Information about data processing
V2 (022024)
VAMED Vitality World uses the onlyfy one service (by XING) to process job applications. This Privacy Policy will inform you about the processing of your data by the onlyfy one service and by VAMED Vitality World.
Shared responsibility
With regard to interaction within the company account of VAMED Vitality World, VAMED Vitality World and New Work SE have shared responsibility pursuant to Article 26 GDPR, as they jointly determine the purposes and means of processing pursuant to Article 4 (7) GDPR. The current version of the agreement on shared responsibility pursuant to Article 26 GDPR, which New Work SE concludes with companies that use onlyfy one, can be viewed here https://www.xing.com/terms/onlyfy-one to gain information on the key aspects of the agreement.
Data processing by New Work SE
onlyfy one is part of the extensive XING service operated by New Work SE, which pursues the aim of improving and simplifying users’ working lives with a variety of applications (onlyfy one, as well as the XING social and jobs network, kununu, etc.), and creates a more fulfilling working world of work for individuals while boosting the performance of companies. As part of the extensive XING service, onlyfy one is an online platform on which or through which talent and companies meet.
With regard to data processing for which New Work SE is solely responsible or is responsible within the scope of the shared responsibility with VAMED Vitality World, detailed information is available in the XING Privacy Policy at https://privacy.xing.com/en/privacy-policy. You will also find contact details for New Work SE, as well as for the New Work SE data protection officer there.
Job applications with onlyfy one
When submitting an application, you enter into a user relationship with New Work SE for the purpose of processing applications. In addition, you will receive support and New Work SE can present you with other opportunities in support of your career. A public profile will not be automatically created for you on the XING social and jobs network. The legal basis for New Work SE processing your data is, in particular, Article 6 (1)(b) GDPR (processing necessary for the performance of a contract).
Pausing your online application
You can pause the creation of your online application at any time and continue at a later point. Cookies are used for this purpose. The data you provide to create the user account, as well as any uploaded documents, are recorded in the company account of VAMED Vitality World in onlyfy one. The data remains recorded even if an application is paused and/or not completed. In this case, your application is flagged as incomplete and the data remains visible to VAMED Vitality World only.
Visibility of your data
The data you have provided as part of the online application can be read, edited, or updated in your candidate profile at any time.
Notes on the special functions of onlyfy one
Calendar function
If the calendar function is used, your data is processed during and for the purpose of setting appointments within the application process. The legal basis is Article 6 (1)(f) GDPR. The calendar function is provided by an IT service provider (Cronofy Ltd., United Kingdom). The United Kingdom is classified as a secure third country based on the adequacy decision of the European Commission. Further information on data protection at Cronofy is available here: https://www.cronofy.com/gdpr/ and https://docs.cronofy.com/policies/privacy-notice/
WhatsApp application
If you use the apply using WhatsApp function, your consent, which can be withdrawn at any time, forms the legal basis for communication (Article 6 (1)(a) GDPR). When applying via WhatsApp, all required applicant information is requested during a WhatsApp chat. The data is then sent directly to onlyfy one through a service provider, and is processed further there as part of and for the purpose of the normal application process.
The apply via WhatsApp function is provided by an IT service provider (PitchYou) that can gain access to your data for this purpose. More information is available here: https://www.pitchyou.de/en/pitchyou-gdpr. Candidate data from apply via WhatsApp are transferred to onlyfy one via an interface. Immediately after this transfer, candidate data are deleted from the apply via WhatsApp infrastructure in PitchYou. Further processing then takes place exclusively in onlyfy one.
Please note that you use your personal WhatsApp account for applications, and therefore we cannot rule out that messages will be transferred, to the USA in particular. WhatsApp data protection information, such as its processing or exercising of data protection rights with regard to WhatsApp is available here: https://www.whatsapp.com/legal/privacy-policy-eea.
Subject to your consent, your application will be sent from WhatsApp via the PitchYou infrastructure to onlyfy one. You have the right to withdraw your consent to this at any time. Either way, your application data will be deleted from the PitchYou infrastructure once transferred to onlyfy one, meaning that PitchYou will not process your data any further.
Applicability of the Swiss Federal Data Protection Act (FADP)
The FADP applies to circumstances which have an impact on Switzerland, even if said circumstances are initiated outside of Switzerland. Correspondingly, this privacy policy applies to information in line with the EU GDPR and the FADP. Here, EU GDPR terminology is used in favour of FADP terminology. However, FADP terminology is used if the FADP applies and the terminology differs from EU GDPR terminology in a given language. The About this site section on XING contains the name and address of our representative in Switzerland.
