Data protection information for candidates and prospects at Zühlke

I. General information

Zühlke employs people throughout the Group. In order to get to know and hire new employees for the companies, it is necessary to process personal data. 

In this privacy policy we, the companies of the Zühlke Group (hereinafter referred to as Zühlke, we or us), explain how we collect and otherwise process personal data in connection with candidates (applicants) and prospects (potential applicants) across our recruitment portal Workday. For applications that come via website www.zuehlke.com, the privacy policy and cookie policy for the website additionally apply.

This privacy policy is compiled based on Regulation (EU) 2016/679 (GDPR) and the FADP (Switzerland), considering data protection laws that apply locally where our companies are located. For simplicity, we refer to GDPR provisions in some places. If your personal data is processed outside the scope of the GDPR, these references do not apply.

II. Process information and applications used

Zühlke uses Workday as groupwide Human Capital Management (HCM) system (hereinafter the platform). The platform enables people who are interested in Zühlke as an employer to create a prospect profile to apply for vacancies at Zühlke. Based on the information stored in the profile, Zühlke can assess the suitability of a prospect for vacancies at Zühlke and provide information on vacancies at Zühlke and/or general information about Zühlke as an employer.

In addition, Zühlke uses the SaaS solution of Paradox, which is an add-on to the platform. Paradox has the following functionalities enabled: “Chat to apply” and “Interview scheduling”. “Chat to apply” allows the candidate and Zühlke recruiting to chat, exchange information, upload documents needed in the application process via WhatsApp or Email. Offering and maintenance of the integrated WhatsApp functionality is part of Paradox's SaaS offering and managed by latter. “Interview scheduling” allows automated interview scheduling between the candidate and Zühlke representatives appointed to the recruiting of the appropriate position.

III. Information about the data controller

1. Name and contact details of the data controller

Zühlke is responsible for processing your personal data. The responsibility for processing your personal data rests with the Zühlke Group company that posted the job advertisement and which therefore processes your personal data via its services or via its communication with you and decides on the purposes and means of this data processing. The following companies are part of the Zühlke Group:

  • Zühlke Engineering AG, Zürcherstrasse 39j, 8952 Schlieren, Switzerland
  • Zühlke Ventures AG, Zürcherstrasse 39j, 8952 Schlieren, Switzerland
  • Zühlke Engineering GmbH, Düsseldorfer Str. 38, 65760 Eschborn, Germany
  • Zühlke Engineering (Austria) GmbH, Rivergate, Handelskai 92, 1200 Wien, Austria
  • Zuhlke Engineering Ltd, 25 Moorgate, London, EC2R 6AY, United Kingdom
  • Zuhlke Engineering d.o.o., Bulevar Milutina Milankovića 1ž, 11070 Belgrad, Serbia 
  • Zuhlke Engineering Pte Ltd, 80 Robinson Road #22-04, Singapore 068898, Central Singapore
  • Zuhlke Engineering Hong Kong Ltd, 17/F, Spaces 8QRE, 8 Queen’s Road East, Wan Chai, Hong Kong
  • Zuhlke Engineering EOOD, 83 Nikola Gabrovski str., floor 5, 1700 Sofia, Bulgaria
  • Zühlke Engineering Unipessoal Lda, Rua de Dom Manuel II 290, piso 5°, 4050-344 Porto, Portugal
  • Zuehlke Engineering Vietnam LLC, Dreamplex Ngo Quang Huy Building, 42 Ngo Quang Huy, Thao Dien Ward, District 2, Thu Duc City, Ho Chi Minh City, Vietnam

2. Contact of the controller’s data protection officer

IV. Processed personal data

We process the following personal data: 

1. When registering on the platform

If you want to register on our platform, you will need to provide registration data to log in to our portal, and we will store this data (e-mail address & password).

2. Candidate profile data

We store data that you or a recruitment agency commissioned by you and on behalf of you, submit in a candidate profile. (Such as name, contact details including phone number and email address and any other additional information) we also ask for the candidate to provide data regarding Gender to help us measure our DE&I efforts yet this is wholly optional.

