PRIVACY NOTICE CONCERNING YOUR APPLICATION WITH BUCHERER

In this privacy notice we will inform you about how we process your personal data in relation to your application and about your rights.

1. Data controller and contact details

At Bucherer, we attach importance to the responsible management of your personal data. We continually update our rules so as to ensure the protection of your personal data in accordance with the data protection legislation in force at any given time.

The entity responsible for processing your personal data, depending on the job advertisement and/or the applicant’s place of residence, is the relevant Bucherer Group company:

Bucherer Switzerland: Bucherer AG, Langensandstrasse 27, CH-6005 Luzern

Bucherer Germany: Bucherer Deutschland GmbH, Ridlerstraße 57, D-80339 München

Bucherer Austria: Anton Haban Gesellschaft mbH, Kärntner Straße 2, A-1010 Wien

Bucherer France: Bucherer France S.A.S., 12, boulevard des Capucines, F-75009 Paris

Bucherer Denmark: Bucherer Denmark ApS, c/o Aagaard & Partnere Advokatanpartsselskab AUMENTO, Ny Østergade 3, DK-1101 København K

Bucherer Great Britain: Bucherer UK Limited, 8-9 Frith Street, GB-London W1D 3JB

hereinafter jointly referred to as ‘Bucherer Group’ or ‘Bucherer’, ‘we’, ‘us’, or ‘our’.

Some types of data processing are carried out by the Bucherer Group company together with the parent company of Bucherer AG based in Switzerland as joint controllers (see section 6), insofar as they jointly decide on the form or the purpose of the data processing operation in question.

If you have any questions regarding the processing of your personal data by us and the associated rights or any observations and suggestions, you can contact the relevant data protection contact person or data protection officer. The latter can be reached via email at data-privacy@bucherer.com or by post using the addresses provided above with the addendum ‘Data Privacy’.

You can also obtain the contact details and further information on the companies involved in data processing at https://www.bucherer.com/ch/en/imprint.html .

2. What kind of information do we ask you for? What kind of data concerning you is processed by us?

In order to examine your application, we require some personal information from you. This information is no different from the information usually collected during an application process. During the application process, apart from your title, name and surname, the usual details such as postal address, email address, telephone numbers, date of birth, your nationality, profile picture and interview records are processed by us. As your potential future employer, we are naturally also interested in your application documents such as motivation letters, your curriculum vitae, professional, educational, and training qualifications and certifications, job references which may also be collected and processed. For certain positions we may also conduct background checks. It goes without saying that any additional information contained in such documents is treated by us with the same degree of confidentiality as the other information submitted by you in order to submit you application. Please make sure that you do not provide us with any information or file attachments containing especially sensitive personal data, in particular information regarding your ethnic background, political, religious, or philosophical beliefs, membership of trade unions, health, and sexual orientation.

In the application process you will be directed to the landing page of our partner Ceridian. In this process, Ceridian is setting Cookies. This data will not be collected, shared, or processed within Bucherer. The Data stays with Ceridian, which has the obligatory to be complaint regarding data privacy and other regulations. Further information can be found in Ceridian's privacy policy.

3. For what purposes is your information used?

You want to reply to a job advertisement for Bucherer? The information and documents submitted by you via the indicated channel are primarily processed by the job offering Bucherer Group Company.

The primary purpose of processing your personal data described under section 2 above in the job application process is to assess and evaluate candidates for employment opportunities within our organization. This includes, but is not limited to, the recruitment, selection, and hiring processes. The information collected is essential for making informed decisions about the suitability of candidates for specific roles and responsibilities within the respective Bucherer Group company or the Bucherer Group if global roles are offered.

4. What is the statutory/legal basis for processing your personal data?

We process personal data in line with the applicable local privacy laws (e.g. the GDPR) and other relevant laws and regulations. The legal basis for the processing of data in the job application process is the initiation of contract negotiations or the management of contractual relationships or the safeguarding of the legitimate interests of Bucherer or third parties in selecting qualified and suitable candidates. If you provide your explicit consent for the processing of your personal data for specific purposes, this processing is deemed lawful based on the consent provided by you. Any consent given can be revoked at any time with effect for the future. Further, we may process your personal data if this is required in order to fulfil legal obligations or to defend against any legal claims asserted against us.

