V2 (022024)
BHI Biohealth International GmbH uses the onlyfy one service (by XING) to process job applications. This Privacy Policy will inform you about the processing of your data by the onlyfy one service and by BHI Biohealth International GmbH.
With regard to interaction within the company account of BHI Biohealth International GmbH, BHI Biohealth International GmbH and New Work SE have shared responsibility pursuant to Article 26 GDPR, as they jointly determine the purposes and means of processing pursuant to Article 4 (7) GDPR. The current version of the agreement on shared responsibility pursuant to Article 26 GDPR, which New Work SE concludes with companies that use onlyfy one, can be viewed here https://www.xing.com/terms/onlyfy-one to gain information on the key aspects of the agreement.
onlyfy one is part of the extensive XING service operated by New Work SE, which pursues the aim of improving and simplifying users’ working lives with a variety of applications (onlyfy one, as well as the XING social and jobs network, kununu, etc.), and creates a more fulfilling working world of work for individuals while boosting the performance of companies. As part of the extensive XING service, onlyfy one is an online platform on which or through which talent and companies meet.
With regard to data processing for which New Work SE is solely responsible or is responsible within the scope of the shared responsibility with BHI Biohealth International GmbH, detailed information is available in the XING Privacy Policy at https://privacy.xing.com/en/privacy-policy. You will also find contact details for New Work SE, as well as for the New Work SE data protection officer there.
When submitting an application, you enter into a user relationship with New Work SE for the purpose of processing applications. In addition, you will receive support and New Work SE can present you with other opportunities in support of your career. A public profile will not be automatically created for you on the XING social and jobs network. The legal basis for New Work SE processing your data is, in particular, Article 6 (1)(b) GDPR (processing necessary for the performance of a contract).
You can pause the creation of your online application at any time and continue at a later point. Cookies are used for this purpose. The data you provide to create the user account, as well as any uploaded documents, are recorded in the company account of BHI Biohealth International GmbH in onlyfy one. The data remains recorded even if an application is paused and/or not completed. In this case, your application is flagged as incomplete and the data remains visible to BHI Biohealth International GmbH only.
The data you have provided as part of the online application can be read, edited, or updated in your candidate profile at any time.
If the calendar function is used, your data is processed during and for the purpose of setting appointments within the application process. The legal basis is Article 6 (1)(f) GDPR. The calendar function is provided by an IT service provider (Cronofy Ltd., United Kingdom). The United Kingdom is classified as a secure third country based on the adequacy decision of the European Commission. Further information on data protection at Cronofy is available here: https://www.cronofy.com/gdpr/ and https://docs.cronofy.com/policies/privacy-notice/
If you use the apply using WhatsApp function, your consent, which can be withdrawn at any time, forms the legal basis for communication (Article 6 (1)(a) GDPR). When applying via WhatsApp, all required applicant information is requested during a WhatsApp chat. The data is then sent directly to onlyfy one through a service provider, and is processed further there as part of and for the purpose of the normal application process.
The apply via WhatsApp function is provided by an IT service provider (PitchYou) that can gain access to your data for this purpose. More information is available here: https://www.pitchyou.de/en/pitchyou-gdpr. Candidate data from apply via WhatsApp are transferred to onlyfy one via an interface. Immediately after this transfer, candidate data are deleted from the apply via WhatsApp infrastructure in PitchYou. Further processing then takes place exclusively in onlyfy one.
Please note that you use your personal WhatsApp account for applications, and therefore we cannot rule out that messages will be transferred, to the USA in particular. WhatsApp data protection information, such as its processing or exercising of data protection rights with regard to WhatsApp is available here: https://www.whatsapp.com/legal/privacy-policy-eea.
Subject to your consent, your application will be sent from WhatsApp via the PitchYou infrastructure to onlyfy one. You have the right to withdraw your consent to this at any time. Either way, your application data will be deleted from the PitchYou infrastructure once transferred to onlyfy one, meaning that PitchYou will not process your data any further.
The FADP applies to circumstances which have an impact on Switzerland, even if said circumstances are initiated outside of Switzerland. Correspondingly, this privacy policy applies to information in line with the EU GDPR and the FADP. Here, EU GDPR terminology is used in favour of FADP terminology. However, FADP terminology is used if the FADP applies and the terminology differs from EU GDPR terminology in a given language. The About this site section on XING contains the name and address of our representative in Switzerland.
The following provides information from BHI Biohealth International GmbH regarding data processing, for which BHI Biohealth International GmbH is solely responsible or responsible within the scope of shared responsibility with New Work SE.
Transparency and reliable handling of your personal data is a key basis for good collaboration. We therefore tell you how we process your data, and how you can protect your rights to which you are entitled pursuant to the General Data Protection Regulation (GDPR). The following information will give you an overview of the collection and processing of your personal data in relation to execution of the application process. Please read this Privacy Policy carefully before applying to us.