3. Comments about candidates

We store any supplementary internal comments that Zühlke adds to a candidate profile. Examples would be notes from interviews or screening calls.

V. Purpose of data processing

Zühlke processes your personal data for the following purposes:

  • To carry out the application process, in particular examining applications, contacting the candidate and conducting job interviews to evaluate and select suitable candidates;
  • For the administration of the applicant management;
  • To carry out the recruitment procedure after successful application, in particular the conclusion of an employment contract;
  • To conduct cooperation with recruitment agencies appointed by candidates;
  • For the safe and stable operation of the platform; 
  • To provide the platform contents called up by the user;
  • For traceability regarding changes to the data stored in the system.

VI. Legal Basis of data processing

Zühlke processes your personal data based on various principles:

  • To carry out pre-contractual measures (the legal basis under GDPR – where applicable – is section 6 para. 1 b of the General Data Protection Regulation); 
  • To meet legal obligations (the legal basis under GDPR – where applicable – is section 6 para. 1 c);
  • Based on your express consent (the legal basis under GDPR – where applicable – is section 6 para. 1 a);
  • To safeguard Zühlke's legitimate interests (the legal basis under GDPR – where applicable – is section 6 para. 1 f).

If you have any questions, please get in touch with the relevant contact referred to above.

VII. Cookies

Cookies are small data files that are placed or accessed on your device when you visit websites or other digital properties. Some digital properties, such as mobile applications, might use similar but different technologies (such as pixels or SDKs). For ease of reference, we use the term cookie to include these technologies too. On our Workday careers portal, the following cookies are utilised, depending on whether you choose to accept them or not: 

Cookie / other tracking tool name: __cflb

  • Category: functional cookie
  • Duration of storage: a few seconds
  • Third party or own cookie: own cookie
  • Transfer to a third country: no
  • Description: This cookie is used by Cloudfare for load balancing.
  • Address (HQ): 101 Townsend St., San Francisco, CA 94107, United States

Cookie / other tracking tool name: __cf_bm

  • Category: functional cookie
  • Duration of storage: a few seconds
  • Third party or own cookie: own cookie
  • Transfer to a third country: no
  • Description: The __cf_bm cookie is a cookie necessary to support Cloudflare Bot Management, currently in private beta. As part of our bot management service, this cookie helps manage incoming traffic that matches criteria associated with bots. This is a CloudFoundry cookie.
  • Address (HQ): 101 Townsend St., San Francisco, CA 94107, United States

Cookie / other tracking tool name: PLAY_SESSION

  • Category: functional cookie
  • Duration of storage: 1 year
  • Third party or own cookie: own cookie
  • Transfer to a third country: no
  • Description: This cookie is used to maintain an anonymous user session by the server.

Cookie / other tracking tool name: OTZ

  • Category: targeting cookie
  • Duration of storage: 1 year
  • Third party or own cookie: third party cookie, Google Privacy Policy 
  • Transfer to a third country:  yes, possibly USA
  • Description: The OTZ cookie is used to collect information about website usage for Google Analytics. It helps in tracking and analysing visitor behaviour on websites that use Google services.
  • Address (HQ): 1600 Amphitheatre Parkway Mountain View, California 94043, United States

Cookie / other tracking tool name: __Host-3PLSID

  • Category: essential cookie
  • Duration of storage: 9 months
  • Third party or own cookie: third-party cookie, Google Privacy Policy
  • Transfer to a third country:  yes, possibly USA
  • Description: The __Host-3PLSID cookie is used for security purposes to protect user data and ensure secure user authentication across Google's services.
  • Address (HQ): 1600 Amphitheatre Parkway Mountain View, California 94043, United States

Cookie / other tracking tool name: LSID

  • Category: essential cookie
  • Duration of storage: 9 months
  • Third party or own cookie: third-party cookie, Google Privacy Policy
  • Transfer to a third country: yes, possibly USA
  • Description:  The LSID cookie is used for security purposes, particularly for user authentication and session management across Google's services.
  • Address (HQ): 1600 Amphitheatre Parkway Mountain View, California 94043, United States

