Privacy Notice for Candidates

This privacy notice explains how Avania controls and processes your personal information including what we collect, why we collect it, how it is used and your choices regarding your personal information. Where you apply for a position with Avania UK Ltd, references to the GDPR in this notice also include the UK GDPR.

Purpose of the data processing

We process your personal data for the purpose of reviewing and processing your application.

Legal basis

We process your personal data for recruitment and selection purposes to assess whether we can conclude an employment contract with you (Art. 6(1)(b) GDPR).

We may also process personal data to prevent fraud and to establish, exercise or defend legal claims. To prevent identity fraud and candidate misrepresentation, we ask all applicants to provide their full legal name and use it to verify their identity and the information provided in the application. Such processing is carried out based on our legitimate interests in ensuring a lawful and secure recruitment process (Art. 6(1)(f) GDPR) and, where required, to comply with applicable legal obligations (Art. 6(1)(c) GDPR).

Where you have separately consented to being included in our talent pool, we process your personal data in order to consider you for future job opportunities for a period of up to two years after completion of the recruitment process. You may withdraw your consent at any time with effect for the future (Art. 6(1)(a) GDPR).

Categories of personal data

As a rule, we process personal data that you provide to us directly in the course of your application, in particular through your application documents and during interviews.

This may include:

• your full legal name and contact details (such as address, email address and phone number);
• your date of birth;
• your educational and professional background;
• information contained in your CV, cover letter or other documents you submit; and
• information generated during the recruitment and selection process.

For certain positions, additional information may be required where this is necessary and legally permissible. Depending on the role, this may include:

• References or assessments from previous employers, where relevant for the position and where permitted by applicable law; you will be informed in advance if references are requested.
• Health-related information, only where you voluntarily provide such information and where it is necessary for recruitment-related purposes (e.g. to assess your ability to perform the role or to provide appropriate workplace accommodations), and only to the extent permitted by law.
• Identification and right-to-work information, such as a copy of an identity document, where required by law.
• Feedback provided by you in relation to the recruitment process or our organisation.

Background checks, including checks relating to criminal convictions, are only carried out for positions in the United States and in accordance with applicable US law. They are not carried out for positions in the European Economic Area or the United Kingdom.

Recipients

Your personal data is processed internally by employees involved in the recruitment and hiring process (e.g. human resources and relevant hiring managers).

We also use external IT and cloud service providers to support our recruitment processes and IT infrastructure. These service providers process personal data on our behalf as data processors and are contractually bound to confidentiality and data protection obligations in accordance with applicable law.

Our application pages are protected by Google reCAPTCHA, a service provided by Google. reCAPTCHA checks whether an entry is made by a person or by an automated program. For this purpose, it evaluates information such as your IP address, browser and device information and how you interact with the page, and transmits this information to Google. This data may be transferred to Google LLC in the United States, which is certified under the EU-U.S. Data Privacy Framework. We use reCAPTCHA based on our legitimate interest in protecting our application process against misuse and spam (Art. 6(1)(f) GDPR).

Some of our IT and cloud service providers, or their affiliated companies or sub-processors, are located in countries outside the European Union, including the United States. Where personal data is transferred to such third countries, appropriate safeguards are in place, in particular the EU-U.S. Data Privacy Framework where the recipient is certified under it (Art. 45 GDPR) or the EU Standard Contractual Clauses pursuant to Art. 46 GDPR, and, where required, additional technical and organisational measures. For transfers from the United Kingdom, the UK Extension to the EU-U.S. Data Privacy Framework or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses apply accordingly.

In addition, personal data may be shared with companies within our corporate group, where this is necessary for recruitment and hiring purposes.

In individual cases, personal data may also be disclosed to external legal advisors or the external data protection officer where this is necessary to comply with legal obligations or to establish, exercise or defend legal claims.

Source of the data

We obtain this information directly from you as well as from third parties such as recruitment agencies or former employers and, for positions in the United States, background checking companies. We may also obtain it from your public profiles available online.

Retention period

We will store your personal data for as long as they are required for the above-mentioned purposes and for as long as legal retention periods require.

If your application is unsuccessful and you have not consented to inclusion in our talent pool, your personal data will generally be deleted or anonymized 3 months after completion of the recruitment process.

If you consent to inclusion in our talent pool, we will retain your application data for up to two years from the end of the recruitment process in order to consider you for future vacancies. After this period, your data will be deleted unless you renew your consent.

Your rights as a data subject

As a data subject you are entitled to the following rights, provided that the legal requirements are fulfilled:

• Right of access, Art. 15 GDPR
• Right to rectification, Art. 16 GDPR
• Right to erasure, Art. 17 GDPR
• Right to restriction of processing, Art. 18 GDPR
• Right to data portability, Art. 20 GDPR
• Right to object, Art. 21 GDPR

If the processing is based on your consent, you have the right to revoke this consent to process the data at any time in whole or in part with effect for the future.

You also have the right to lodge a complaint with the data protection supervisory authority regarding the data processing.

Provision of data

You provide us with your data voluntarily. In order for us to be able to check your application and suitability, however, the disclosure of some data is essential. If you do not wish to provide us with the required data, we will unfortunately not be able to consider your application.

Controller

Avania B.V. and affiliates (a list of group companies can be found at https://www.avaniaclinical.com/privacy-policy/), Prof. Bronkhorstlaan 10, Bld. 54, 3723 MB Bilthoven NL; email: legal@avaniaclinical.com

The controller responsible for your application is the Avania company that has advertised the position you are applying for.

Data Protection Officer for Avania’s European entities:

fox-on Datenschutz GmbH, Pollerhofstr. 33a, 51789 Lindlar, Germany. Email: dpo@fox-on.com