Datenschutzerklärung

  • Privacy notice for applicants

    At IBM iX, we take the protection of your data very seriously. We therefore process your data only in accordance with the law. In this privacy notice you will find all information about data processings within the application process.

    1. Who is responsible for protecting your data?
    The following companies are responsible for jobs in the respective country:

    Germany:
        Switzerland, Zürich
         Switzerland, Genf
    IBM iX Berlin GmbH
    Chausseestraße 5
    10115 Berlin
    Germany
    +49 30 283921-0

    berlin@ibmix.de
    IBM iX Switzerland AG
    Vulkanstrasse 106,
    8048 Zürich,
    Switzerland
    +41 58 33 30 303

    zurich@ibmix.ch
    IBM iX Switzerland AG
    Rue Eugène-Marziano 25,
    1227 Genf,
    Switzerland
    +41 58 33 34 455

    genf@ibmix.ch

    2. How can you contact our data protection officer?
    You can contact our data protection officer by e-mail at privacy@ibmix.de or by mail at the addresses listed above with the addition of "For the attention of the data protection officer".

    3. What are your rights?
    Under the above contact details, you can request information about the data stored about your person. In addition, under certain conditions you may request the rectification or deletion of your data. You also have the right to restrict the processing of your data and the right to have the data you have provided us with published in a structured, common and machine-readable format.

    If we have received and process your data on the basis of a consent you have given, you may withdraw this consent at any time with the result that we will no longer process your data for the purposes stated in the consent upon receipt of the consent revocation. The revocation shall not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.

    You also have the opportunity to file a complaint with the data protection authority.

    4. How long is your data kept?
    We keep data exclusively in accordance with the law for as long as this is necessary to achieve the specific purposes. If the purpose no longer exists, we delete the data. We can also anonymize the data, which irrevocably removes the reference to a person.

    Applications that do not lead to employment are deleted after 6 months following the completion of the application process. If your application led to employment, your data will be stored for as long as required by law or as long as any existing legal claims have not expired.

    5. What data do we process?
    We process the following data as part of the application process:

    • Master data (first name, last name, date of birth)
    • Contact details (address, e-mail, telephone number)
    • Information from the application form (including, for example, salary requirements, your motivation, how you noticed us, earliest possible start date, link to online profiles such as LinkedIn)
    • Data about your disability (only if you provide this information voluntarily)
    • Data on education/professional experience (esp. data from your CV and cover letter, data on professional development, certificates, qualifications and language skills)
    • Photo (if you voluntarily provide it as part of the application)
    • Communication Data (date of phone calls, messages, interviews)
    • Data you provided in the feedback survey
    • Image, audio, video & meeting metadata for interviews conducted online
    You are not obliged to provide us with your data. However, if you do not provide it, it will not be possible for us to carry out the application process with you.

    6. On what legal basis and for what purpose do we process your data?
    1.We process your data in accordance with Art. 6 para. 1 lit b GDPR for the performance of a contract and for the implementation of pre-contractual measures. We do this to process your application, for personnel development and for access management to our offices.

    2.Your data may also be processed in the legitimate interest of us or a third party in accordance with Art. 6 para. 1 lit f GDPR to fulfill compliance requirements, to ensure IT security and IT operations, to defend against legal claims (e. g. under the General Equal Treatment Act), for transmission within the group companies for the central management of the application process and for the use of recruiting tools (see below).

    If we process your data in our interest or in the interest of a third party, you have the right to object at any time if reasons arise from your particular situation.

    3.Based on your consent, your application data may also be passed on to group companies so that you can be considered for suitable positions there. In such a case, we will process your data in accordance with Art. 6 para. 1 lit a GDPR. If you do not consent, your application data will only be considered for those companies to which you have applied. You can revoke this consent at any time with effect for the future. To do so, please contact us using the contact details provided above.

    We may also send you a feedback survey after the application process has been completed. We process the data you provide within the survey on the basis of your consent, which you can revoke at any time with effect for the future.

