Updated September 2020
We, the Ubimax GmbH (hereinafter also “Ubimax”), take the protection of your personal data very seriously. The following policy provides an overview of how we ensure the protection of your personal data and what kind of data is processed for which purposes during your application process with us. Personal data means any information relating to an identified or identifiable natural person, such as your name, address, email addresses, IP address or user behavior.
Ubimax GmbH (“Ubimax”), Hoerneckestrasse 25-31, 28217 Bremen, email@example.com, is controller of your personal data pursuant to Art. 4 para. 7 General Data Protection Regulation (“GDPR”). In case you apply for a position with any other Ubimax Group Companies, the controller would then be the respective Group Company whereas Ubimax acts as a data processor. To see the relevant group companies, please refer to the List of Ubimax Group Companies.
Data protection officer, who can be reached at firstname.lastname@example.org
I. When using Ubimax’s career website:
1. Protocol data
When you visit the Ubimax website, we collect the following personal data transmitted by your server:
• IP address
• Date and time of the request
• Time zone difference from Greenwich Mean Time (GMT)
• Content of the request (specific site)
• Access status / HTTP status code
• Volume of data transmitted each time
• Website from which the request comes
• Browser software, including language and version
• Operating system and its interface
• The country of origin for the visitor
3. Web analytics
To every extent possible, the described analyses will be based on pseudonymous data (e.g. we may consider the Google Analytics Client ID and other non-personalized cookie data, rather than using immediately identifying personal data such as your name or email-address).
II. When applying for a job at Ubimax
When you apply for a job at Ubimax or any other affiliate company, we will usually process your personal data that you provide us with (“Application Data”) which may include in particular:
• Your resume, including personal data such as name, surname, contact details, previous employment information, picture, educational information and the like
• Your certificates, including personal data such as your university diplomas, grade transcripts, school certificates, language certificates and the like
• Cover Letters, including personal data name, surname, contact details, previous employment information, educational information, salary expectations and the like
• Any other documents as you may provide them to us
1. Registering on our career page
If you register on our career page and send us your application, we will process the Applicant Data that you will provide us with (as defined above).
2. Ubimax Talent Community
If you wish to become a member of our Ubimax Talent Community, you agree that we at Ubimax may process your personal data that you have provided, including all applications submitted to us for the Ubimax Group Companies worldwide. We will process your personal data to inform you about interesting job offers and recruiting events. We may contact you in this connection either by email or telephone call. You can revoke your consent at any time by sending your revocation to career@Ubimax.com.
3. Inquiries regarding the job openings
If you inquire about open job opportunities or your own application with us via a contact form, email or via phone, we may collect and process the following personal data: your name, email address, desired job opportunity, and the topic of the inquiry itself.
4. Sending applications via email
If you send us your application via email, we will process the Applicant Data that you will provide us with (as defined above).
5. Applying through social media or job portals
If you apply to a position advertised on various professional social media or job portals (e.g. LinkedIn, Indeed etc.), we will process the Applicant Data that you will provide us with (as defined above).
6. Applying through recruiting agencies
If you apply to a position through a recruiting agency, we will receive and process your Applicant Data provided to us by the relevant recruiting agency.
7. Organizing travels or reimbursing the interview costs
Insofar applicable, Ubimax will process personal data in order to organize your travels or reimburse your travelling costs in connection with conducted interviews. In such cases, we may ask you to provide us with additional information, such as bank information, travelling dates, the amount of expenses and the like. This information is required for us to process the expense report and reimburse you for the costs associated with travel.
8. Applications send in via post
If you decide to apply for a job at Ubimax by sending in the paper applications, we will manually transfer the information from your application to our application system. Consequently, you will receive an email in order for you to activate your created application. In this email, we will provide further information, e.g. inform you, whether we will send your paper application back or shred it. If you do not activate your application within 30 days, your data is deleted from our application management system and you will not be considered any further in the selection process.
9. Employee referral process
If you apply for a job with us using our employee referral program we will process, in addition to your application data, the name of the employee who referred you to us and other information such as how do you know each other as well as any comments that you and your referrer provide to us. You will also receive an email confirming that you have been referred do us by your contact.
