Privacy Policy - Hong Kong

DATA PROTECTION INFORMATION FOR CANDIDATES

Data protection information for candidates

Preliminary note

With the following information, we would like to provide you with an overview of how your personal data is processed by us, as well as your rights under data protection law.

This data protection information describes all data processing procedures carried out by DEKRA SE and its Group companies via the DEKRA candidate portal.

Who is responsible for data processing, and whom can I contact?

The data controller deemed responsible for the processing of your personal data in connection with your visit to this website and the creation of a candidate profile via the DEKRA candidate portal under data protection law is

DEKRA SE

with its registered office in Stuttgart,

and registered in the commercial register

of the Stuttgart District Court under HRB 734316,

Handwerkstr. 15, 70565 Stuttgart, Germany

If you apply to one of our Group companies, it will act as an independent controller for the subsequent application process. Please refer to the further information in the respective job advertisement and on our website.

If you create a candidate profile independently of an application and do not make your profile visible, DEKRA SE is the controller.

If you make your candidate profile visible to recruiters from participating Group companies worldwide or nationally, i.e. in the country/region of your place of residence, the following Group companies act as joint controllers for processing in connection with your candidate profile outside of a specific application, depending on your selection:

DEKRA CERTIFICATION HONG KONG LIMITED UNIT 1305 13/f SHATIN GALLERIA, 18-24 SHAN MET STREET, FOTAN, NT, HONG KONG

DEKRA SE Handwerkstr. 15, 70565 Stuttgart, Germany konzerndatenschutz@dekra.com

For any general questions and queries regarding the collection and processing of your personal data, please contact dataprotection.esa@dekra.com.

Should you have any questions about your rights as a data subject or would like to exercise these rights, please contact the data protection officer of the relevant DEKRA company via the contact address provided.

What data sources do we use?

We process personal data for the purpose of enabling the use of the DEKRA candidate portal, and for carrying out selection procedures to establish an employment relationship:

which has been received directly from you as part of the candidate process, or the creation of your account and candidate profile,
which we have permissibly collected from public sources or from third parties;
or which has been disclosed to us, for example, by public authorities, insurance providers, pension funds, credit institutions, educational and training institutions, other external service providers or by third parties you have named as references.

Relevant personal data may include: Personal information (e.g. title, last name, first name), contact information (e.g. e-mail address, postal address, telephone number), information about your career (e.g. curriculum vitae), information about your qualifications (e.g. certificates), documentation data (e.g. interview notes) and other data comparable to the categories mentioned.

What do we process your data for (purpose of processing), and on what legal basis?

We process your personal data in accordance with the provisions of all applicable data protection laws.

A. For the purpose of the technical provision of the website

Insofar as you visit our website, it is necessary for the purpose of the website’s technical provision (and ensuring the requisite system security) that we process certain information automatically transmitted by your browser so that our website can be displayed in your browser and you can use the website. This information is automatically collected each time our website is accessed and automatically stored in so-called server log files; this information essentially comprises:

IP address of the requesting computer
Host name of the accessing computer
Recognition data of the browser and operating system used
Date and time of access
Website from which the access is made (referrer URL)

Our legitimate interest in this regard is that we can make our website and our candidate portal technically available to you.

LEGAL BASIS

Art. 6 (1) lit. f GDPR and relevant law/regulation in Hong Kong

B. For the purpose of creating a user account and candidate profile

In the event that you create a user account in our candidate portal, we process your personal data for the purpose of creating and managing the user account for the DEKRA candidate portal. Insofar as you create a candidate profile within your user account and provide us with information about your career and qualifications, we process your personal data for the purpose of enabling the creation and management of your candidate profile.

This primarily comprises personal information, address data, communication data, access data (e-mail address, password), as well as data pertaining to your professional experience and qualifications.

LEGAL BASIS

Art. 6 (1) lit. b GDPR and relevant law/regulation in Hong Kong

C. For the purpose of communication

For the purpose of communicating with you, we process personal data, in order to respond to your inquiries or to communicate with you in the context of job recruitment procedures, and to send you pre-contractual documents.