    4. We do not require any special categories of personal data within the meaning of Art. 9 GDPR (e. g. data relating to a disability) for the application process. We kindly ask you not to provide us with such data. If you still provide us with it, we will process this on the basis of your consent pursuant to Art. 6 para. 1 lit a in conjunction with Art. 9 para. 2 lit a GDPR (for Germany in conjunction with § 26 para. 2 German Federal Data Protection Act (BDSG)), unless legal permissions pursuant to Art. 9 para. 2 lit b GDPR (for Germany in conjunction with § 26 para. 3 BDSG) are relevant.

    5. The processing of application data in Germany is based on Art. 88 GDPR in conjunction with Art. 26 BDSG.

    7. To whom may your data be disclosed?
    During the application process, it might be necessary that we transfer personal data to various recipients. The recipients are either independent data controllers (i.e. they are themselves subject to the obligations of the GDPR)), our processors (based on an agreement according to Art. 28 GDPR)) or joint controllers (based on an agreement according to Art. 26 GDPR)).

    IBM iX may share the personal information collected with IBM, IBM subsidiaries and third parties globally.

    Within our group companies, only those departments or employees will receive your data if they need it to process your application.
    Where necessary, agreements pursuant to Art. 28 GDPR have been concluded between the companies listed above.

    In certain cases, e.g. if you have given your consent for this, we may also pass on your documents to other group companies.

    In certain cases, we work with external service providers (processors) and transfer your data to them to the extent necessary for the provision of services. Our processors include IT service providers, software and service providers (for the provision of IT applications) and providers of recruiting tools (see below).

    Our application portal Umantis is operated by our processor Haufe-Lexware GmbH & Co. KG, Munzinger Straße 9, 79111 Freiburg, Germany.

    If the application for a position at IBM iX is made through a personnel service provider (such as headhunters), the personnel service provider collects your data and forwards it to us for the evaluation of the application. We will also inform the personnel service provider if and whether you are hired.

    Also there are legal obligations that we can only fulfill if we transfer your data to authorities or courts to the extent required.

    In all these cases, your data will only be transmitted or provided to the absolute minimum extent necessary.

    8. May my data be processed in a third country?
    Yes, if this third country has been confirmed by the European Commission/UK Secretary of State to have an adequate level of data protection or if other appropriate data protection guarantees are in place.

    In the case of third country processing, we use appropriate safeguards, such as standard contractual clauses, certifications, binding corporate rules or an adequacy decision by the European Commission/UK Secretary of State.

    When using the recruiting tools of the provider LinkedIn Corporation, your data may be processed in the US. You can find more information on this, in particular on the relevant risks, in Chapter 11.

    We use the Cisco Webex tool to conduct online interviews. Cisco Webex is a service of Cisco Systems Inc. based in San José, California, USA. You can find more information about this, especially about the risks involved, in chapter 12.

    In special cases, the transfer to a third country may also take place with your explicit consent, provided that we have informed you about the possible risks of the intended transfer and the lack of appropriate data protection safeguards.

    9. Where does the data we process about you come from?
    We collect your data as part of the application process either by you providing it to us directly (e.g. by uploading your resume), by us collecting it ourselves (e.g. by viewing your online profile on a job platform) or by us receiving it from a recruitment agency.

    10. How is recruiting done via XING Talent Manager and XING Talent Pool Manager?
    If you have a XING profile, we may use XING Talent Manager and XING Talent Pool Manager to discover and contact you as a potential new employee. XING is operated by the company New Work SE, Strandkai 1, 20457 Hamburg, Germany.

    We can use XING Talent Manager to search for candidates on XING and manage applications and profiles of XING members for our recruiting purposes. This tool is only used and accessed by our recruiting employees.

    If you set IBM iX as preferred employer in your user profile, we also process your profile in XING Talent Pool Manager. This gives us the opportunity to create so-called "talent pools" and to manage members who are of interest to the company as employees in these pools and to stay in contact with them for future job positions.