III. Active sourcing
We may also reach out to you via professional social media platforms (e.g. LinkedIn, Xing) in order to offer you to consider any of our vacant positions and in general ask you whether you are interested in working for Ubimax or not. In this context, we will process the personal data that you have made available on the respective professional social media platform, e.g. name, current and previous employments, qualifications, picture, hobbies etc.
IV. Background checks
Due to the nature of Ubimax´s products, the topic of security dominates all of Ubimax´s development goals. Therefore, the integrity of our employees is important for us. Against this background, we may conduct background checks for the key positions at Ubimax, which may involve criminal, educational, and employment incl. reference checks. We only conduct such checks for a limited number of key positions and only in a limited scope. During the check we may process information on the existence of criminal history (only the offences relevant for the respective key position), education history and employment history. In the process, we try to limit any privacy impact to an absolute minimum. Should you be affected by corresponding checks, we will make the process transparent from the beginning, and you will be provided with more information on the procedure during your application process.
V. Processing in case of misconducts
We kindly ask you to remain professional during the application process and show care and respect towards our employees, who are trying their best to assist you during your application process. As a company, we value respect for one another and strive to foster professional working environment. Therefore, in case we encounter behavior that is not professional or disrespectful towards our employees, we reserve the right to process some personal data (e.g. your name, email address, reason for rejection) and store it for up to 10 years, and, consequently, do not consider you for any further applications for any of our Group Companies.
VI. Processing for internal reporting
We may process some of your personal data for our internal controlling, analytical and reporting purposes. In doing so, we will only use the data that is absolutely required for such reporting purposes, e.g. your name, hiring position, location etc. (data minimization). Most reports will be done on an anonymous basis, e.g. to compare the application numbers throughout countries or positions.
I. When using Ubimax’s career website
II. Applying for a job at Ubimax
If you apply at Ubimax for any of the job offers advertised on our website, we need to process your personal data in order to process your application, prepare interviews, answer your inquiries, conduct the selection process and communicate with you as required. Legal basis for processing your personal data is your request prior to entering into an employment contract with you, i.e. Sec. 26 para. 1 of the German Data Protection Act (Bundesdatenschutzgesetz, “BDSG”). In other cases (reimbursing the interview costs), we will be processing your data as it is necessary for the purposes of our legitimate interests (Art. 6 para. 1 lit. f) GDPR).If you would like to be added to our Talent Community, the legal basis for the processing your personal data would be your consent, (Art. 6 para. 1 lit. f) GDPR). You can revoke your consent at any time by contacting us at email@example.com.
We generally ask you to not provide us with personal data that would fall under “special categories” in the sense of Art. 9 GDPR, such as information revealing your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data or data concerning your health or your sex life or sexual orientation. If you do submit data falling under any of these special categories nevertheless, we process such data in accordance with Art. 9 para. 2 lit. a) GDPR, Art. 9 para. 2 lit. b) GDPR in conjunction with Sec. 26 para. 3 BDSG, or Art. 9 para. 2 lit. h) GDPR.
You may access and update the data provided by you at any time. You are yourself responsible for the accuracy and truthfulness of any personal data you submit.
III. Active sourcing
Legal basis for data processing in case of the active sourcing is our legitimate interest in accordance with Art. 6 para. 1 lit. f) GDPR as well as data processing for employment-related purposes in accordance with Sec. 26 para. 1 BDSG.
IV. Background checks
Legal basis for data processing for background checks is our legitimate interest in accordance with Art. 6 para. 1 lit. f) GDPR as well as data processing for employment-related purposes in accordance with Sec. 26 para. 1 BDSG.
V. Processing in case of misconducts
Legal basis for data processing in case of misconducts is our legitimate interest in accordance with Art. 6 para. 1 lit. f) GDPR as well as data processing for employment-related purposes in accordance with Sec. 26 para. 1 BDSG.
VI. Processing for internal reporting
Legal basis for data processing for our internal reporting purposes is our legitimate interest in accordance with Art. 6 para. 1 lit. f) GDPR as well as data processing for employment-related purposes in accordance with Sec. 26 para. 1 BDSG.
The legal basis for processing personal data for analysis is your consent, i.e. Art. 6 para. 1 lit. a) GDPR.
