Information about data processing

V2 (022024)

waterdrop® Microdrink GmbH uses the onlyfy one service (by XING) to process job applications. This Privacy Policy will inform you about the processing of your data by the onlyfy one service and by waterdrop® Microdrink GmbH.

Shared responsibility

With regard to interaction within the company account of waterdrop® Microdrink GmbH, waterdrop® Microdrink GmbH and New Work SE have shared responsibility pursuant to Article 26 GDPR, as they jointly determine the purposes and means of processing pursuant to Article 4 (7) GDPR. The current version of the agreement on shared responsibility pursuant to Article 26 GDPR, which New Work SE concludes with companies that use onlyfy one, can be viewed here https://www.xing.com/terms/onlyfy-one to gain information on the key aspects of the agreement.

Data processing by New Work SE

onlyfy one is part of the extensive XING service operated by New Work SE, which pursues the aim of improving and simplifying users’ working lives with a variety of applications (onlyfy one, as well as the XING social and jobs network, kununu, etc.), and creates a more fulfilling working world of work for individuals while boosting the performance of companies. As part of the extensive XING service, onlyfy one is an online platform on which or through which talent and companies meet.

With regard to data processing for which New Work SE is solely responsible or is responsible within the scope of the shared responsibility with waterdrop® Microdrink GmbH, detailed information is available in the XING Privacy Policy at https://privacy.xing.com/en/privacy-policy. You will also find contact details for New Work SE, as well as for the New Work SE data protection officer there.

Job applications with onlyfy one

When submitting an application, you enter into a user relationship with New Work SE for the purpose of processing applications. In addition, you will receive support and New Work SE can present you with other opportunities in support of your career. A public profile will not be automatically created for you on the XING social and jobs network. The legal basis for New Work SE processing your data is, in particular, Article 6 (1)(b) GDPR (processing necessary for the performance of a contract).

Pausing your online application

You can pause the creation of your online application at any time and continue at a later point. Cookies are used for this purpose. The data you provide to create the user account, as well as any uploaded documents, are recorded in the company account of waterdrop® Microdrink GmbH in onlyfy one. The data remains recorded even if an application is paused and/or not completed. In this case, your application is flagged as incomplete and the data remains visible to waterdrop® Microdrink GmbH only.

Visibility of your data

The data you have provided as part of the online application can be read, edited, or updated in your candidate profile at any time.

Notes on the special functions of onlyfy one

Calendar function

If the calendar function is used, your data is processed during and for the purpose of setting appointments within the application process. The legal basis is Article 6 (1)(f) GDPR. The calendar function is provided by an IT service provider (Cronofy Ltd., United Kingdom). The United Kingdom is classified as a secure third country based on the adequacy decision of the European Commission. Further information on data protection at Cronofy is available here: https://www.cronofy.com/gdpr/ and https://docs.cronofy.com/policies/privacy-notice/

WhatsApp application

If you use the apply using WhatsApp function, your consent, which can be withdrawn at any time, forms the legal basis for communication (Article 6 (1)(a) GDPR). When applying via WhatsApp, all required applicant information is requested during a WhatsApp chat. The data is then sent directly to onlyfy one through a service provider, and is processed further there as part of and for the purpose of the normal application process.

The apply via WhatsApp function is provided by an IT service provider (PitchYou) that can gain access to your data for this purpose. More information is available here: https://www.pitchyou.de/en/pitchyou-gdpr. Candidate data from apply via WhatsApp are transferred to onlyfy one via an interface. Immediately after this transfer, candidate data are deleted from the apply via WhatsApp infrastructure in PitchYou. Further processing then takes place exclusively in onlyfy one.

Please note that you use your personal WhatsApp account for applications, and therefore we cannot rule out that messages will be transferred, to the USA in particular. WhatsApp data protection information, such as its processing or exercising of data protection rights with regard to WhatsApp is available here: https://www.whatsapp.com/legal/privacy-policy-eea.

Subject to your consent, your application will be sent from WhatsApp via the PitchYou infrastructure to onlyfy one. You have the right to withdraw your consent to this at any time. Either way, your application data will be deleted from the PitchYou infrastructure once transferred to onlyfy one, meaning that PitchYou will not process your data any further.

Applicability of the Swiss Federal Data Protection Act (FADP)

The FADP applies to circumstances which have an impact on Switzerland, even if said circumstances are initiated outside of Switzerland. Correspondingly, this privacy policy applies to information in line with the EU GDPR and the FADP. Here, EU GDPR terminology is used in favour of FADP terminology. However, FADP terminology is used if the FADP applies and the terminology differs from EU GDPR terminology in a given language. The About this site section on XING contains the name and address of our representative in Switzerland.

