EU用户隐私条例

Effective Date: January 4, 2022

• 1. General
• 2. How Smaato collects, uses and retains your data
• 3. To whom Smaato may transfer your data
• 4. Application for further positions
• 5. How to access and control your data
• 6. How Smaato protects your data
• 7. Contact details and responsible entity for your data
• 8. Contact details of the Data Protection Officer

1. General

We are pleased that you are interested in us and are applying or have applied for a job at Smaato, Inc. (“Smaato”, “us”, “we” or “our”). In this Applicant Privacy Policy, we would like to provide you with information on the processing of your personal data in connection with your application.

As part of the application process, it is regularly necessary to forward your personal data within the Smaato group to the relevant business department or affiliated group company. The legal basis of such data processing is Art. 88 para. 1 of the EU General Data Protection Regulation (“GDPR”) in connection with § 26 para. 1 German FDPA, i.e., you provide us with personal data for the purpose of deciding whether to establish an employment relationship.

Whenever Smaato collects, processes and retains your personal data, the Smaato group company or affiliate to which you are applying for a job, or which will be your contract partner, will act as a data controller. If you opted to be part of the Talent Pool (as defined below), your contract partner regarding the usage of the Talent Pool is Smaato, Inc.

You, as an applicant, are responsible for ensuring that the data you submit to us is correct and true. You are under no statutory or contractual obligation to provide personal data to Smaato during the recruitment process. However, if you do not provide the information, we may not be able to process your application properly or at all. Your personal data will be treated as strictly confidential.

This Applicant Privacy Policy may be subject to modification from time to time, notably in the event of changes to legislation or the introduction of new laws. Any changes will be published on our website. We therefore recommend that you check the Applicant Privacy Policy regularly. This Applicant Privacy Policy applies in addition to our general Privacy Policy and Cookie Policy for this website.

2. How Smaato Collects, Uses and Retains Your Data

Smaato may collect personal data from you through your online application via the Smaato Career Portal (as defined below), email, a third party such as a recruitment agency, or someone who recommended you. Applications are processed in collaboration between Smaato, Inc. in Hamburg, Germany as the provider of the Smaato Career Portal, the group wide human resources department (hereinafter “HR Department”), the management, and the relevant business department of the group company which advertises the position. The responsible person of the business department concerned, the responsible manager, and the responsible person of the HR Department may belong to different legal entities within Smaato. Therefore, it is possible that your personal data is exchanged between different legal entities within Smaato.

Our application process includes the following processing steps:

• identification of suitable external and internal applicants for the respective or other suitable vacancies
• aptitude testing of applicants based on application documents, telephone interviews, video interviews, assessment center, personal interviews
• if we decide to hire you, we process your data for the purpose of contract negotiations and contract preparation
• evaluation of our recruiting process.

In some cases, we need to process your personal data to ensure that we are complying with our legal obligations. For example, it is mandatory to check a successful applicant’s eligibility to work in Germany before employment starts.

All personal data you submit to us in the framework of your application is collected, processed, and retained by Smaato for processing your job application. This includes evaluating your qualifications and skills, verifying information you have provided, carrying out reference checks, communicating with you, managing the recruitment process, and deciding on the establishment of an employment relationship for which you have applied.

If you give your consent or we deem this is in your interest, we may send you further job offers or invitations to surveys, e.g., an option for you to provide us with your opinion concerning the application process via a form. As a rule, no personal data will be gathered from you or processed in this form. Should you wish to remain anonymous, please ensure that you do not disclose any information in the free text field in the opinion survey that allows you to be personally identified.

Smaato offers the possibility to join a talent pool (“Talent Pool”). When your application is uploaded through our online upload function without being linked to a specific job offer, or relates to a specific offer but you have provided your consent for further processing, then Smaato may process your personal data as follows:

1. If the HR Department considers your application as a possible match for a (different) job offer within Smaato, your application will be forwarded internally to the relevant Smaato group entity and business departments.
2. Applicants for whom the HR Department does not immediately find a suitable job offer will be included in the Talent Pool to be considered for future vacancies.
3. You can review and update your data and revoke your consent at any time by logging in to your profile in the Smaato Career Portal.

After completion of the application procedure whereas no employment contract was concluded your application documents will be stored for a maximum of twelve months, so that we can contact you again if necessary or respond to enquiries. After that period, your data will be anonymized. If you have registered in our Smaato Career Portal (SmartRecruiters), your data will be stored there until you delete your profile.

Should the data be necessary for legal prosecution after completion of the application procedure, data processing may be carried out based on the requirements of Art. 6 GDPR, in particular to safeguard Smaato’s legitimate interests pursuant to Art. 6 para. 1 lit. f) GDPR. Our interest then lies in the exercise or defense of legal claims.