I. Google Analytics
Ubimax uses Google Analytics, a web analytics service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, Google Ireland Ltd., Gordon House, 4 Barrow Street, Dublin, Ireland, or any other Affiliate of Google LLC (“Google“). Google Analytics uses “cookies”, i.e. text files that are stored on your computer and enable analysis of your use of our website. When you visit our website for the first time, you will be assigned a cookie with a unique user identification, i.e. a Google Analytics Client ID.
Ubimax uses Google Analytics with the extension “_anonymizeIp()”. Thereby, IP addresses are processed in a shortened form. The information generated by cookies about your use of this website is usually transmitted to and stored on a Google server in the USA. Only in exceptional circumstances will the full IP address be transmitted to a Google server in the USA and shortened there. The IP address transmitted by your browser as part of the Google Analytics data collection will not be merged with other data from Google.
Other tools we use in this context that are also provided by Google includes Google Tag Manager (a tag management system that allows Ubimax to quickly and easily update tracking codes and related code fragments collectively known as “tags” on our website or mobile app).
Within the scope of using Google Analytics on our career website we only process limited data, such as visitor numbers, geographical regions, browser type, browser language preferences, operating system of your device, device type (mobile, tablet, desktop), network information.
Ubimax uses data gathered through your Google Analytics Client ID in order to perform analyses of your interactions with our career website and improve the contents and user experience of the website. With the help of Google’s Analytics Demographics and Interest Reporting, we will receive analyses on our users’ age, gender, and interest categories (please refer to https://support.google.com/analytics/answer/2799357?hl=en for further information).
II. Applicant portal
Applications made before 1st October 2020 will be processed within the preceding application tool provided by Personio. Applications made after 1st October will respectively be processed within the new application tool provided by Smart Recruiters. During the transition period we will be using both systems, until the migration is completed.
a. SmartRecruiters (SR)
SR sets certain cookies within the applicant portal in order to ensure the applications coming through our online application tool are properly processed.
III. Legal basis
Legal basis to conduct and use the results of the analyses under section E.I. above is your consent in accordance with Art. 6 para. 1 lit. a) GDPR.
When you visit our websites (through any device) for the first time, we will ask you to choose your preferences through our Cookie banner (“Banner”). Within the Banner you can make a choice according to your wishes, either allowing us to set certain or all Cookie categories, limiting the setting of the Cookies or not allowing any at all. We will place Cookies on your device based on your choice. Please note, however, that some Cookies will always be active, and we do not ask for your consent for these. This is true for the strictly necessary Cookies, because – as their name suggests – we need to place them for the proper functioning of our website.
You can change your preferences at any time in our Cookie Settings.
Legal basis for the use of necessary third party cookies under section E.II. above is our legitimate interest in accordance with Art. 6 para. 1 lit. f) GDPR (for the strictly necessary cookies) and your consent in accordance with Art. 6 para. 1 lit. f) GDPR (for functional or analytical cookies).
Ubimax employees, who administer, maintain and further develop Ubimax’s website, as well as manage recruiting and human resource services will receive access to your personal data. To that end, Ubimax has strong technical and organizational security measures to protect personal data against unauthorized disclosure to third parties and to ensure that only relevant individuals, who act within their job description and have a need-to-know interest in accessing any of your personal data, will have access to the data for which they have sufficient clearance. Within the scope of the job application process, your data will mostly be used by the human resource service, specifically by executives involved in the application process, in order to review your profile for job offers.
Insofar as we use services of third party providers for the performance and handling of our services (such as providers of IT operation and maintenance services, (cloud) storage service providers and providers of (cloud) collaboration tools, for example Amazon Web Services, Microsoft (Dynamics 365, Azure)), this takes place within the scope of data processing and specifically within the scope of statutory requirements. All mentioned third-party providers and employees of such providers may receive access to personal data through the service they provide.
For the Applicant Data processing, we share your personal data with Jobvite Inc. (“Jobvite”) in the US, as well as SmartRecruiters GmbH (“SmartRecruiters”). Jobvite will be soon completely replaced by the Smart Recruiters. Both vendors are providers of our applicant management system, where the applications for all job openings are processed. Ubimax has relevant agreements, including the data processing agreement with Jobvite as well as SmartRecruiters in place.
