Candidate Privacy Notice

We would like to provide you with important privacy information regarding the processing of your personal data in the recruitment process within GMS AG as data controller (further – GMS), located Schochenmühlestrasse 2, 6340 Baar, Switzerland and/or its affiliated entities worldwide (collectively referred to as “GMS”). We value your application and are committed to protecting your personal data.

GMS Privacy Mission is to establish and maintain strong data protection and privacy practices that safeguard personal information and build trust in our innovative solutions.

GMS Privacy Vision is to be recognized as a privacy and data protection leader in the electronic communication world, by providing compliant, secure, responsible and transparent innovative solutions that create value and build trust between our clients and their customers.

I. Purposes of data processing

GMS collects, uses, and processes candidates’ Personal Data for the following purposes:

To evaluate candidates’ eligibility for employment and suitability for specific roles;
To manage the recruitment and selection process;
To communicate with candidate about job opportunities and the recruitment process;
To conduct background checks, reference checks, and verifications;
To assess candidates’ qualifications and skills for the applied position;
To establish and maintain contact with candidate during the recruitment process;
To comply with legal obligations and regulatory requirements;
To maintain recruitment records and statistics;
To consider candidate in future recruitment processes and employment opportunities;

II. Types of data

During the recruitment process, GMS collects and processes various types of your personal data, including:

Identification data: such as name;
Contact details: such as email address, phone number, postal address;
Professional qualifications: including CV, reference letter, and interview notes;
Employment history: details of previous employers, job titles, and employment dates;
Educational background: academic qualifications, degrees, and certifications;
Skills and competencies: information relevant to the position applied for;
Other information: any other information voluntarily provided by the candidate during the recruitment process, such as contact information for referees.

III. Data provision requirement and consequences

The provision of personal data to GMS is necessary for the evaluation of your eligibility for employment and suitability for specific role, as well as for the management of the recruitment and selection process. Failure to provide the requested personal data may result in GMS being unable to assess your qualifications and skills for the applied position, communicate with you about job opportunities, conduct necessary background and reference checks, or maintain contact with you during the recruitment process. In such cases, GMS may not be able to fully consider your application or proceed with the recruitment process.

IV. Legal basis

GMS legal basis for the lawful processing of Personal Data will depend on the collected Personal Data and the context in which it is collected. However, the legal basis for processing candidates’ Personal Data may include:

Processing necessary for the performance of a contract or in order to take steps at the request of the data subject prior to entering into a contract (e.g., employment contract, B2B contract);
Compliance with legal obligations to which the controller is subject;
Candidate consent to the processing of their Personal Data for one or more specific purposes, where required.

Candidate consent may be required for specific purposes in the context of the recruitment process, such as:

Collecting sensitive data – If the recruitment process involves collecting special categories of Personal Data about the candidate, such as information related to health, race, religion, or other special categories of data under GDPR, explicit consent would be required. For example, if the candidate voluntarily provides information about a disability to request accommodations during the recruitment process, their explicit consent to process this sensitive data is necessary.
Reference checks – When conducting reference checks, particularly if these checks involve contacting individuals not listed on the candidate’s CV or application, candidate may need to provide consent for their referees to be contacted.
Background checks – If GMS conducts background checks that go beyond standard employment verification, candidate consent is required. The consent should specify the types of checks that will be conducted and the purpose.
Future job opportunities – GMS may seek consent to retain a candidate’s data for future job opportunities if they are not selected for the current role.

GMS will always make sure to specify on which legal basis is intending to collect and process personal data.

V. Data retention

GMS will retain candidates Personal Data for the duration of the specific recruitment process for which the data was collected. Personal Data will be securely deleted after the completion of the recruitment process. This occurs within 6 months after the completion of the recruitment process, unless applicable law requires a different retention period.

If you explicitly consented to the retention of your data for consideration in future recruitment processes and employment opportunities, the following principles apply. GMS will securely retain your Personal Data for a defined period, typically 24 months, from the date of consent. This retention period allows GMS to consider you for suitable positions that may arise in the future. If you have provided consent, you have the right to withdraw your consent at any time. GMS will promptly cease processing of your data for future recruitment opportunities upon receipt of such withdrawal. At the end of the defined retention period, if no suitable employment opportunity has arisen, the Personal Data will be securely deleted or anonymized.

