, apprenticeship offices and vocational schools, the Austrian Federal Ministry of Social Affairs, the Chamber of Labour, data protection authorities, etc.).

We may share employee information with third parties who acquire or to whom we transfer all or substantially all of the assets, shares and/or business of the company for which you work. If such a sale or transfer occurs, we will make a reasonable effort to ensure that the recipient of your employee data uses it in a manner consistent with this Privacy Policy.

If we process data in a third country outside of the European Union (EU) or the European Economic Area (EEA), or if your data is processed through the use of third-party services, it will only be to the extent required to fulfil our pre-contractual/contractual duties or legal obligations or on the basis of express consent or our legitimate interests. We have implemented appropriate and adequate safeguards to ensure that the transfer of data to the respective third country is carried out in conformity with data protection guidelines (e.g. adequacy decisions, binding corporate rules and agreement on standard privacy protection clauses). Upon request, we will send a copy of these safeguards if we are processing your data or having your data processed in a third country.

1. Storage period

We only store data for as long as it is needed to fulfil its specific purpose.

Legal basis of the contractual relationship: Applicant data is deleted after seven months at the latest if the applicant is not hired into an employment relationship, unless the applicant has given separate consent to keep their data on file for a longer period (until then, it is kept for the purpose of defending against any claims under the Austrian Equal Treatment Act (GlBG)).

Legal basis of consent: If you have given your consent to retain records for a longer period of time (in the applicant pool), we will store your data for the period for which you have granted your consent.

Data may be stored for longer than specified if required to assert our legal rights or defend against legal claims. In that case, the data will be stored based on our legitimate interests as per Article 6 (1) (f) GDPR.

If you withdraw your application before completing the application process, i.e. delete your data and your account, the stored data will be blocked for the duration of the ongoing application process and deleted permanently six months after the conclusion of the application process. You can delete your candidate profile and your application documents yourself, request their deletion, or place limits on their processing at any time.

1. Rights of data subjects

You have the right to receive information about how we process your personal data and about your rights as a data subject in a clear, transparent and easily understandable way (Article 13f GDPR). Furthermore, you have the right to receive information about how and to what extent your personal data is being processed (Article 15 GDPR). You have the right to ask for inaccurate personal data to be corrected, completed (Article 16 GDPR) or deleted without delay, insofar as the reasons specified in Article 17 (1) GDPR have been fulfilled.

You have the right to restrict the processing of your personal data provided that the reasons defined in Article 18 (1) GDPR are met, such that we may merely store but not use nor process this data. You also have the right to object to the processing of your personal data on the basis of an overriding legitimate interest (Article 21 GDPR). In addition, you have the right to receive the personal data that you have provided, in a structured, commonly-used and machine-readable format (Article 20 GDPR), and the right to withdraw your consent with immediate effect at any time without providing a reason (Article 7 GDPR).

1. Right to lodge a complaint

You have the right to lodge a complaint with the supervisory authority if you consider that the processing of your personal data violates data privacy regulations.

The responsible supervisory authority is:

Austrian Data Protection Authority
Barichgasse 40–42
1030 Vienna, Austria
Telephone number: +43 1 52 152-0
Email address: [email protected]

Before you lodge a complaint with the supervisory authority, or for any other questions relating to data protection, you can get in touch with us at any time using the contact details provided above under item 1.

1. Prescreen privacy policy

The data processing described below is not the responsibility of woom GmbH, but of Prescreen International GmbH, Mariahilfer Straße 17, 1060 Wien ("Prescreen"). Please address any questions regarding data protection to Prescreen at [email protected].

a) Automated collection of user data

When accessing the domain jobbase.io, your internet browser automatically sends certain usage data for technical reasons. This information is stored separately from other data in so-called log files. In the process, Prescreen collects the following information:

• Date, time and duration of access
• Browser type/version
• Operating system used
• URL of the previously visited web page
• Volume of data sent
• GeoIP lookup based on the Internet Protocol address (IP address)
• Name of the retrieved files
• Http status code (e.g. "request successful")
• URL of the accessed web page
• Access type (GET, POST)

This data is technically necessary to provide the functions of the e-recruiting system and to ensure the stability and security of the system. Prescreen stores it for a period of 12 months. Data that must be stored longer for evidentiary purposes is exempt from deletion until the corresponding matter has been definitively settled.

The legal basis for the processing of this data is Art. 6 (1) (f) GDPR.

b) Cookies

Prescreen uses cookies. They make the online application more user-friendly and effective. The cookies are technically necessary to provide this website to you. Without cookies, the operation of the website would not be possible. Therefore, there is no option of objecting to the use of cookies.

The legal basis for the processing of this data is Art. 6 (1) (f) GDPR. The following cookies are used by Prescreen:

Provider	Cookie	Purpose	Duration of storage
Prescreen	PHPSESSID	This cookie is used to identify users while they are using Prescreen. The cookie is mandatory for correct functionality. The cookie becomes invalid when the browser is closed.	Until the browser window is closed (session cookie).
Prescreen	REMEMBERME	This cookie is used to recover an expired session. The cookie is mandatory for correct functionality.	The cookie becomes invalid after 2 weeks.

Information accurate as of: February 2022