This may include, in particular, your first name, last name, home address, e-mail address, telephone number and, if applicable, contract data.

Our legitimate interest here is to be able to stay in touch and communicate with you in the context of inquiries and vacancy procedures. This is to ensure smooth preparation of job placements and support of interested parties.

LEGAL BASIS

Art. 6 (1) lit. a, b and f GDPR and relevant law/regulation in Hong Kong

For any processing relating to the provision of consent, the legal basis is Art. 6 (1) lit. f GDPR, whereby our legitimate interest is to defend ourselves against possible legal claims. You can withdraw any consent given at any time with effect for the future in any appropriate form.

D. For the purpose of inclusion in an candidates pool

In the event that you provide us with your consent to store your personal data for the purpose of worldwide or nationwide matching with future job profiles in the context of selection procedures for possible employment, we will process your personal data in accordance with your selection for the purpose of notifying you by e-mail about jobs that match the requirements and qualifications you have indicated.

This may include, in particular, your personal information (title, last name, first name), address data (street, house number, postal code, city), contact data (private e-mail address, social media profiles), the preferred language of communication, candidate documents (cover letter, resume, references, salary requirements, notice period, possible start date), individual responses (how did the candidates become aware of the position, is the candidates of legal age, willing to relocate), previous activities, language skills and interests.

LEGAL BASIS

Art. 6 (1) lit. a GDPR and relevant law/regulation in Hong Kong

E. For the purpose of conducting a selection process for possible employment

In the event that you apply for a specific position or have given us your consent to store your candidate data in our candidates pool for suitable positions in the future, we process your personal data in the context of job filling procedures for the purpose of conducting a selection process for possible employment. For this purpose, your personal data will be transferred to the DEKRA company that has advertised the vacancy.

This may include, in particular, your first name, last name, address, country, e-mail address, telephone number, work experience, qualifications, references and language skills.

LEGAL BASIS

Art. 6 (1) lit. a and b GDPR and relevant law/regulation in Hong Kong

F. For the purpose of sending the newsletter (information about career opportunities) and sending the job newsletter

In the event that you provide us with your consent to send you regular information about career opportunities by e-mail or to inform you about jobs of interest to you via our job newsletter, we will process your personal data for the purpose of informing you by e-mail.

This may include, in particular, your first name, last name, e-mail address and your selection based on the filters set in the candidate profile.

We use the so-called double opt-in procedure for sending the newsletter. This means that we will only send you an e-mail newsletter once you have expressly confirmed that you consent to receiving newsletters. We will first send you a confirmation e-mail asking you to confirm that you wish to receive future newsletters by clicking on an appropriate link.

When you register for the newsletter, we store your IP address entered by your Internet service provider (ISP), as well as the date and time of registration, in order to be able to trace any possible misuse of your e-mail address at a later date. We also store your registration to prove that you have registered and agreed.

You may unsubscribe from the newsletter at any time via the link provided for this purpose in the newsletter, or by withdrawing your declaration of consent vis-a-vis the data controller.

For the purpose of sending the newsletter, we store your data until you withdraw your consent or until the newsletter is permanently discontinued. For the purpose of proving consent, no longer than by the end of the fourth calendar year following the last advertising e-mail dispatch.

LEGAL BASIS

Art. 6 (1) lit. a GDPR and relevant law/regulation in Hong Kong

Who receives my data?

In order for us to process your data in accordance with the purposes described above, it may also be necessary to provide other recipients with your data for processing.

Within our group of companies, your data will also be transferred to other companies if they have advertised the vacant position or perform data processing tasks centrally for the companies affiliated in the group (e.g. IT services, HR support, disposal of files, etc.). Information on data protection is available on the website of the respective DEKRA company, or on DEKRA’s data protection portal (Data privacy notice).

With regard to the transfer of data to recipients outside the DEKRA Group, we only pass on information if this is required by law, if the candidates has issued their consent, or this is necessary, in order to protect our legitimate interests.