Cookie / other tracking tool name: __Host-GAPS

  • Category: essential cookie
  • Duration of storage: 1 year
  • Third party or own cookie: third-party cookie, Google Privacy Policy
  • Transfer to a third country: yes, possibly USA
  • Description: The __Host-GAPS cookie is used for security purposes and to manage user sessions across Google's services. It helps to authenticate users and protect their data from unauthorised access and fraudulent activities.
  • Address (HQ): 1600 Amphitheatre Parkway Mountain View, California 94043, United States

Cookie / other tracking tool name: ACCOUNT_CHOOSER

  • Category: functional cookie
  • Duration of storage: 1 year
  • Third party or own cookie: third-party cookie, Google Privacy Policy
  • Transfer to a third country: yes, possibly USA
  • Description: The ACCOUNT_CHOOSER cookie is used to remember which Google account a user prefers to use when logging in. When a user accesses a Google service, this cookie helps streamline the login process by pre-selecting the account they have previously chosen, thus providing a more convenient and faster sign-in experience.
  • Address (HQ): 1600 Amphitheatre Parkway Mountain View, California 94043, United States

Cookie / other tracking tool name: __Host-1PLSID

  • Category: essential cookie
  • Duration of storage: 9 months
  • Third party or own cookie: third-party cookie, Google Privacy Policy
  • Transfer to a third country: yes, possibly USA
  • Description: The __Host-1PLSID cookie is used for security purposes, specifically to authenticate users and protect their data from unauthorised access.
  • Address (HQ): 1600 Amphitheatre Parkway Mountain View, California 94043, United States

Cookie / other tracking tool name: SIDCC

  • Category: essential cookie
  • Duration of storage: 7 months
  • Third party or own cookie: third-party cookie, Google Privacy Policy
  • Transfer to a third country: yes, possibly USA
  • Description: The SIDCC cookie is a security cookie used by Google to protect a user's session and preferences across its services, ensuring safe and seamless navigation.
  • Address (HQ): 1600 Amphitheatre Parkway Mountain View, California 94043, United States

Cookie / other tracking tool name: __Secure-3PAPISID

  • Category: targeting cookie
  • Duration of storage: 9 months
  • Third party or own cookie: third-party cookie, Google Privacy Policy
  • Transfer to a third country: yes, possibly USA
  • Description: This cookie is used to build a profile of website visitor interests in order to show relevant and personalised ads through retargeting. It also enhances the security of user sessions by helping to protect against malicious attacks.
  • Address (HQ): 1600 Amphitheatre Parkway Mountain View, California 94043, United States

Cookie / other tracking tool name: __Secure-3PSIDCC

  • Category: targeting cookie
  • Duration of storage: 7 months
  • Third party or own cookie: third-party cookie, Google Privacy Policy
  • Transfer to a third country: yes, possibly USA
  • Description: This cookie is used to build a profile of website visitor interests in order to show relevant and personalised ads through retargeting. It also enhances the security of user sessions by helping to protect against malicious attacks.
  • Address (HQ): 1600 Amphitheatre Parkway Mountain View, California 94043, United States

Cookie / other tracking tool name: SSID

  • Category: targeting cookie
  • Duration of storage: few seconds
  • Third party or own cookie: third-party cookie, Google Privacy Policy
  • Transfer to a third country: yes, possibly USA
  • Description: The SSID cookie stores user preferences and information when viewing pages with Google services, such as Google Maps or YouTube embedded videos. It is also used to improve the user experience by remembering settings and preferences.
  • Address (HQ): 1600 Amphitheatre Parkway Mountain View, California 94043, United States

Cookie / other tracking tool name: OSID

  • Category: essential cookie
  • Duration of storage: few seconds
  • Third party or own cookie: third-party cookie, Google Privacy Policy
  • Transfer to a third country: yes, possibly USA
  • Description: The OSID cookie is primarily used for security purposes. It helps to authenticate users, prevent fraudulent use of login credentials, and protect user data from unauthorised access. This cookie is part of Google's measures to ensure the integrity and  security of user sessions.
  • Address (HQ): 1600 Amphitheatre Parkway Mountain View, California 94043, United States