VAMED Data Privacy Policy
1. PreambleThe VAMED Group (i.e., VAMED Aktiengesellschaft and its affiliated companies; hereinafter referred to as “VAMED” or ‘we’) uses the “onlyfy one” platform provided by New Work SE, Am Strandkai 1, Hamburg (hereinafter referred to as “onlyfy one”) for the purpose of managing and processing applications. With regard to the interaction in VAMED's company account, VAMED and onlyfy are to be qualified as joint controllers in accordance with Art. 26 of the General Data Protection Regulation (GDPR) (hereinafter referred to as “we,” “us”). The current version of the agreement on joint responsibility pursuant to Art. 26 GDPR, which New Work SE concludes with companies that use onlyfy one, can be viewed here as an appendix to the General Terms and Conditions https://www.xing.com/terms/onlyfy-one to inform yourself about the essentials of the agreement.
In this privacy policy, we inform you about processing activities carried out by VAMED as the sole controller or as joint controller with New Work SE. For more information on data processing by New Work SE as part of XING, please visit: https://privacy.xing.com/de/datenschutzerklaerung.
2. What is personal data?
Personal data is any information that can be used to draw conclusions about your personal or factual circumstances or that makes you identifiable.
3. Processing of personal data when visiting the domain onlyfy.io
When you access the domain onlyfy.io, your internet browser automatically transmits certain usage data for technical reasons. This information is stored separately from other data in so-called log files. The following information is collected:
• Date and time as well as duration of access,
• Browser type/version,
• Operating system used,
• URL of the previously visited website,
• Amount of data transferred,
• A GeoIP lookup is performed based on the IP address (Internet Protocol address),
• Name of the files accessed,
• http status code (e.g., “request successful”),
• and URL of the website accessed,
• access type (GET, POST).
This data is technically necessary to offer the functions of the e-recruiting system and to ensure its stability and security. It is stored by onlyfy one for a period of 12 months. Data that must be retained for evidentiary purposes is excluded from deletion until the respective incident has been finally clarified.
4. Cookies
Onlyfy one uses cookies to operate its website. These serve to make your online application more user-friendly, effective, and secure. Cookies are small text files that are stored on your computer. Session cookies are deleted as soon as you leave our website. Permanent cookies, on the other hand, remain stored on your computer's hard drive until they are deleted by your browser (e.g., so that you can return to an ongoing application process later). You can prevent the installation of cookies by adjusting your browser software settings accordingly. Please note, however, that in this case you may not be able to use all the functions of onlyfy one to their full extent.
Cookies may be necessary to maintain the “functionality” of the website. The use of such cookies does not require consent and therefore cannot be deactivated. Cookies that serve the purpose of “analyzing” your behavior on our website are only set with your consent. If we use cookies that require consent, a cookie banner will appear when you first visit our website, allowing you to consent to the use of cookies that require consent. If you wish to change your cookie settings at a later date, you can do so on the website under the “Cookies” section.
c) Below you will find a list of the cookies used.
Provider | Cookie | Purpose | Duration of storage |
New Work SE | PHPSESSID | This cookie is used to identify the user during their use of onlyfy one. The cookie is essential for the correct functionality of the website. The cookie is only valid until the browser window is closed. | Until the browser window is closed (session cookie). |
New Work SE | REMEMBERME | This cookie is used to restore an expired session. The cookie is essential for the correct functionality of the website. | |
5. Processing of personal data as part of the application process
a) We process your personal data in accordance with the provisions of the European General Data Protection Regulation (GDPR) and the Austrian Data Protection Act. Your personal data is exclusively processed for the purposes defined in this Data Privacy Policy (e.g. to process your job application, transfer data to your personal file, if applicable, initiate a contract of employment, and maintain an employment relationship; or to keep your application on record in case there is no suitable vacant position).
- steps prior to entering into a contract (Art. 6 (1) (b) GDPR)
The data is processed (in the event of employment) for the performance of necessary measures prior to entering into a contract and, subsequently, for legal obligations arising from your employment relationship.
- Data processing based on consent (Art. 6 (1) (a) GDPR)
If you gave us your consent for processing your personal data, your data will be processed exclusively for the purposes and within the scope defined in your Declaration of Consent (e.g. keeping your application on record for 24 months). You may also withdraw your consent at any time and independently of each other with effect for the future by sending an email to the VAMED Group at datenschutz@vamed.com. The revocation of consent does not affect the legality of data processing up to the time
of revocation.
- Data processing based on legitimate interest (Art. 6 (1) (f) GDPR).
We may, where necessary, process your data beyond the scope and purpose of the employment contract in order to safeguard legitimate interests of ours or third parties.
b) We would like to point out that for the purposes of direct advertising, we will send you electronic messages about new job offers from companies to which you have previously applied. On behalf of those companies, we process your name, your email address and the data you entered in your previous application. You may object to receiving these messages at any time by sending an email to the VAMED Group at datenschutz@vamed.com.
