CICC Deutschland GmbH – Privacy Notice for Job Applicants

As part of any recruitment process, CICC Deutschland GmbH (Address: Neue Mainzer Straße 52-58, 60311 Frankfurt am Main, Telephone: +49 69 24437 3560, Email for general queries: info@ciccde.com, Email for Legal and Compliance Department: compliance@ciccuk.com, Email for data protection queries: DataProtection@ciccuk.com) (“the Company”, “us”, or “we”) collects and processes personal data relating to job applicants. The Company is committed to being transparent about how it collects and processes that data and to meeting its data protection obligations, in particular under the EU General Data Protection Regulation ("GDPR") and the German Federal Data Protection Act ("FDPA").

What information does the Company collect?

The Company collects and processes the following personal data about you ("Applicant Data"):

• your name, address and contact details, including email address and telephone number;
• your nationality;
• details of your qualifications, skills, experience, education and employment history;
• information about your entitlement to work in the respective job location (if applicable) and if voluntary provided in addition the following personal data ("Additional Applicant Data);
• your date of birth, photo, emergency contact person and their contact number;
• information about your current level of remuneration.

It is not anticipated to process special categories of personal data, however, if you provide the Company with special categories of personal data, such as health data, the Company will also process such data.   

The Company collects this information in a variety of ways. For example, data might be contained in application forms or CVs, or collected through interviews, or from public sources.

Data will be stored on your application record and in other IT systems (including the Company’s email system).

Why does the Company process personal data?

The Company needs to process data which is necessary for hiring decision pursuant to Art. 88 GDPR and Section 26 para. 1, sentence 1 FDPA.

In some cases, the Company needs to process data to ensure that it is complying with its legal obligations pursuant to Art. 6 (1) lit. c GDPR in connection with Art. 88 GDPR and Section 26 FDPA, in particular in the area of labor and employment law, social security and tax law. For example, to check a successful applicant's eligibility to work in certain locations before employment starts.

In other cases, the Company has a legitimate interest in processing personal data during the recruitment process and for keeping records of the process pursuant to Art. 6 (1) lit. f GDPR. The legitimate interests of the Company is that processing data from job applicants allows the Company to manage the recruitment process, assess and confirm a candidate's suitability for employment and decide to whom to offer a job. The Company may also need to process data from job applicants to respond to and defend against legal claims pursuant to Art. 6 (1) lit. f GDPR. More information on the balancing of interest test is available on request.

The Company processes health information for employment-related purposes if the processing is necessary to exercise rights or to comply with legal obligations derived from labour law, social security and social protection law, and there is no reason to believe that the data subject has an overriding legitimate interest in not processing the data (Art. 88 GDPR, section 26 para. 3 FDPA).

For some roles, the organisation will seek information about criminal convictions and offences. Where the Company seeks this information, it does so because it is necessary for the particular position of the employee.

If your application is unsuccessful, the Company will keep your personal data on file in case there are future employment opportunities for which you may be suited, to the extent you have consented pursuant to Art. 6 lit. a GDPR to such further storage and use of your application.

Who has access to data?

Your information will be shared internally in the Company on a need-to-know-basis for the purposes of the recruitment process. This includes members of the HR team, interviewers involved in the recruitment process, managers/secretaries in the business area with a vacancy and IT or staff from other functions if access to the data is necessary for the proper performance of their roles and based on Sec. 26 para. 1 sentence 1 FDPA. The company may share your information within CICC Groups of Companies (include any "subsidiary" or "associate" of China International Capital Corporation Limited), on a need to know basis to the extent necessary for the particular position and/or due to the organisational structure/set-up of the Company, e.g. in case the interviewer and/or HR team is located at a group company of the Company, based on Sec. 26 para. 1 sentence 1 FDPA.

The Company may share your data with third parties, before or after your application for employment is successful and it makes you an offer of employment to the extent permitted by applicable law based on the Company's legitimate interests pursuant to Art. 6 (1) lit. f GDPR. More information on the balancing of interest test is available on request.