    In XING Talent Manager and Talent Pool Manager, we process data that results from your XING profile as well as other information that you may voluntarily provide us when contacted by our recruiters. We do not save or copy your XING profile, but we create a link to your profile via the services offered to us by XING.

    The legal basis for this data processing is Art. 6 para. 1 lit. f GDPR. We have a legitimate interest in actively searching for suitable candidates on the job and career network XING and in contacting users. Furthermore, we have a legitimate interest in recording your profile if you have indicated IBM iX as preferred employer. You can also object to this processing. To do so, please contact us using the contact details provided above.

    We delete the link to your profile as soon as we decide that we do not wish to contact you as a candidate or as soon as we know that you are not interested in working for us. If you delete your profile, your data will no longer be visible to us in Talent Manager or Talent Pool Manager.

    For more information on data privacy regarding the XING Talent Manager and the XING Talent Pool Manager, please visit https://www.xing.com/legal/privacy_policy_Talent Manager
    https://www.xing.com/legal/privacy_policy_Talent Pool Manager.

    11. How is recruiting done through LinkedIn Talent Solutions?
    If you have a LinkedIn profile, we may use LinkedIn Recruiter, LinkedIn Job Slot and LinkedIn Campaigns to discover and contact you as a potential new employee on LinkedIn.

    LinkedIn Recruiter is a tool of the American company LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA. When using LinkedIn Recruiter, your data may therefore be processed in the US. The European Court of Justice has determined that the US does not ensure an adequate level of data protection. Therefore, there is a risk that your data is subject to access by US authorities for control and monitoring purposes and that no effective legal remedies are available.

    LinkedIn Recruiter allows us to search for candidates on LinkedIn and manage applications and profiles of LinkedIn members for our recruiting purposes. This tool is only used and accessed by our recruiting employees.

    In LinkedIn Recruiter, we process data that results from your LinkedIn profile as well as other information that you may voluntarily provide us when contacted by our recruiters.

    The legal basis for this data processing is Art. 6 para. 1 lit. f GDPR. We have a legitimate interest in actively searching for suitable candidates on the job and career network LinkedIn and contacting users. You can object to this processing. To do so, please contact us using the contact details provided above.

    We delete the link to your profile as soon as we decide that we do not wish to contact you as a candidate or as soon as we know that you are not interested in working for us. If you delete your profile, your data will no longer be visible to us in LinkedIn Recruiter.

    For more information about LinkedIn's privacy practices, please visit: https://www.linkedin.com/legal/privacy-policy?trk=hb_ft_priv

    12. How is the data processing done via Cisco Webex? 
    We use the Cisco Webex tool to conduct online interviews. The following personal data may be processed in the process:

    - User details: last name, first name, email address
    - Meeting metadata: Topic, description (optional), IP addresses, device/hardware information.
    - When dialing in with your telephone: information on the incoming and outgoing call number, country name, start and end time. Also additional connection data such as the IP address of the device can be stored.
    - Text, audio and video data: you might have the option of using the chat function. In this case, the text entries you make will also be processed. In order to enable the video and the audio function, the data from your microphone and your video camera will be processed during the meeting.
    Cisco Webex is a service of Cisco Systems Inc. based in San José, California, USA. Your data may therefore be processed in the US. The European Court of Justice has determined that the USA does not ensure an adequate level of data protection. There is therefore a risk that your data may be accessed by US authorities for control and monitoring purposes and that no effective legal remedies are available.
    The legal basis is your consent pursuant to Art. 6 para. 1 lit. a GDPR, which is implied by activating the corresponding functions in "Cisco Webex".
    If you do not want to use Cisco Webex for the interview, please contact the recruitment team to arrange an alternative option (e.g. via phone).

    For more information about Cisco Webex's privacy notice, please visit https://trustportal.cisco.com/c/dam/r/ctp/docs/privacydatasheet/collaboration/cisco-webex-meetings-privacy-data-sheet.pdf

    13. How is the data processing done on the website?
    Information on data protection about the processing on the website https://ibmix.de/en/
    can be found here: https://ibmix.de/en/privacy/.

    Updated February 2024