When hired, your personal data will be transferred from the Smaato Career Portal to the Smaato HR administration system. Processing and storage of your personal data will then be governed by Smaato’s internal data processing policies of which you will be informed when onboarding to your new job.

If you have incurred travel expenses for a personal interview, we will reimburse them. You will receive a form from us for this purpose. Your data will be processed exclusively for this purpose.

We store the information required for reimbursement of costs in accordance with commercial and tax law for the periods specified by law. For this period (usually ten years), the data will be reprocessed for the purpose of a review by the tax authorities, for economic and tax audit purposes, and to clarify possible criminal offenses.

3. To Whom Smaato May Transfer Your Data

If you have applied for a specific job offer, your application documents will only be considered for the filling of this position. Only those persons entrusted with filling vacancies will have access to your application data. In addition, only the IT administrators have access to the data in order to maintain the system and guarantee data security. Your data will not be passed on to third parties outside the Smaato group without your consent.

If you apply for a specific job offer at a Smaato affiliated company, it may be necessary for Smaato to forward your applicant data to the respective affiliated company when processing your application. In this case, Smaato will act as a joint controller with the respective affiliated company and will process your applicant data exclusively in accordance with this data protection notice and the legal requirements for joint controllership.

For the processing of your application, we use a third-party service provided by SmartRecruiters Inc., located at 225 Bush Street, San Francisco, CA 94104 (hereinafter “SmartRecruiters”), to whom your data will consequently be transferred. If you use the SmartRecruiters platform (the “Smaato Career Portal”) to manage or submit your application, the data privacy policy of SmartRecruiters shall also apply. SmartRecruiters will use personal data of applicants solely for processing the applications on behalf of Smaato.

You can also apply in the Smaato Career Portal by connecting to third-party accounts (e.g., LinkedIn, Indeed, SmartRecruiters SmartProfile). BY CONNECTING YOUR SMARTRECRUITERS ACCOUNT TO YOUR THIRD-PARTY ACCOUNT, YOU ACKNOWLEDGE AND AGREE THAT YOU ARE CONSENTING TO THE CONTINUOUS RELEASE OF INFORMATION ABOUT YOU TO OTHERS (IN ACCORDANCE WITH YOUR PRIVACY SETTINGS ON THOSE THIRD-PARTY SITES). IF YOU DO NOT WANT DATA ABOUT YOU, INCLUDING PERSONALLY IDENTIFYING INFORMATION, TO BE SHARED IN THIS MANNER, DO NOT USE THIS FEATURE. You may disconnect your account from a third-party account at any time. Users may disconnect their accounts from third-party websites by visiting their “Account Settings” page.

We may share your data with our service providers, such as SmartRecruiters, within the framework of processing by a data processor. Our service providers were carefully selected by us and are obliged, in accordance with the statutory provisions of Art. 28 EU GDPR, to handle your data in a data protection compliant and trustworthy manner and to comply with our own data protection standards. Our partners are not permitted to use the data themselves for their own purposes.

If a transfer of personal data to a third country outside the European Economic Area becomes necessary, e.g. to other Smaato companies or cooperation partners in third countries, Smaato will ensure that there is a legal basis for this. These are usually

• a consent in accordance with Art. 6 Para. 1 lit. a) GDPR;
• the existence of an adequacy decision of the European Commission (Art. 45 GDPR); a published and constantly updated list of these countries can be found here;
• use of appropriate safeguards guarantees in the form of standard data protection clauses adopted by the European Commission (Art. 46 para. 2 lit. c) GDPR); a published and constantly updated list of the clauses is available here;
• an approved certification mechanism (Art. 46 para. 2 lit. f) GDPR). As a business under the jurisdiction of the U.S. Federal Trade Commission, Smaato has certified with the EU-U.S. and Swiss-U.S. Privacy Shield Frameworks as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal data from EU member countries and Switzerland. Smaato certifies that it adheres to the Privacy Shield Principles of notice, choice, onward transfer, security, data integrity, access, and enforcement. To learn more about the Privacy Shield, and to view the list of entities who have current certifications under the Privacy Shield, please visit this page.

In addition, we may also be required to share your personal data with authorities or other competent bodies as a result of a legal obligation to which we are subject.

4. Application for Further Positions

Occasionally we also have an interest in and need for competent applicants in other areas and would be happy to consider your application for other vacancies. We will only do this if you expressly consent to such processing when submitting your application (for example, by ticking the appropriate box).

In this case, you agree that other recruiters from Smaato and/or its affiliated companies may also view your applicant data, including any sensitive data contained therein, and take it into account when filling vacancies.

