We take the protection of your personal data very seriously. That is why we process your personal data exclusively in compliance with the provisions of the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG), and all other relevant legislation; in particular, the Austrian Labour Constitution Act (ArbVG). Below, you'll find exact information about how we use your data when you apply for a position with us.

1.) Controller

woom GmbH
Muthgasse 109 A

1190 Vienna, Austria
Telefonnummer: +43 800 404 332
Email address: [email protected]

(Hereinafter referred to as "woom", "we" and "us")

Lukmann Consulting GmbH

Packerstraße 131 a, 8561 Söding, Österreich

Email: [email protected]

Telefonnummer: +49 7223 95 666 77

2.) Types of data processed, purposes and legal bases

2.1) Categories of processed data

The following types of data supplied personally by the applicant are processed:

• Master data (surname, form of address, email address, telephone number, street address, date of birth, citizenship)
• Qualification data (cover letter, letter of motivation, CV, previous employment, professional qualifications and skills)
• Optional information, such as application photo, severely disabled status or other information that you voluntarily provide to us in your application or upload voluntarily
• Additional position-specific information (e.g. driver's license, citizenship)
• Any communications between you and us, including any comments or reviews written about you as part of your application process
• Other data/data categories, such as publicly accessible, job-related data, e.g. profiles on professional social media networks such as XING or LinkedIn
• Special categories of personal data: If you provide information in your application documents that contains special categories of personal data as defined by Article 9 (1) GDPR (e.g. information that reveals your sexual orientation; information about your health; information that reveals your ethnic origin or religion), we will only process this data within legally established guidelines.

2.2) Contract fulfilment or pre-contractual measures (Art. 6 (1) (b) GDPR)We process this data for the purpose of managing your application and selecting personnel to fill vacancies; that is, in the context of initiating an employment contract. You are not required by law or contract to provide personal data, nor do you have any obligation to provide such personal data. However, the provision of personal data is necessary for the application process. This means that if you do not provide us with personal information when you apply, we will not be able to carry out the application process.

The scope of the data processed specifically depends on the position that is being filled.

2.3) Consent (Art. 6 (1) (a) GDPR)

If you provide us with relevant information and give your consent, we will also process data pertaining to your religious beliefs (in order to be able to process certain holiday entitlements), your union affiliation (in order to deduct your contributions) as part of the storage of your application documentation for a certain period of time (inclusion in the pool of applicants, storage beyond the current application process for consideration in subsequent application processes).

Insofar as we base our data processing on your consent, you have the right to withdraw your consent with immediate effect at any time without providing a reason. The withdrawal of consent can be sent by e-mail to [email protected]. The legality of processing your data until the time of withdrawal remains unaffected. Your consent is voluntary and may be withdrawn at any time without providing reasons.

2.4) Legitimate interest (Art. 6 (1) (f) GDPR)

In certain cases, we process your data to protect our or a third party's legitimate interest. A legitimate interest exists when your data is required for the assertion, exercise or defence of legal claims in the context of the application process (e.g. claims under the Austrian Equal Treatment Act) for instance. Should a legal dispute arise, we have a legitimate interest in processing the data for evidentiary purposes.

2.5) Feedback questionnaire

In order to optimise our application processes and improve as an employer, we give you the opportunity to provide your personal feedback. For this purpose, we will send you a feedback questionnaire to the email address you provided. If you voluntarily participate in the survey and fill out the questionnaire, processing of this data is based on our legitimate interests. For this purpose, our service provider Bamboo HR collects the feedback, position title as well as location and job category of the position applied for and, if applicable, the type of employment for which you have applied. This information is then transmitted to kununu GmbH and possibly to other verified evaluation platforms, where it is published anonymously. kununu cannot make any reference to your person. Please note, however, that third parties, such as your employer, may be able to identify you based on the information you provide in the published feedback.

3.) No automated decision making or profiling

You will not be subject to automated decisions with legal consequences for you or a similar significant adverse effect on you. Furthermore, we do not engage in any profiling activities.

4.) What happens if you do not complete your online profile?

If you break off the application process we will not store or process any data.

5.) External data recipients

We share your personal data with the following external service providers (data processors) where necessary:

Application Management and E-Recruiting Service Providers

Bamboo HR LLC.