If there are any questions on data processing, please contact: noack@sbs-data.de
Pursuant to Article 4 (1) GDPR, personal data is any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
The following data and data categories are processed to execute the application process:
Your personal data is processed for the purposes of selecting people to fill open positions, i.e. to initiate an employment contract. The necessity and scope of the data collection is assessed according to factors such as the position to be filled. More extensive data collection may be required if the position you are applying for involves performing particularly confidential work that carries considerable personal and financial responsibility, or is linked to certain physical and health requirements. Your data can also be used to remind you to complete your application. The legal basis is Section 26 (1) Federal Data Protection Act (Bundesdatenschutzgesetz, “BDSG”).
If you have declared that you freely consent to the processing of specific personal data, then this consent shall form the legal basis for processing of this data.
In the following cases (may have to be adapted by the Customer) we process your personal data based on consent you have granted:
If we base data processing on your consent, you shall have the right to withdraw your consent at any time with effect for the future. The withdrawal should be sent by e-mail to noack@sbs-data.de. The lawfulness of processing your data up to withdrawal of consent shall remain unaffected.
In certain cases, we process your data to protect our legitimate interest or that of third parties. A legitimate interest shall exist, for example, if your data is required for the establishment, exercise or defence of legal claims as part of the application process (e.g. claims pursuant to the General Equal Treatment Act). In the event of a legal dispute, we have a legitimate interest in processing the data for evidence purposes.
To optimise our application processes and make improvements as an employer, we provide you with an option to submit your personal feedback. To facilitate this, we will send (with prior consent – to be adapted by the Customer) a feedback survey to the e-mail address you have supplied. If you participate in the survey, onlyfy one (see point 5 “To whom is your data disclosed?”) will record the feedback, job title, and location of the position, as well as the job category and, if necessary, the type of job for which you have applied. This information is then sent to kununu and any other verified assessment platforms, and published there without giving your name. However, please remember that others, for example your employer, may be able to identify you based on information you provide in the published feedback.
Your data is mainly processed by our HR department. However, internal and external offices are sometimes involved in processing your data.
Internal offices may include divisions, departments or the works council of our company.
We use New Work SE as an external service provider. New Work SE, Strandkai 1, 20457 Hamburg operates onlyfy one, the online platform on and through which we bring together talent and companies. More information on onlyfy one is set out above.
When you apply via onlyfy one, your personal data is recorded directly in onlyfy one. If you apply by post or e-mail, we may also transfer your data into onlyfy one.
We store your personal data for as long as we need it to make a decision regarding your application. Even if no employment contract is concluded between us, we may still retain data if it is required to defend against possible legal claims. Your data is normally erased within 6 months following the end of the application process for our company.
If no employment contract is concluded, but you have granted your consent to continued storage of your data (“applicant pool of BHI Biohealth International GmbH”), we store your data until your consent is withdrawn, but for no longer than 12 further months. If specific circumstances demand it, we can also store your data for a longer period for the purposes of defending against possible legal claims.
If you withdraw your application before the end of the application process, i.e. erase your data and account, the stored data is made unavailable for the remainder of the current application process, and is erased at the end of 6 months following the end of the application process for our company.
Unless you make further changes to your candidate profile, such as completing a current application, starting a new application, or amending the data in an existing application, your data will be erased within 6 months following the end of the last active application process for our company.
If you are no longer using your candidate profile and have not granted consent to a longer data storage period in our applicant pool, the data will be erased within 6 months following the end of the application process for our company.
You can create an erasure request for your candidate profile and application documents at any time. After the erasure request has been created, you will be informed of the exact erasure date, and your data will be erased according to the set terms of this Privacy Policy. (may have to be adapted by the Customer)
You can demand information on whether we have stored your personal data. If you wish, we can tell you which data this concerns, for what purpose the data is processed, to whom this data is disclosed, for how long the data is stored, and the other rights that you are entitled to in relation to this data.
Furthermore, you also have the right to rectification or erasure of your data. You can also demand that we give you or a person or company of your choice access, in a structured, commonly used, machine-readable format, to all personal data that you have provided to us.
You also have the right not to be subject to decision-making based solely on automated processing, including profiling, which produces legal effects concerning you. We do not use solely automated processing to help make decisions during the application process.
You also have the right to object at any time on grounds relating to your particular situation, to processing of personal data concerning you on the basis of Article 6 (1)(e) GDPR (data processing in the public interest) or Article 6 (1)(f) GDPR (data processing to protect a legitimate interest); this shall also apply to profiling based on this provision. In the event that you object, we shall no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or if the processing is required for the establishment, exercise or defence of legal claims.
Furthermore, you have the right to lodge a complaint with a supervisory authority for data protection.
To exercise your rights, you can send an e-mail to noack@sbs-data.de. We shall process your enquiries promptly and in accordance with legal requirements, and tell you which measures we have implemented or will implement.
The provision of personal data is neither legally nor contractually required, nor are you obliged to provide personal data. However, the provision of personal data is required for execution of the application process. This means that if you do not provide us with personal data in your application, we will not be able to perform the application process.