6. Is data transferred to or collected by third parties?
The following data is collected and processed for the automated processing of your application:
• First name, last name, email address and, if applicable, address/city, date of birth, title, telephone number, citizenship
• Additional questions depending on the respective job advertisement (e.g., driver's license)
• Curriculum vitae, in particular information on professional experience and education
• Skills (e.g., Photoshop, MS Office)
• Application photo
• Qualifications, awards, and language skills
• Letter of motivation
• Files and documents that you may upload
• Special categories of personal data: If you provide information in your application documents that contains special categories of personal data within the meaning of Art. 9 (1) GDPR (e.g., information that allows conclusions to be drawn about your sexual orientation; information about your health; information that allows conclusions to be drawn about your ethnic origin or religion), we will also only process this data within the legally permissible framework.
•
We store the written, electronic communication that takes place between you and the company you are applying to. We also process comments and evaluations written about you in the course of your application process.
6. Purpose and legal basis of data collectionVAMED processes your personal data in accordance with the provisions of the European General Data Protection Regulation (GDPR) and the Data Protection Act. Processing is carried out only in accordance with the purposes specified here (e.g., processing your application and, if applicable, transferring it to your personnel file and implementing necessary measures in connection with the establishment of your employment relationship and, subsequently, your ongoing employment relationship, or keeping your applicant data on file in case we do not have a suitable position to offer at the moment).
• To fulfill pre-contractual measures (Art. 6 (1) (b) GDPR)
Processing is carried out (in the event of recruitment) to fulfill pre-contractual measures from the employment contract and subsequent obligations in connection with your employment relationship.
• Within the scope of your consent (Art. 6 (1) (a) GDPR)
If you have given us your consent to process your personal data, processing will only take place in accordance with the purposes specified in the declaration of consent and to the extent agreed therein (e.g., for keeping your application on file for a period of 24 months). Consent can be revoked at any time and independently of each other with effect for the future by sending an email to datenschutz@vamed.com to the VAMED Group. Revocation of consent does not affect the lawfulness of data processing up to the point of revocation.
• to safeguard legitimate interests (Art. 6 (1) (f) GDPR)
Where necessary, data processing may be carried out beyond the actual performance of the contract in order to safeguard our legitimate interests or those of third parties.
Please note that we send you electronic messages about new job vacancies from companies to which you have already applied in the past for the purposes of direct marketing. On behalf of these companies, we process your name, email address, and data that you provided in your previous application. You can object to the sending of these messages at any time by sending an email to datenschutz@vamed.com to the VAMED Group.
7. Is data passed on to third parties or collected by third parties?The data collected as part of your application will not be published or passed on to third parties without your consent. Apart from our employees, who process your data in the course of providing our services, we pass on your personal data to the following recipients:
a) To companies that are to be contacted in connection with your application, as well as to those companies within the VAMED Group (including managed companies) that are responsible for uniform personnel administration (these are VAMED Aktiengesellschaft, VAMED Engineering GmbH, VAMED Management und Service GmbH, VAMED Technical Service GmbH, VAMED Standortentwicklung und Engineering GmbH, and Vamed KMB Krankenhausmanagement und Betriebsführungsges.mbH).
b) In addition, as part of the group-wide personnel administration, we forward your application data to other companies within the VAMED Group (including managed companies) with potentially suitable positions, provided that your application could not be considered by the company to which you applied.
c) In providing our services, we are supported by processors acting as IT service providers and in the context of hosting services. These processors are based in Austria and Germany and are contractually obliged to comply with the applicable data protection regulations and the provisions on data protection and confidentiality under this agreement.
d) When the calendar function is used, your data will be processed within the scope and for the purpose of scheduling appointments in the application process. The legal basis for this is Art. 6 (1) lit. f GDPR. The calendar function is provided by an IT service provider (Cronofy Ltd., United Kingdom). The United Kingdom is classified as a safe third country on the basis of the adequacy decision of the European Commission. You can find more information on data protection here: – https://www.cronofy.com/gdpr/ and –
https://docs.cronofy.com/policies/privacy-notice/e) If you use the Apply via WhatsApp function, the legal basis for communication is your consent, which you can revoke at any time (Art. 6 (1) a GDPR). When applying via WhatsApp, all necessary applicant information is requested via a WhatsApp chat. The data is then imported directly into onlyfy one via a service provider and further processed there within the framework and for the purpose of the normal application process.
The Apply via WhatsApp function is provided by an IT service provider (PitchYou), which can access your data for this purpose. Further information can be found here: https://www.pitchyou.de/datenschutz. Candidate data from “Application via WhatsApp” is transferred to onlyfy one via an interface and deleted from the “Application via WhatsApp” infrastructure in PitchYou immediately after transfer. Further processing then takes place exclusively in onlyfy one.
