Privacy Notice to Job Applicants

Last updated: 22 July 2019

 

  1. Introduction

Tillotts Pharma AG, on behalf of itself and its wholly-owned affiliates[1] (“Tillotts”, “Tillotts Group” or “we”) has issued this privacy notice to job applicants (“Notice”) to describe how we handle personal data that we hold about our job applicants.

We respect the privacy rights of individuals and are committed to handling personal data responsibly and in accordance with applicable law. This Notice sets out the personal data that we collect and process about you, the purposes of the processing and the rights that you have in connection with it.

If you are in doubt regarding the applicable standards, or have any comments or questions about this Notice, please contact us at the contact details in Section 10 below.

 

  1. What types of personal data are collected?

When making an application for employment, we may process personal data about you and your dependents, beneficiaries and other individuals whose personal data has been provided to us.

The types of personal data we may process include, but are not limited to:

  • Identification data – such as your name, gender, photograph, date of birth.
  • Contact details – such as home address, telephone/email addresses.
  • Background information – such as academic/professional qualifications, education, CV/résumé and what else you provide to us in the recruitment process, criminal records data (for vetting purposes, where permissible and in accordance with applicable law), personality tests.
  • National identifiers – such as national ID/passport, immigration/visa status, social security numbers.
  • Any personal data you voluntarily share with us (spouse & dependents identification information, marital status, hobbies, volunteer work, religious, political or philosophical beliefs).

Sensitive personal data includes any data that reveals your racial or ethnic origin, religious, political or philosophical beliefs, genetic data, biometric data for the purposes of unique identification, trade union membership, or information about your health/sex life. As a general rule, we only collect or process any sensitive personal data about you if you disclose it to us on a voluntary basis.

Generally, the personal data we collect from you is collected from you directly. In some cases, we may collect personal data about you from recruitment agencies for recruitment purposes.

 

  1. What are the purposes for the processing of your personal data?

We collect and use your personal data primarily for recruitment purposes – in particular, to determine your qualifications for employment and to reach a hiring decision. This includes assessing your skills, qualifications and background for a particular role, verifying your information, carrying our reference checks or background checks (where applicable) and to generally manage the hiring process and communicate with you about it.

If you are accepted for a role at Tillotts, the information collected during the recruitment process will form part of your ongoing staff record.

If you are not successful, we may still keep your application to allow us to consider you for other suitable openings within Tillotts, but for no longer than 9 (nine) months as of our notice of rejection to you, unless we have a legal obligation to retain your personal data for a longer period of time. If you disagree with aforementioned practice, please inform your Tillotts’ contact person in writing accordingly. However, we may need to retain information to comply with legal and tax obligations, or for any reason detailed under Section 7 below.

 

  1. Who do we share your personal data with?

We provide access to personal data only to those who require such access to perform their tasks and duties, and to third parties who have a legitimate purpose for accessing it. Whenever we permit a third party to access your personal data, we will implement appropriate measures to ensure the personal data is used in a manner consistent with this Notice and that the security and confidentiality of the data is maintained.

(i)        Transfer within the Tillotts Group

We may share your personal data within the Tillotts Group in order to administer human resources, staff compensation and benefits, as well as for other legitimate business purposes such as IT services/security, tax and accounting.

(ii)        Transfer to third parties

We may also disclose personal data to third parties on other lawful grounds, including:

  • To comply with our legal obligations, including where necessary to abide by law, regulation or contract, or to respond to a court order, administrative or judicial process, including, but not limited to a subpoena, regulatory audit or search warrant;
  • In response to lawful requests by public authorities (including for national security or law enforcement purposes);
  • As necessary to establish, exercise or defend against potential, threatened or actual litigation;
  • Where necessary and appropriate to protect the vital interests of another person;
  • In connection with the sale, assignment or other transfer of all or part of our business; or
  • With your consent.

 

  1. What is the legal basis for the processing of your personal data?

Our legal basis for collecting and using the personal data described above will depend on the personal data concerned and the specific context in which we collect it.

However, we will normally collect personal data from you only (i) where we need the personal data to perform a contract with you (i.e. to administer an employment or work relationship with us), (ii) where the processing is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms, or (iii) where we have your consent to do so. In some cases, we may also have a legal obligation to collect personal data from you or may otherwise need the personal data to protect your vital interests or those of another person.

If you have questions about or need further information concerning the legal basis on which we collect and use your personal data, you may contact us using the contact details provided in Section 10 below.     

 

  1. Do we transfer your personal data abroad?

As explained in Section 4 above, your personal data may be transferred to, and processed in, countries other than the country in which you are a resident. These countries may have data protection laws that are different to the laws of your country of residence.

Our servers are located in Switzerland, a country that that the European Commission has decided provides an adequate level of data protection, and our parent company operates in Japan. This means that when we collect your personal data, we may process it in any of these countries.

In cases where your personal data is transferred to a country outside the EU/European Economic Area (“EEA”) which is not covered by a decision of the European Commission that the country concerned ensures an adequate level of protection, we will take such measures as are necessary to ensure the transfer is in compliance with the applicable data protection laws, including the GDPR. Such measures may include (without limitation) transferring your personal data to a recipient that has achieved binding corporate rules authorisation in accordance with applicable data protection laws, or to a recipient that has executed standard contractual clauses adopted or approved by the European Commission.

 

  1. Which data retention periods apply?

Your personal data will be stored in accordance with applicable laws and kept as long as needed to carry out the purposes described in this Notice or as otherwise required by applicable law. Generally this means your personal data will be retained until the end or your employment application plus a reasonable period of time thereafter to deal with any legal matters (e.g. judicial actions), but for no longer than 9 (nine) months as of our notice of rejection to you (cf. Section 3), unless we have a legal obligation to retain your personal data for a longer period of time.

 

  1. What are your data protection rights?

You have the following data protection rights:

  • You may access, correct, update or request deletion of your personal data.
  • You may object to processing of your personal data, ask us to restrict processing of your personal data or request portability of your personal data.
  • You can withdraw your consent at any time if we have collected and processed your personal data with your consent. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal data conducted on lawful processing grounds other than your consent.
  • You have the right to complain to a data protection authority about our collection and use of your personal data. For more information, please contact your local data protection authority. (Contact details for data protection authorities in the European Economic Area are available here.)

You may contact us at any time with a request to exercise your data protection rights by using the contact details provided in Section 9 below.

You will receive a response to your request in accordance with applicable data protection laws.

 

  1. Updates to this Notice

This Notice may be updated periodically to reflect any necessary changes in our privacy practices. We indicate at the top of the Notice when it was most recently updated.

         

  1. Contact details

Please address any questions or requests relating to this Notice by Email ».

 

[1] Affiliates include: Tillotts Pharma AB (Sweden), Tillotts Pharma GmbH (Germany), Tillotts Pharma UK Ltd., Tillotts Pharma Limited (Ireland), Tillotts Pharma Spain S.L.U., Tillotts Pharma France S.A.S., Tillotts Pharma Czech s.r.o.