Should you appear to be suitable for the vacancy, we would approach you to inquire whether you would be interested in participating in the selection process for the position to be filled. You can revoke your consent at any time in the Smaato Career Portal.

5. How to Access and Control Your Data

You have certain choices available to you when it comes to your personal data. Below is a summary of your rights, how to exercise them, and any limitations.

In addition to the right to withdraw your consent given to us, you are entitled to the following further rights if the respective legal requirements are met:

• the right to information about your personal data stored by us (Art. 15 GDPR); in particular, you can request information about the processing purposes, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, and the origin of your data (unless it has been collected directly from you);
• the right to rectify inaccurate personal data or to complete personal data that is correct (Art. 16 GDPR);
• the right to delete your personal data stored by us (Art. 17 GDPR), insofar as no legal or contractual retention periods or other legal obligations or rights for further storage must be observed by us;
• the right to restrict the processing of your personal data (Art. 18 GDPR) if: the accuracy of the data is disputed by you; if the processing is unlawful but you refuse to accept the deletion of the data; Smaato no longer needs the data, but you need them to assert, exercise, or defend legal claims or you have filed an objection against the processing pursuant to Art. 21 GDPR;
• the right to data portability (Art. 20 GDPR), i.e., the right to have selected personal data about you stored by us transferred in a common, machine-readable format, or to request the transfer to another controller;
• the right to object against data processing under the conditions of Art. 21 para. 1 GDPR, where data processing may be objected to for reasons arising from the particular situation of the data subject; this applies to all processing purposes described in this Applicant Privacy Policy that are administered on the basis of Article 6 para. 1 lit. f) GDPR – the GDPR requires us to abide by such a general objection only if you give us reasons of overriding importance (e.g., a possible danger to life or health);
• the right to lodge a complaint with a supervisory authority in accordance with Art. 77 GDPR. As a rule, you can contact the supervisory authority at your usual place of residence or workplace or Smaato’s lead supervisory authority.

You can assert the aforementioned rights to which you are entitled by sending an email to privacy(at)smaato.com.

You can assert the right to data portability in your Smaato Career Portal (SmartRecruiters) account.

You can also request information about your personal data stored by us by sending an email to privacy(at)smaato.com.

Right to withdraw consent

Insofar as we process data on the basis of a consent given by you, you have the right to revoke the consent given at any time. The revocation of your consent does not mean that the data processing carried out based on your consent up to the time of revocation becomes invalid.

6. How Smaato Protects Your Data

We offer you an SSL (secure socket layer) security procedure together with a 256-bit encryption on our Smaato Career Portal and Smaato website. You can recognize the transfer of encrypted data by the picture of a closed key or lock symbol at the top or bottom of your browser.

We apply the highest level of care and appropriate security standards in order to protect your personal data against unauthorized access or loss. We would like to point out that data transfer via the internet (for example, in the case of unencrypted communication by email) can pose security risks. It is not possible to fully protect the data against third-party access.

7. Contact Details and Responsible Entity for Your Data

You have the possibility to contact us in several ways. By email, telephone, or mail. If you contact us, we will use the personal data that you voluntarily provide to us for the sole purpose of contacting you and processing your enquiry. In order to answer your request, it may be necessary to forward it together with your personal data to one of our affiliated companies. The legal basis for this data processing is Art. 6 para. 1 lit. b), Art. 6 para. 1 lit. c) GDPR and Art. 6 para. 1 lit. f) GDPR.

If you have any questions or complaints about Smaato’s privacy practices, we encourage you to contact us at privacy(at)smaato.com and we will work with you to resolve your issue. You may also contact your responsible European Data Protection Authority or the Swiss Federal Data Protection and Information Commissioner, respectively, with questions or complaints about our privacy practices. Under certain circumstances, the Privacy Shield provides for the election of binding arbitration for complaints not resolved through other means, more fully described on the Privacy Shield website.

You can also contact the lead supervisory authority for Smaato:

The Hamburg Commissioner for Data Protection and Freedom of Information / Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit

Ludwig-Erhard-Str 22, 7th floor
20459 Hamburg
Tel.: +49 (040) 42854-4040
E-mail: mailbox(at)datenschutz.hamburg.de

This data protection information applies to data processing by the data controller Smaato, Inc.:

Smaato, Inc.
240 Stockton Street, 9th Floor
San Francisco, CA 94108

Or our German office at:
Barcastraße 5, 1st Floor
22087 Hamburg, Germany

E-mail: privacy(at)smaato.com

8. Contact details of the Data Protection Officer

Fieldfisher Tech Rechtsanwaltsgesellschaft mbH
Am Sandtorkai 68
20457 Hamburg