VI. Data disclosure and third-party transfer

GMS may need to share your Personal Data with the following parties:

GMS entities and affiliates.
External service providers, such as cloud services providers.
Regulatory authorities and law enforcement agencies, if required by law.
Third parties involved in the recruitment process, such as recruitment agencies, interviewers and assessors.

Since the Ukraine, Pakistan and other non-EEA countries where GMS entities are located do not provide the same level of protection of Personal Data as in the European Economic Area (EEA), in order to provide adequate protection for such data transfers, GMS has entered into a data transfer agreement conforming to the EU Commission Standard Contractual Clauses for the transfer of Personal Data to third countries with other non-EEA GMS entities in countries not recognized as providing the same level of protection of Personal Data as in the EEA.

With regard to third-party service providers located in territories outside of the EEA and not providing a level of protection to Personal Data not equivalent to that provided in the home jurisdiction of the candidate, GMS will (i) exercise appropriate due diligence in the selection of such third-party service providers, and (ii) require via appropriate contractual measures that such third-party service providers maintain adequate technical and organizational security measures to safeguard the candidates’ Personal Data, and process the Personal Data only as instructed by GMS and for no other purposes.

Any transfer of Personal Data to one of the above recipients located in a country outside the EEA not recognized as providing the same level of protection of Personal Data as in the EEA, will be made on the basis of a data transfer agreement conforming to the EU Commission Standard Contractual Clauses for the transfer of data to third countries, or another data transfer mechanism in accordance with applicable data protection laws.

GMS cannot guarantee the exclusion of Personal Data from disclosure to any court, administrative, police, law enforcement, or regulatory authority if there is a legal obligation or legitimate interest to do so. The decision of the aforementioned authorities may reference or include the Personal Data and be made publicly available.

VII. Your rights

As a candidate participating in the recruitment process, you are entitled to various rights. These rights are designed to give you control over your Personal Data and include:

right to access – you have the right to obtain confirmation from GMS as to whether or not Personal Data concerning you is being processed, and, where that is the case, access to the Personal Data. This includes receiving a copy of the Personal Data undergoing processing. Access requests may be denied if the data contains information that infringes on the rights and freedoms of others or if it conflicts with GMS’s legal obligations;
right to rectify – should you find that the Personal Data GMS holds about you is inaccurate or incomplete, you have the right to request that GMS corrects or completes this data without undue delay. If there’s a dispute regarding the accuracy of your data, GMS commits to reviewing and resolving these disputes promptly, ensuring fairness and transparency;
right to erase – you may request the erasure of your Personal Data under certain conditions, such as when the data is no longer necessary for the purposes it was collected for, or if you withdraw consent on which the processing is based. GMS may refuse the request for erasure to comply with a legal obligation, for the performance of a task carried out in the public interest, or for the establishment, exercise, or defence of legal claims;
right to restrict Personal Data;
right to data portability;
right to withdrawal of consent – participation in the recruitment process is voluntary, and you have the right to withdraw your consent at any time without any adverse consequences. The consent withdrawal will not affect the lawfulness of any processing carried out prior to the withdrawal, nor will it affect processing of the Personal Data carried out in reliance on lawful grounds other than consent;
the right to lodge a complaint or concern with the local data protection authority if you believe that your rights have been violated.

Conditions and Limitations

It’s important to note that these rights are not absolute and may be subject to conditions or limitations as per applicable law. For instance, if exercising one of these rights might reveal Personal Data about another person, or if it infringes upon the rights of a third party, GMS may need to limit your access or deny the request. GMS may also deny requests if they are unfounded, excessively repetitive, or if accessing the requested information requires disproportionate technical effort or expense.

Dispute Resolution

In the event of a dispute regarding your request or the accuracy of your Personal Data, GMS will engage in a transparent dialogue with you to address your concerns. We will inform you of the actions taken to resolve the dispute, including any corrections made or reasons for not making the changes requested.

VIII. Automated decision-making and profiling

GMS does not use automated decision-making processes, including profiling for the purposes outlined above.

IX. Contact information and Data Protection Officer

For inquiries or requests regarding your data, please contact our Data Protection Officer at dataprotection@gms.net.