Cookie / other tracking tool name: __Secure-1PSID

  • Category: essential cookie
  • Duration of storage: 9 months
  • Third party or own cookie: third-party cookie, Google Privacy Policy
  • Transfer to a third country: yes, possibly USA
  • Description: The __Secure-1PSID cookie is used for security purposes to protect users' data and ensure secure user authentication. It helps prevent fraudulent use of login credentials and protects user data from unauthorised access. Additionally, it is used to profile the interests of website visitors in order to show relevant and personalised advertisements.
  • Address (HQ): 1600 Amphitheatre Parkway Mountain View, California 94043, United States

Cookie / other tracking tool name: NID

  • Category: targeting cookie
  • Duration of storage: 1 year
  • Third party or own cookie: third-party cookie, Google Privacy Policy
  • Transfer to a third country: yes, possibly USA
  • Description: The NID cookie is used to store user preferences and information when viewing pages with Google services.
  • Address (HQ): 1600 Amphitheatre Parkway Mountain View, California 94043, United States

Cookie / other tracking tool name: HSID

  • Category: targeting cookie
  • Duration of storage: few seconds
  • Third party or own cookie: third-party cookie, Google Privacy Policy
  • Transfer to a third country: yes, possibly USA
  • Description: Used by Google in combination with SID to verify Google user account and most recent login time.
  • Address (HQ): 1600 Amphitheatre Parkway Mountain View, California 94043, United States

Cookie / other tracking tool name: __Secure-OSID

  • Category: targeting cookie
  • Duration of storage:9 months
  • Third party or own cookie: third-party cookie, Google Privacy Policy
  • Transfer to a third country: yes, possibly USA
  • Description: The __Secure-OSID cookie is primarily used for security purposes to protect users' data and ensure secure user authentication.
  • Address (HQ): 1600 Amphitheatre Parkway Mountain View, California 94043, United States

Cookie / other tracking tool name: APISID

  • Category: targeting cookie
  • Duration of storage: few seconds
  • Third party or own cookie: third-party cookie, Google Privacy Policy
  • Transfer to a third country: yes, possibly USA
  • Description: The APISID cookie is used to store user preferences and information when viewing pages with Google services.
  • Address (HQ): 1600 Amphitheatre Parkway Mountain View, California 94043, United States

Cookie / other tracking tool name: SID

  • Category: targeting cookie
  • Duration of storage: few seconds
  • Third party or own cookie: third-party cookie, Google Privacy Policy
  • Transfer to a third country: yes, possibly USA
  • Description: Used by Google to verify Google user account and most recent login time.
  • Address (HQ): 1600 Amphitheatre Parkway Mountain View, California 94043, United States

Cookie / other tracking tool name: __Secure-3PSID

  • Category: targeting cookie
  • Duration of storage: 9 months
  • Third party or own cookie: third-party cookie, Google Privacy Policy
  • Transfer to a third country: yes, possibly USA
  • Description: The __Secure-3PSID cookie is used for security purposes and to authenticate users, prevent fraudulent use of login credentials, and protect user data from unauthorised access
  • Address (HQ): 1600 Amphitheatre Parkway Mountain View, California 94043, United States

Cookie / other tracking tool name: __Secure-1PSIDCC

  • Category: targeting cookie
  • Duration of storage: 7 months
  • Third party or own cookie: third-party cookie, Google Privacy Policy
  • Transfer to a third country: yes, possibly USA
  • Description: The __Secure-1PSIDCC cookie is used for security purposes to protect users' data and ensure secure user authentication.
  • Address (HQ): 1600 Amphitheatre Parkway Mountain View, California 94043, United States

Cookie / other tracking tool name: SAPISID

  • Category: targeting cookie
  • Duration of storage: few seconds
  • Third party or own cookie: third-party cookie, Google Privacy Policy
  • Transfer to a third country: yes, possibly USA
  • Description: The SAPISID cookie is used to store user preferences and information while interacting with Google services.
  • Address (HQ): 1600 Amphitheatre Parkway Mountain View, California 94043, United States

Cookie / other tracking tool name: wd-browser-id

  • Category: functional cookie
  • Duration of storage: 1 year
  • Third party or own cookie: own cookie 
  • Transfer to a third country: no
  • Description: The wd-browser-id cookie is used to identify the browser and enhance the user's experience with Microsoft web services

Cookie / other tracking tool name: timezoneOffset

  • Category: functional cookie
  • Duration of storage: 1 year
  • Third party or own cookie: own cookie
  • Transfer to a third country: no
  • Description: The timezoneOffset cookie is used to store the difference in minutes between the user's local time and UTC.