5. How and where is your data stored? How long is it stored and when is it deleted?

Your data is stored on behalf of Bucherer on a server run by our HCM software provider Ceridian. The server is located within Europe. Your data is protected at all times using appropriate organizational and technical security measures against accidental or deliberate manipulation, loss, destruction or access by unauthorized persons. All the security measures are adapted on an ongoing basis to incorporate the most recent technological developments. Your data is stored for as long as the application for the advertised post in question is ongoing or when it becomes clear that a vacancy will not be taken up. If you successfully conclude the application process, your information and data is retrieved from the system and transferred to your personnel file and stored there. All the information and documents relating to unsuccessful candidates for a job are erased after the application process has concluded at the very latest in accordance with the statutory retention periods. No announcement is issued regarding the erasure of data.

If you are interested in other job offers within Bucherer you can authorize us to store and process your data beyond the retention period corresponding to a specific application process. This enables us to consider your application to see whether it meets the requirements of another position (see your right of revocation for storage of your applicant details based on your consent under section 8 below).

6. Recruiting system and information on joint responsibility

In order to ensure the uniform availability of our recruiting and human capital management platform, Bucherer deploys group-wide, centrally managed systems. These systems are responsible for the uniform, group-wide management, maintenance, and processing of applicant data to the extent and for the purposes described in section 2 above.

Other Bucherer Group companies may gain access to the information stored therein, provided this is necessary for internal administrative purposes or applicant support or for the purpose of monitoring misuse.

The legal basis for such group-wide transfer of personal data generally resides in the safeguarding of the legitimate interests of Bucherer or a Bucherer Group company. Bucherer has a legitimate interest in processing such data in centralised systems so as to ensure coordinated and harmonized application and HR processes and to implement uniform technical and organisational security measures. Responsibility for the use of these systems by the companies listed in section 1 is shared with Bucherer AG. With this in mind, the companies in the Bucherer Group have concluded an agreement governing joint responsibility. The agreement essentially provides as follows:

Areas of responsibility: Responsibility for the operation and administration of the systems and management of the application data stored and for related privacy issues (e.g. requests from applicants for information and to delete data) primarily lies with Bucherer AG based in Switzerland (parent company). The collection and updating of data in the systems, e.g. during applicant registration, application process and communication with the applicant in this regard generally takes place through the respective Bucherer Group company, which are accordingly responsible in this respect. All the Bucherer Group companies process personal data in compliance with the relevant data protection provisions.
Data security: Bucherer AG with registered office in Switzerland (parent company) is primarily responsible, along with the relevant Bucherer Group companies (see section 1), for ensuring adequate levels of security of personal data when such data is processed in the centralised systems and for the underlying data protection principles (e.g. through rights management and access control, implementation of a deletion concept, privacy by design).
Duties to inform and report: Duties to inform are fulfilled by the corresponding Bucherer Group company (see section 1) in line with this Privacy Notice. Compliance with reporting duties in the event of a data protection incident is also the responsibility of the respective Bucherer Group company, with the understanding that all the companies strive to support each other as best they can and make available the necessary information in this respect.
Data subject rights / contact persons: Each company in the Bucherer Group is solely responsible for processing and responding to data protection requests and queries from their own applicants. This means that your point of contact in all matters concerning data protection is the relevant Bucherer Group company (see section 1). If you wish to exercise your data protection rights (e.g. requests for information or to delete data), you can contact the data protection contact person or data protection officer described in section 1. If required for the purpose of dealing with your request, the companies in the Bucherer Group will promptly share information and support one another and make available the necessary information when replying to requests for information and other requests.

If you have any further questions regarding the agreement governing joint responsibility, you can contact the relevant data protection contact person or data protection officer at any time (see section 1).