42 Future Way, Draper, UT 84020, USA

• IT service providers and/or providers of services such as data hosting, data processing or similar services, including mobile phone operators;
• Other service providers and providers of software solutions and tools (e.g. newsletter sending services, survey tools, marketing service providers) that we commission to support us in providing our services.

All our commissioned data processors only ever process data on our behalf and on the basis of our instructions for providing the services specified above.

We also share personal data with the following recipients where necessary:

• Third parties we rely upon to fulfil our obligations to you (e.g. with banks for payroll accounting, with personnel administration providers, or with pension and employee benefit funds);
• Other external third parties as required, based on our legitimate interests (e.g. auditors, pension and employee benefit funds, insurance providers, legal representatives), and on a case-by-case basis with labour-market services, trade unions, other third parties involved in the fulfilment of the contract with the data subject or the provision of services by the data controller to the data subject and third parties otherwise involved in the employmentrelationship, e.g. travel agencies, online booking portals, event, trade fair and conference organisers, insurance companies, tax consultants, IT infrastructure operators, etc.).
• Courts, authorities and other government offices to the extent required by law (e.g. social insurance institutions, labour inspectors and job centres, tax authorities, apprenticeship offices and vocational schools, the Austrian Federal Ministry of Social Affairs, the Chamber of Labour, data protection authorities, etc.).

We may share employee information with third parties who acquire or to whom we transfer all or substantially all of the assets, shares and/or business of the company for which you work. If such a sale or transfer occurs, we will make a reasonable effort to ensure that the recipient of your employee data uses it in a manner consistent with this Privacy Policy.

If we process data in a third country outside of the European Union (EU) or the European Economic Area (EEA), or if your data is processed through the use of third-party services, it will only be to the extent required to fulfil our pre-contractual/contractual duties or legal obligations or on the basis of express consent or our legitimate interests. We have implemented appropriate and adequate safeguards to ensure that the transfer of data to the respective third country is carried out in conformity with data protection guidelines (e.g. adequacy decisions, binding corporate rules and agreement on standard privacy protection clauses). Upon request, we will send a copy of these safeguards if we are processing your data or having your data processed in a third country.

6.) Storage period

We only store data for as long as it is needed to fulfil its specific purpose.

Legal basis of the contractual relationship: Applicant data is deleted after seven months at the latest if the applicant is not hired into an employment relationship, unless the applicant has given separate consent to keep their data on file for a longer period (until then, it is kept for the purpose of defending against any claims under the Austrian Equal Treatment Act (GlBG)).

Legal basis of consent: If you have given your consent to retain records for a longer period of time (in the applicant pool), we will store your data for the period for which you have granted your consent.

Data may be stored for longer than specified if required to assert our legal rights or defend against legal claims. In that case, the data will be stored based on our legitimate interests as per Article 6 (1) (f) GDPR.

If you withdraw your application before completing the application process, i.e. delete your data and your account, the stored data will be blocked for the duration of the ongoing application process and deleted permanently six months after the conclusion of the application process. You can delete your candidate profile and your application documents yourself, request their deletion, or place limits on their processing at any time.

7.) Rights of data subjects

You have the right to receive information about how we process your personal data and about your rights as a data subject in a clear, transparent and easily understandable way (Article 13f GDPR). Furthermore, you have the right to receive information about how and to what extent your personal data is being processed (Article 15 GDPR). You have the right to ask for inaccurate personal data to be corrected, completed (Article 16 GDPR) or deleted without delay, insofar as the reasons specified in Article 17 (1) GDPR have been fulfilled.

You have the right to restrict the processing of your personal data provided that the reasons defined in Article 18 (1) GDPR are met, such that we may merely store but not use nor process this data. You also have the right to object to the processing of your personal data on the basis of an overriding legitimate interest (Article 21 GDPR). In addition, you have the right to receive the personal data that you have provided, in a structured, commonly-used and machine-readable format (Article 20 GDPR), and the right to withdraw your consent with immediate effect at any time without providing a reason (Article 7 GDPR).

7.1) Right to lodge a complaint

You have the right to lodge a complaint with the supervisory authority if you consider that the processing of your personal data violates data privacy regulations.

The responsible supervisory authority is:

Austrian Data Protection Authority
Barichgasse 40–42
1030 Vienna, Austria
Telephone number: +43 1 52 152-0
Email address: [email protected]

Before you lodge a complaint with the supervisory authority, or for any other questions relating to data protection, you can get in touch with us at any time using the contact details provided above under item 1.