Cookie / other tracking tool name: wday_vps_cookie

  • Category: functional cookie
  • Duration of storage: 1 year
  • Third party or own cookie: own cookie
  • Transfer to a third country: no
  • Description: The wday_vps_cookie is used by Workday to manage and maintain user sessions within their platform. It helps ensure that user sessions are handled efficiently, providing a seamless and secure user experience.

Cookie / other tracking tool name: CALYPSO_CSRF_TOKEN

  • Category: functional cookie
  • Duration of storage: 1 year
  • Third party or own cookie: own cookie
  • Transfer to a third country: no
  • Description: The CALYPSO_CSRF_TOKEN cookie is used to store a CSRF token, a unique secret value that is sent with each request to the server to ensure that the request comes from a legitimate source.

Cookie / other tracking tool name: _cfuvid

  • Category: functional cookie
  • Duration of storage: 1 year
  • Third party or own cookie: own cookie
  • Transfer to a third country: no
  • Description: The _cfuvid cookie is used by Cloudflare to identify trusted web traffic. It helps to enhance security and performance by distinguishing between legitimate users and malicious actors.

VIII. Your rights

You can exercise certain rights in relation to data concerning you that is processed by us. In particular, you have the following rights:

  • the right to obtain information from us as to whether and what data we process that concerns you;
  • the right to request that we provide specific personal data in a commonly used electronic format or send it to another controller;
  • the right to have your data rectified if it is inaccurate;
  • the right to request that data is erased, provided there are no conflicting retention requirements or rights;
  • the right to object: if the processing of your personal data is based on our legitimate interest, you can object to the use of your personal data. However, this only applies if you find yourself in a special situation where your personal interests conflict with the use of your personal data. Please note that our compelling, overriding interests also remain reserved. Processing on the grounds of other legal bases remains unaffected by the objection.
  • the right to withdraw consent where our processing is based on your consent;
  • the right, on request, to obtain further information necessary to exercise these rights; and
  • the right to lodge a complaint with the competent supervisory authorities.

You can address all requests to exercise your rights to the controller directly (see Section III for contact details). Requests can be exercised free of charge; they will be processed by us as quickly as possible and within one month of receiving your request, at the latest.

IX. Data Processing Location at Zühlke

If your personal data is disclosed abroad, this will only take place in countries that have a recognised equivalent data protection standard or where specific guarantees have been given.

You should expect your data to be transferred to all countries in which the Zühlke Group is represented by Group companies (see section II) and to other countries in Europe and the USA where the service providers we use are located (see section X). In case we should transfer personal data from EU to Zuhlke Group companies outside the European Economic Area (EEA), the transfer will only be performed if it was confirmed by the respective authorities that this third party country has an adequate level of data protection or if standard data protection clauses exist.

If you have any questions, please get in touch with the relevant contact referred to above (see section III. 2.).

X. Data processing outside the Zühlke Group

Your personal data will be processed where the companies of Zühlke are located. If third parties are involved in processing as auxiliary parties (processors), for example to process commercial administrative services and in connection with IT services (within the Zühlke Group or in the case of external IT service providers), it is likely that processing will take place outside of Zühlke locations. This may be in Switzerland, the UK, the EU or in third countries.

Tools from third parties based in third countries, e.g. the USA, may be integrated into our IT Landscape or to provide services. If these tools are enabled, your personal data may be shared with the servers of the companies in question. However, any personal data processed will be stored in a European cloud.

We run checks on all auxiliary parties from a variety of different angles (data protection, data security, IT, legal) and conclude appropriate data protection contracts, including current EU standard contractual clauses, before we use third-party services. US companies are also checked to see whether they participate in the Privacy Framework Program.