Ubimax chooses all third-party service providers with due care, obligates them to confidentiality, and concludes data processing agreements with them in accordance with the standards of the GDPR. Should you have any questions about third parties we use, please contact us at firstname.lastname@example.org.
For web analytics activities, we rely on Google, which will process personal data on our behalf as explained in more detail in section E.
We will not share your personal data with local authorities or courts except where we are required to do so by applicable law, a court order or a legally binding injunction.
Data transfer in third countries
Whenever Ubimax transfers your personal data out of the EU or the EEA to countries that do not have an adequate level of data protection recognized by the EU, we will apply safeguards to adequately protect your personal data. In particular, we will conclude model contracts with corresponding entities.
Please refer to https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/model-contracts-transfer-personal-data-third-countries_en to obtain further information on the Standard Contractual Clauses for the transfer of personal data to processors established outside the EU or EEA.
In particular, we transfer your personal data to our service provider Jobvite in the USA. See sec. F above for more information on Jobvite.
We furthermore transfer data to Google in the USA, for the provision of analytics services, with whom we have concluded Standard Contractual Clauses.
Your personal data will be deleted once you withdraw any consent you have given, or, more generally, once the purpose for processing has ceased to exist. In some cases, Ubimax is legally obligated to retain data for a certain period. Once this period has lapsed, Ubimax will delete the data in accordance with data protection obligations. We will delete the rejected applications after six (6) months. If you are a member of our Talent Community, we will store your data for two (2) years, unless you revoke your consent earlier. We may ask you to renew your consent after two years. In case of a misconduct (as described in section C.V. above), we may store the personal data for up to 10 years.
You may choose not to provide your personal data or provide incomplete personal data. However, you should be aware that you may not be able to use all of the functionalities of our website or not be considered for a job you applied for; where we ask for consent and you choose not to provide it, or you block, disable or delete cookies, we may not be able to provide you with the information or service requested.
I. Your rights
Regarding your personal data processed by us, you can contact us either in writing to Ubimax GmbH, Hoerneckestrasse 25-31, 28217 Bremen, Germany, via email at career@Ubimax.com as well as to our DPO directly at email@example.com to exercise the following rights:
• Right to information in accordance with Art. 13 and 14 GDPR
You have the right to request information about the processing of your personal data in accordance with the respective legal regulations.
• Right to access the information in accordance with Art. 15 GDPR
You may inquire which personal data we store about you.
• Right to rectification in accordance with Art. 16 GDPR
You have the right to request the rectification of inaccurate or incomplete personal data concerning you.
• Right to erasure in accordance with Art. 17 GDPR
You have the right to request the erasure of personal data relating to you without delay, unless deletion is contrary to legal obligations, such as statutory retention periods or our overriding interest.
• Right to restriction of processing in accordance with Art. 18 GDPR
You have the right to demand the restriction of the processing of your personal data.
• Right to revoke the consent in accordance with Art. 7 (3) GDPR
In case we have obtained a separate consent for the processing of your personal data, you have the right to revoke the consent at any time. The revocation shall not affect the lawfulness of the processing based on your consent up to your revocation.
• Right to object in accordance with Art. 21 GDPR
You have the right to object, at any time, to the processing of your personal data based on our legitimate interests or public interest for reasons arising from your particular situation.
If you lodge an objection, we will no longer process personal data relating to you, unless we can prove compelling reasons that outweigh your interests, rights and freedoms or unless the processing serves to assert, exercise or defend legal claims.
The objection can be made without formality and should be addressed, if possible, to Ubimax GmbH (firstname.lastname@example.org).
You may request to receive your personal data in a structured, commonly used and machine-readable format and – subject to your acquisition of the respective copyrights or other required rights – have it transmitted to another controller in accordance with Art. 20 GDPR provided that the processing is based on your respective consent or to execute a contractual relationship or a relationship prior to entering into a contract with you.
You have the right to lodge a complaint with a supervisory authority in relation to the processing of your personal data. The supervisory authority responsible for Ubimax GmbH is the State Commissioner for Data Protection and Freedom of Information of Bremen: https://www.datenschutz.bremen.de/wir_ueber_uns/beschwerdeformular-15253.
Should you have any questions, please contact email@example.com.