Information according to Art. 13 DSGVO for applicants

Dear Applicant,

as a company and employer, the protection of personal data is very important to Waterdrop
Microdrink GmbH ("we" or "Waterdrop").

Therefore, we inform each applicant for a position at Waterdrop ("Applicant" or "Data
Subject") about the data processing activities we carry out on the Applicant's personal data
that are necessary for us to comply with our legal obligations in relation to Waterdrop's
recruitment and selection of applicants as follows:

(1) the name and contact details of the person responsible and, where appropriate, of his
representative

Waterdrop Microdrink GmbH
Laimgrubengasse 14, 1060 Vienna
FN 449685b
(b) Data Protection Officer:
Mr. Mag. Žiga Škorjanc
Managing Director
lexICT GmbH
Wehlestrasse 154/9
A-1020, Vienna
FN 578688 m
GISA number: 34792865 and 34792889
https://www.lexict.de/buero-wien
skorjanc@lexict.at
Tel: +43 1 37 50 186

Accessibility of the data protection officer for data subjects:
By email:

dpo@waterdrop.com
(c) the purposes for which the personal data are processed and the legal basis for the
processing:

Data application: Recruiting process and applicant selection
Purpose of the processing: Processing of the applicant's personal data for the screening of
the respective applicant profile, for consideration in the recruiting process, for possible
employment of the applicant or for record keeping purposes including storage.
Personal data, in particular name, address, date of birth, citizenship, marital status,
type/duration/scope of employment according to the application documents provided by the

applicant and any other information according to the application documents provided by the
applicant.
Legal basis of processing: for the possible conclusion of an employment contract with the
applicant, i.e. for the implementation of pre-contractual measures (6 para 1 lit b DSGVO).

d) legitimate interests pursued by the person responsible or a third party: Waterdrop receives
numerous applications to fill different positions on an ongoing basis. The data processing is
carried out for the management of the recruiting process as well as the processing and
record keeping of applications.

e) Recipients or categories of recipients of the personal data: A transfer of the relevant data
in the respective individual case can take place on the basis of the legal provisions or
contractual agreement to the following bodies:
External headhunters and recruiters, Public Employment Service, City of Vienna -
Immigration and Citizenship (MA 35), Labour Inspectorate, statutory interest groups, bodies
representing company interests, legal representatives, courts.

(f) data may be transferred to third countries if the position to be filled is geographically
located in such a third country or if it is otherwise necessary for the purpose of processing
the data.

(2)

a) Duration for which the personal data is stored: 1 year from receipt of the application by
Waterdrop or, for record purposes, 5 years from receipt of the application by Waterdrop.

(b) The applicant shall have the right to
● Information about the stored data according to Art 15 DSGVO,
● Correction of inaccurate data in accordance with Art 16 DSGVO,
● Deletion of data in accordance with Art 17 DSGVO,
● Restriction of the processing of data in accordance with Art 18 DSGVO,
● Objection against unreasonable data processing according to Art 21 DSGVO as well
as
● Data portability according to Art 20 DSGVO.
If the processing is based on a declaration of consent, the data subject has the possibility to
revoke this at any time without affecting the lawfulness of the processing carried out on the
basis of the consent until the revocation.
However, this may require the exclusion of the person concerned from the application
process.

d) The applicant has the right to complain to the supervisory authority - in Austria the
competent authority is the data protection authority.

The according address is:

Austrian Data Protection Authority
Wickenburggasse 8
1080 Vienna
Phone: +43 1 531 15-202525
Fax: +43 1 531 15-202690
Email: dsb@dsb.gv.at

e) The data will be used for the entire recruiting process and, if necessary, for the
preparation of the contract or employment. If no personal data is available, Waterdrop lacks
the information basis for processing the applicant's application, for considering the applicant
in the recruiting process and, in the case of a planned employment, the contractually
required information cannot be stated in the respective service contract.

(3) Waterdrop confirms, in the event that the personal data are further processed for a
purpose other than that for which the personal data were collected, to provide the data
subject, prior to such further processing, with information about such other purpose and any
other relevant information pursuant to paragraph (2).

Further information requirements:
Automated decision making including profiling does not take place.
If personal data is processed for a purpose other than that for which the personal data was
collected, we have disclosed information about that other purpose to the data subject.
I declare by my written consent that I have been made aware of the aforementioned
information concerning the processing of my personal data.