7. Who has access to your information and/or who will process this information?

Your data and documents can only be accessed by employees at the personnel services division, the potential future team members and by the persons at the Bucherer Group company or Bucherer with specific responsibility for such matters. Internal and external service providers may be engaged by the Bucherer Group company or Bucherer in connection with the process and evaluation of applications (such as recruiting software platform provider, external job assessment and recruitment provider). However, they only process your data on behalf of Bucherer in respect of which you have submitted your application, for the aforementioned purposes. Moreover, they are bound to maintain confidentiality by law and contractually.

8. Data processing in third countries

If we transfer your personal data to third countries outside Switzerland, the European Union (EU) or the European Economic Area (EAA), before the transfer takes place we will check, apart from the exceptions contemplated in the recipient country, whether there exists an adequate level of data protection or you have consented to the transfer of data. An adequate level of data protection is guaranteed for example by drafting EU standard contract clauses or the existence of what are known as Binding Corporate Rules (BCR). We transmit and process data within Europe and the USA.

9. Your rights

The rights listed in this section may be subject to certain exceptions or additional conditions in accordance with the (local) data protection laws in force.

Right to information: You can request information from us at any time about the personal data processed by us. The provision of information must respect the rights and freedoms of other persons who may be adversely affected by the transfer of data.

Right to rectification: You can request the rectification of inaccurate personal data or the completion of incomplete personal data stored by us.

Right to erasure: You can also request the erasure of the personal data stored by us, if the processing is not necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims.

Right to restriction of processing: You can request the restriction of the processing of your personal data. This applies in particular if you contest the accuracy of the personal data stored by us or if you have objected to processing. In this case we are obliged to restrict the processing of the data pending the examination of your concern.

Right to data portability: You have the right to receive the personal data provided to us in a structured, commonly used and machine-readable format or, where technically feasible, to request its transfer directly to another controller. This right to data portability only exists if the processing is based on your consent or on a contract and is carried out by automated means.

Right to object to data processing based on legitimate grounds: If we process your data to safeguard legitimate interests, you can object to the processing of your personal data on grounds relating to your particular situation at any time. If a legitimate objection is lodged we are obliged to stop processing your data unless we can demonstrate compelling legitimate grounds overriding your interests or if we are obliged process such data for the establishment, exercise or defence of legal claims. The right to object may be subject to limitations as set out in the applicable data protection laws.

Right to object to data processing for direct marketing: If we process your personal data for direct marketing purposes, you have the absolute right to object at any time to the processing of your data for such marketing. In such cases, there is no need to provide details relating to your particular situation. This also applies to any profiling, to the extent that it is related to such direct marketing. If you lodge an objection your data will no longer be processed for direct marketing purposes.

Right of revocation: If we process personal data on the basis of your consent, you also have the right to withdraw your consent at any time. The consequence of your revocation will be that we will no longer continue to process data based on your previous consent in the future. If you wish to withdraw your consent for the use of certain cookies, please take note of our explanations in the cookie guidelines.

If you wish to exercise your data protection rights, please contact the relevant data protection contact person or data protection officer. Their contact details can be found in section 1 of these provisions. Please note that depending on the applicable data protection laws, the exercise of the aforementioned rights may be framed differently or limited and/or subject to different conditions. In order to prove the identity of the person exercising your rights described in this section 8, Bucherer may request that an ID document be presented and process it accordingly.

10. Right of appeal

If you believe that the processing of your personal data by us violates your data protection rights, you have the right to lodge a complaint before a supervisory authority, specifically in the member state of your usual place of residence, your workplace or the location of the alleged violation. You can find an overview of all the European supervisory authorities by clicking here: https://www.bfdi.bund.de/DE/Service/Anschriften/Europa/Europa-node.html .

11. Who can you contact if you have problems with the online application process or questions concerning data processing in relation to your application?

If you have questions or problems with the online application process, feel free to contact the corresponding HR department of the Bucherer Group company indicated in the relevant job advertisement. It goes without saying that all queries will be handled with strict confidentiality.

English version December 2023