Under these conditions, the recipients of personal data may include, for example, service providers and vicarious agents employed by us who receive data for these purposes, provided they observe confidentiality and data protection requirements, in particular. These can be companies operating within HR and IT services, telecommunications and consulting categories, for example. We ensure that your personal data is used in accordance with your instructions by concluding group-internal data processing agreements and with commissioned service providers.

The processing operations described in this data protection notice are processed via the SuccessFactors candidate of SAP Deutschland SE & Co. KG, Hasso-Plattner-Ring 7, 69190 Walldorf. A corresponding data processing agreement has been concluded with SAP to this end, which ensures that your personal data is processed by SAP in accordance with instructions and in compliance with the requirements of data protection law. For more information pertaining to data privacy at SAP, see the SAP Data Protection Declaration and the Data Protection Area of the SAP Trust Center.

Is data transferred to a third country or to an international organization?

Data is only transferred to countries outside the European Union (so-called third countries) if you have given us your consent to this end. We would like to expressly point out that your data could also be transferred to third countries that lack the requisite security provisions for which neither an EU adequacy decision nor other suitable data protection guarantees currently apply. The protection of your data may not be guaranteed in the destination country, as in some cases, there is no level of data protection equivalent to that in the EU. Therefore, said data transmission is accompanied by corresponding risks. In particular, there are no guarantees with regard to the prevention of access to your transmitted data by government agencies. In this context, we would like to expressly point out that you, as an EU citizen, may not enjoy any effective legal protection against the processing of your data by authorities in third countries that lack the requisite security provisions. If you nevertheless issue us with your consent with regard to the transfer to third countries, you do so in full knowledge of these risks, which you also consciously accept by doing so.

How long will my data be stored?

We generally store your personal data for a period of 4 months after the end of the process. If you have consented to be included in our candidate pool, we will process your data for this purpose for two years.

Other data processing based on consent shall be carried out at the longest until the time of withdrawal of your consent. We store any consent given to us for a period of four years from the time of its revocation or expiry.

In addition, we store your data for the purpose of complying with statutory retention periods, and for exercising legal claims or defending against legal claims within the scope of the statutory limitation provisions.

What data protection rights do I have?

You are entitled to the following statutory data subject rights, provided that their requirements are met as following and relevant law/regulation in Japan:

Right to the disclosure of information about any data stored by us about you in accordance with Art. 15 GDPR,
Right to the rectification of inaccurate data pursuant to Art. 16 GDPR,
Right to erase the data stored by us in accordance with Art. 17 GDPR,
Right to restrict the processing of data stored by us in accordance with Art. 18 GDPR,
Right to data portability according to Art. 20 GDPR,
Right to lodge an objection according to Art. 21 GDPR,
Right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR if you believe that the processing of personal data concerning you violates provisions of the GDPR.

Is there an obligation for me to provide data?

You are not obliged to provide us with personal data. In the context of an application procedure, however, you must provide us with the personal data that is required for the procedure itself, in order to participate as a candidate in a selection process.

To what extent is there automated decision making?

In order to carry out a procedure or facilitate the use of an candidate profile in the DEKRA candidate portal, we do not use fully automated decision-making in accordance with Article 22 GDPR.

Information about your right to lodge an objection according to Article 21 GDPR Case-by-case right to lodge an objection

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is carried out on the basis of Art. 6 (1) lit. f GDPR (data processing on the basis of a balance of interests). This also applies to profiling based on this provision within the meaning of Article 4 No. 4 GDPR. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the purpose of asserting, exercising or defending legal claims.

Recipient of an objection

The objection can be made informally with the subject “Objection”, stating your name and any additional authentication features that may become necessary. To do so, please contact the data controller or the data protection officer by e-mail.

Version and amendment of this data protection declaration

The version of this data protection declaration is May 2024.

The further development of our company may also have an impact on the handling of personal data. We, therefore, reserve the right to amend this data protection declaration in the future within the framework of the applicable data protection laws and, if necessary, to adapt it to changed data processing realities. We will notify you separately of any significant changes to the content.