Please note that you are using your own private WhatsApp account to apply and therefore transmission, particularly to the USA, cannot be ruled out. WhatsApp's privacy information, for example regarding their processing or exercising your privacy rights vis-à-vis WhatsApp, can be found here: https://www.whatsapp.com/legal/privacy-policy-eea.
After you give your consent, your application will be sent via WhatsApp by PitchYou to onlyfy one. You can revoke your consent to the transfer at any time. However, your application data will be deleted from PitchYou's infrastructure after it has been transferred to onlyfy one, so that no further processing by PitchYou takes place.
8. Storage periods
We store the personal data of rejected applicants for a maximum of six months, starting from the date of rejection of the application.
If you withdraw your application before the end of the application process, i.e., delete your data and your account, the stored data will be blocked for the duration of the ongoing application process and permanently deleted six months after the end of the application process.
If you have given your consent as part of the application process, we will store your data for the purpose of further consideration and contact in the event of suitable job vacancies in the future for a period of two years from the date of application.
Longer storage periods may result from the fact that the data is necessary for asserting, exercising, or defending legal claims before an authority or that there are legal retention obligations. The data will be stored for as long as necessary to fulfill these purposes.
9. Your rights regarding stored dataYou have the following rights under the GDPR:
• Right of access (Art. 15 GDPR): You have the right to request confirmation from VAMED as to whether your personal data is being processed. In addition, you have the right to obtain further information about the specific purposes of processing, categories of personal data, recipients or categories of recipients of personal data, storage period, the existence of a right to erasure or rectification of your personal data or to restriction of processing, and the right to object, the existence of a right to lodge a complaint, and all available information about the origin of your data.
• Right to rectification (Art. 16 GDPR): You have the right to request that VAMED rectify your personal data without delay. This right includes the rectification of inaccurate data and the completion of incomplete personal data.
• Right to erasure (Art. 17 GDPR): You have the right to request that VAMED erase your personal data without undue delay, provided that the reasons specified in Art. 17(1)(a) to (f) GDPR (e.g., the purpose for processing no longer applies) apply and the processing of your personal data is not necessary.
• Right to restriction of processing (Art. 18 GDPR): In the cases specified in Art. 18 GDPR (e.g., inaccuracy of the personal data processed, unlawfulness of the processing, etc.), you also have the right to request that VAMED restrict the processing.
• Right to data portability (Art. 20 GDPR): You have the right to receive the personal data concerning you that you have provided to VAMED in a structured, commonly used format and to request that VAMED transfer this data to another controller (e.g., another law firm).
• Right to object (Art. 21 GDPR): You have the right to object at any time to the processing of your personal data processed within the scope of this website.
To exercise these rights or obtain additional information about them, please contact the VAMED Group by email (datenschutz@vamed.com).
10. Right of revocationYou may revoke your consent to data protection at any time with future effect. To exercise your right of revocation, please contact the VAMED Group by email (datenschutz@vamed.com).
If we use cookies on our website that require consent and you have also consented to their use, you can revoke this consent on our website under the “Cookies” section. For more information about cookies, please refer to section 4, “Cookies.”
11. Complaints to the data protection authorityIf you believe that we are processing your data in violation of applicable law, you can lodge a complaint with the Austrian data protection authority or the otherwise competent supervisory authority (in particular in the member state of your place of residence or work).
12. Contact details of the company responsible for data protectionIf you have any questions or other concerns regarding the processing of your personal data by us, please contact the Group Data Protection Officer at daten-schutz@vamed.com or VAMED Aktiengesellschaft, Sterngasse 5, A-1230 Vienna.
Our privacy policy and our responsibility and liability in this regard do not extend to third-party websites to which we link or to which you are redirected. Furthermore, we are not responsible for data processing carried out by the operators of these websites in such cases.
13. Recruiting via social mediaIf you use our “application via social media” function, the legal basis for the processing of personal data is your consent, which you can revoke at any time (Art. 6 (1) (a) GDPR). When applying via Facebook or LinkedIn, you can upload your application documents directly or use our applicant platform by clicking on the link provided. If you upload your documents to the respective social media channel, the data will be imported directly into the onlyfy one system via a service provider and processed there exclusively within the scope and for the purpose of the application process and deleted once this purpose no longer applies. The “application via social media” function is provided by a service provider (Vierfeld Digital GmbH), which may access your data for this purpose.
Please note that you are using your own private social media account to apply and that data processing by the social media provider therefore takes place and transfer, in particular to the USA, cannot be ruled out. The USA is currently considered an unsafe third country, which means that it may not be able to guarantee the EU data protection standard. The transfer may involve certain data protection risks (e.g., unauthorized access to your data by US security authorities). Alternatively, you can use our application platform available at: https://www.vamed.com/de/karriere/.
If you wish to revoke your consent, please contact: datenschutz@vamed.com.