Your data may be transferred outside the European Economic Area (EEA) to CICC Group’s head office in China, and other regional overseas offices including Hong Kong, Singapore, the US and UK and service providers based outside of EEA. Data is transferred outside the EEA on the basis of a binding data processing agreement and corporate policies and procedures or other safeguards as the circumstances may require. You may request a copy of the applicable safeguards by contacting the Legal and Compliance Department at compliance@ciccuk.com.

How does the Company protect data?

The Company takes the security of your data seriously. It has internal policies and controls in place to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by its employees in the proper performance of their duties.

The Company has implemented appropriate technical and organisational measures to ensure a level of security appropriate to the risk of harm that might result from, unauthorised or unlawful processing accidental or unlawful loss, destruction or alteration, unauthorised (or disclosure of) access or damage to your personal data including:

Security systems;

Usernames and passwords;

Virus checking;

Auditing procedures and data integrity checks

The Company has put in place procedures to deal with any suspected personal data breach and will notify you and any applicable supervisory authority where we are legally required to do so.

If you suspect any misuse or loss of or unauthorised access to your personal data, please let us know immediately by contacting us.

For how long does the Company keep data?

Your personal data is stored by the Company and/or our service providers, strictly to the extent necessary for the performance of our obligations and strictly for the time necessary to achieve the purposes for which the information is collected, in accordance with applicable data protection laws. If you applied, but we rejected your application, we will store your personal data for six months. After six months your personal data will be deleted, unless your personal data may be kept longer, e.g. due to an emerging lawsuit to exercise or defend our claims. If we want to add you to our applicant pool, we will ask for your consent to do so in our rejection mail. In such case your personal data will be stored for one year for the purpose of re-evaluation and other vacancies at the Company and based on your consent. After one year your personal data will be deleted.

If your application for employment is successful, relevant personal data gathered during the recruitment process will be transferred to your personnel file and retained during your employment. The periods for which your data will be held will be provided to you in a new privacy notice.

Your rights

If you have declared your consent regarding certain types of processing activities, you can withdraw this consent at any time with future effect. Such a withdrawal will not affect the lawfulness of the processing prior to the consent withdrawal.

As a data subject pursuant to applicable data protection law, you may have a number of rights. You may have the following rights:

• Right of access: You may have the right to obtain from us confirmation as to whether or not personal data concerning you is processed, and, where that is the case, to request access to the personal data. The access information includes – inter alia – the purposes of the processing, the categories of personal data concerned, and the recipients or categories of recipients to whom the personal data have been or will be disclosed. However, this is not an absolute right and the interests of other individuals may restrict your right of access. You may have the right to obtain a copy of the personal data undergoing processing. For further copies requested by you, we may charge a reasonable fee based on administrative costs;
• Right to rectification: You may have the right to obtain from us the rectification of inaccurate personal data concerning you. Depending on the purposes of the processing, you may have the right to have incomplete personal data completed, including by means of providing a supplementary statement;
• Right to erasure: Under certain circumstances, you may have the right to obtain from us the erasure of personal data concerning you and we may be obliged to erase such personal data;
• Right to restriction of processing: Under certain circumstances, you may have the right to obtain from us restriction of processing your personal data. In this case, the respective data will be marked and may only be processed by us for certain purposes;
• Right to data portability: Under certain circumstances, you may have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and you may have the right to transmit those data to another entity without hindrance from us; and
• Under certain circumstances, you may have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data by us and we can be required to no longer process your personal data.  

If you would like to exercise any of these rights, please contact Human Resources Department and Legal and Compliance Department of CICC available at DataProtection@ciccuk.com .

The Company will respond to all legitimate requests without undue delay and in any event within one moth of receipt of your request. In exceptional cases, it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you, advice on the reasons for the delay, give you further information and keep you updated.

If you think your data protection rights have been breached in any way by us, you have the right to lodge a complaint about the Company's processing of your data with a supervisory authority, in particular in your country of residence, place of work or place of the alleged infringement.

What if you do not provide personal data?

You are under no statutory or contractual obligation to provide data to the Company during the recruitment process. However, if you do not provide the Applicant Data, the Company may not be able to process your application properly or at all. If your application is successful, it may be a condition of any job offer that you provide evidence of your right to work in Germany

You are under no obligation to provide the Additional Applicant Data and there are no consequences for your application if you choose not to provide such information.