The following main providers are used:

  • Workday software from Workday, 6110 Stoneridge Mall Road, Pleasanton, CA 94588 
  • Paradox, Paradox, Inc., a Delaware corporation, located at 6330 E. Thomas Rd., Suite #200, Scottsdale, AZ 85251. 
  • If requested by the candidate (voluntary, as it is not necessary): WhatsApp Ireland Ltd, Merrion Road, Dublin 4, D04 X2K5, Ireland.

Below you will find further information of the third-party providers used:

If you would like more detailed information, you can contact the controller at any time (see Section III).

XI. Retention period / erasure of personal data

As a rule, we delete your data from the time at which the purpose for processing no longer applies. In the event of an objection to processing based on a legitimate interest or consent, we will delete your data from this point in time, unless another permission for processing continues to exist, for example in the case of legal storage obligations, a legitimate interest to enforce our own legal positions, etc. Below are the detailed rules for the different use cases.

If the user requests to delete their candidate profile and there was no application, the data will be deleted. Otherwise, the candidate profile data will be stored for a limited period from the date of the last application (see A): 

  • In Germany, Austria, and Bulgaria: 6 months;
  • In Switzerland, Serbia, UK, Singapore, Hong Kong, Vietnam: 12 months;
  • Portugal: 5 years further to the termination of the recruitment process for the position the applicant has applied for. If legal action or an administrative procedure is initiated by public authorities, data may be conserved until the conclusion of said legal action or procedure, provided it is necessary for the company’s defense.

If the user wants to delete their prospect profile, a data deletion request is needed.  Otherwise, the candidate profile data will be stored for a limited period from the time of the last login to the platform (see B):

  • In Switzerland, Germany, Austria, UK, Serbia, and Portugal: 24 months;
  • In Bulgaria, Singapore, and Hong Kong, Vietnam: 36 months;

A. Candidate profile data

We store data that candidates themselves, or recruitment agencies commissioned by the candidate and on behalf of the latter, submit in a candidate profile.

If a candidate is successful, we transfer the data to our HCM system.

If a candidate withdraws the application they have submitted or the application is unsuccessful we will continue to store the data for a certain period:

  • In Bulgaria, Germany, and Austria: 6 months (if the data was submitted by a recruitment agency, we will store the data for another 12 months);
  • In Switzerland, UK, Serbia, Singapore, Hong Kong, Vietnam: 12 months; 
  • In Portugal 5 years further to the termination of the recruitment process for the position the applicant has applied for. If legal action or an administrative procedure is initiated by public authorities, data may be conserved until the conclusion of said legal action or procedure, provided it is necessary for the company’s defense.

B.  Prospect profile data

We store data that prospects themselves, or recruitment agencies commissioned by the prospect and on behalf of the prospect, submit in a prospect profile. 

If a user of the platform requests to delete their prospect profile, the data is deleted. Otherwise, the data will be stored for a certain period from the time of the last login to the platform:

  • In Switzerland, Germany, Austria, UK, Serbia, Bulgaria and Portugal: 24 months;
  • In Singapore and Hong Kong, Vietnam: 36 months;

Comments about candidates

We store any supplementary internal comments that Zuhlke adds to a candidate profile. These are notes from job interviews. These internal comments are not visible to candidates on the platform.

If a candidate is successful, we transfer the data to the personnel file.

If a candidate withdraws the application they have submitted, or the application is unsuccessful, we will continue to store the data for a certain period of time:

  • In Germany and Austria: 6 months (if the data was submitted by a recruitment agency, we will store the data for 12 months);
  • In Switzerland, Serbia, Hong Kong, Singapore, Vietnam, UK: 12 months; 
  • In Bulgaria: 36 months;
  • In Portugal: 5 years further to the termination of the recruitment process for the position the applicant has applied for. If legal action or an administrative procedure is initiated by public authorities, data may be conserved until the conclusion of said legal action or procedure, provided it is necessary for the company’s defense.

XII. Status of the privacy policy

This privacy policy is currently valid and was last updated on 05/08/2024.

It may become necessary to amend this privacy policy due to the further development of our platform or offers referred to above, or due to changes in legal or official requirements. The current privacy policy can be accessed at any time on our platform.