Candidate Notice

1. Scope of processing

2. Types of personal data:

• a. The information you have provided to us, or is available on publicly available sources, related to your curriculum vitae (name, title, home address, telephone number, personal email address, date of birth, qualifications, nationality, professional memberships, diplomas, transcripts, languages, computer skills, etc.)
• b. Marital/partnership status, dependents, emergency contact information, and photos.
• c. Documents required under immigration laws (Citizenship, passport details, identity card details, residence, or work permit details) – applicable only if we are involved in a recruitment process with foreign citizens.
• d. Any information you provide to us during an interview.
• e. Information about your desired salary and benefits.
• f. Information about your education and work history.

Please note that the list of Personal Data mentioned above is not exhaustive. Therefore, if the processing of other Personal Data than stated above is deemed necessary, you will be informed without undue delay and as provided by the applicable legislation.

3. How is your personal data collected?

• a. Almost always directly from you, the candidate.
• b. From your named referees, from whom we collect the following categories of data: full name, periods of previous employment, performance during previous employment.
• c. From publicly accessible sources, such as LinkedIn, where we collect your full name, email, work history, and other data included on your profile.
• d. Third parties such as employment websites, professional social networks, recruitment agencies, recruitment consultants or headhunters, as well as education centers or universities, authorities (e.g., criminal background checks, health/medical information, etc.). In this case, we will consider that such third-party acts as a controller of personal data and is responsible for ensuring that your consent to share the personal data of your application has been granted.

4. How will your personal data be used?

• a. We will assess your skills, qualifications, and suitability for the role.
• b. We want to communicate with you about the recruitment process.
• c. We need to keep records related to our hiring processes.
• d. We must comply with legal or regulatory requirements.

It is in our legitimate interests to decide whether to appoint you to the role since it would be beneficial to BMW TechWorks Romania to appoint a suitable candidate to that role. We also need to process your personal information to decide whether to start a collaboration with you. Having received your CV and the results of any tests you take, we will process that information to decide whether you meet the basic requirements to be shortlisted for the role. If we decide to offer you the role, we will then take up references, if needed, before confirming your appointment. If you fail to provide personal data when requested, which is necessary for us to consider your application (such as evidence of qualifications or work history), we may not be able to process your application further.

5. How do we use particularly sensitive personal data?

• a. We will use data about your disability status to consider whether we need to provide appropriate adjustments during the recruitment process, for example, whether adjustments need to be made during a test or interview.
• b. We will use data about your nationality or ethnicity to assess whether a work permit and a visa will be necessary for the role.
• c. We will use data including criminal background checks (to the extent permitted and as strictly necessary according to the applicable legislation).

Special categories of data, such as health/medical information, are only processed for specific purposes, to accommodate a disability or illness and to provide benefits. Please be assured that, as explained in this Data processing notice, special categories of data will only be used for the purposes mentioned and as required by applicable legislation.

6. Transfers of personal data and data security

• a. Your personal data will be transferred or be accessible internationally. Any transfers of personal data from within the EEA (European Economic Area) will take place in line with applicable data protection legislation and applicable additional safeguards and supplementary measures. Any personal data transfer from non-EEA countries will take place in accordance with applicable legislation. We may have to share your data with third parties and affiliates. We require third parties to respect the security of your data and to treat it in accordance with the applicable legislation. If we do, you can expect a similar degree of protection in respect of your personal information.
• b. We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorized way, altered, or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors, and other third parties who have a business need to know. They will only process your personal information on our instructions, and they are subject to a duty of confidentiality. Details of these measures may be obtained from our Data Protection Officer.
• c. We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

7. Third party processors

8. How long do we want to use your data?

• a. We will retain your personal information for a period of 2 years. We retain your personal information for that period so that we can show, in the event of a legal claim, that we have not discriminated against candidates on prohibited grounds and that we have conducted the recruitment exercise in a fair and transparent way.
• b. We further retain such personal data, for the same period of 2 years mentioned above, in case a similar role becomes vacant for which you will be a suitable candidate. Please ensure that your personal data is up to date by sending us your CV, in case you acquire new experiences.
• c. Prior to the expiration of the period mentioned above, we will contact you to obtain your consent for the extension of the 2-year period, with a new period equal in time and in case you do not agree with this extension we will securely destroy your personal data in accordance with our data retention policy.

9. What are your rights?

• a. Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
• b. Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data corrected.
• c. Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing (see below).
• d. Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal data for direct marketing purposes.
• e. Request the transfer of your personal data to another controller.
• f. Restrict processing and rights related to automated decision making and profiling
• g. File a complaint with the Data protection authority – https://www.dataprotection.ro/

10. Get in touch with the Data Protection Officer