Data Protection Notice for Job Applicants

About this notice

This notice explains how Otsuka Novel Products GmbH, (hereinafter referred to as “ONPG”) (also referred to in this notice as “ONPG” “we”, “our” and “us”) processes your personal data when you apply for a job at ONPG.

1. Controller and data protection officer

1.1 Otsuka Novel Products GmbH, with its registered office at Erika-Mann Str.21, 80636 Munich, Germany, and e-mail address privacy(at)otsuka-onpg.com, is the controller in relation to the processing of your personal data.

1.2 Controller is a legal term. It means that we make decisions about how and why we process your personal data. Because of this, we are responsible for making sure it is processed in accordance with applicable data protection laws.

1.3 We designated a data protection officer. You can contact our data protection officer in writing at our address indicated above.

2. What types of personal data do we process and where do we get it from?

2.1 We process the following types of your personal data: contact information (e.g., name, address, phone, e-mail), qualification data (e.g., CV, references, certificates), and data collected during the recruiting process (e.g., answers to interview questions).

2.2 We collect your personal data from you directly, recruitment agencies, and publicly available professional social networks such as LinkedIn and Xing.

2.3 Please note that if you do not provide us with your personal data, we will not be able to process your application.

3. What do we do with your personal data, and why?

3.1 We use your personal data for a number of different purposes. We must always have a “lawful basis” (i.e., a reason, prescribed by law) for processing your personal data. The table below sets out the purposes for which we process the different categories of your personal data and the corresponding lawful basis for that processing.

3.2 We do not process your personal data for automated decision-making according to Article 22 GDPR.

4. Who do we share your personal data with, and why?

4.1 Where necessary for the purposes described in section 3, we share your personal data with the following categories of recipients:

4.1.1 other companies of Otsuka Group;

4.1.2 recruitment agencies;

4.1.3 professional advisors (such as lawyers and accountants);

4.1.4 third party IT service providers (such as IT support, cloud platform, and data hosting providers).

4.2 Where we are asked to respond to a court order or other binding requests; we may need to share your personal data with the courts.

4.3 Where necessary for any investigations or to respond to enquiries in relation to our compliance with applicable law or regulations, we may need to share your personal data with regulatory authorities and law enforcement agencies.

5. Where is your personal data transferred to?

5.1 For the purposes described in section 3, we might need to transfer your personal data to other companies of Otsuka Group, recruitment agencies, professional advisors, or third-party IT service providers located outside the European Economic Area (“third country recipients”).

5.2 We will only make the transfer to a third country recipient if:

5.2.1 the EU Commission decided that the country of the third county recipient ensures an adequate level of data protection according to Article 45 GDPR;

5.2.2 we concluded standard data protection clauses with the third country recipient adopted by the EU Commission according to Article 46(2)(c) GDPR;

5.2.3 the transfer is subject to the binding corporate rules approved by the competent supervisory authority according to Article 46(2)(b) and Article 47 GDPR; or

5.2.4 the transfer is permitted in specific situations according to Article 49 GDPR.

5.3 If you would like to receive a copy of the relevant documents referred to in section 5.2, please contact our data protection officer via indicated above.

6. How long do we keep your personal data for?

6.1 We will only retain your personal data for a limited period of time, and for no longer than is necessary for the purposes for which we are processing it for. This will depend on a number of factors, including:

6.1.1 any laws or regulations that we are required to follow;

6.1.2 whether we are in a legal or other type of dispute with each other or any third party;

6.1.3 the type of information that we hold about you; and

6.1.4 whether we are asked by you or a regulatory authority to keep your personal data for a valid reason.

6.2 If we reject your application or you withdraw your application, we will store your personal data for a period of 6 months for establishment, exercise, or defence of legal claims.

6.3 If you give us your consent for using your personal data to reach out to you in case of job opportunities that match your profile, we will store your personal data for a period of one year from the date of your consent.

7. What are your privacy rights and how can you exercise them?

7.1 Where our processing of your personal data is based on your consent, you have the right to withdraw your consent at any time (Article 7(3) GDPR).

7.3 You have the right to (subject to certain limitations):

7.3.1 access your personal data and to be provided with certain information in relation to it, such as the purpose for which it is processed, the persons to whom it is disclosed and the period for which it will be stored (Article 15 GDPR);

7.3.2 require us to correct any inaccuracies in your personal data without undue delay or have incomplete personal data completed (Article 16 GDPR);

7.3.3 require us to erase your personal data (Article 17 GDPR);

7.3.4 require us to restrict processing of your personal data (Article 18 GDPR); and

7.3.5 receive the personal data which you have provided to us, in a machine-readable format, where we are processing it on the basis of your consent or because it is necessary for your contract with us and where the processing is automated (Article 20 GDPR).

7.4 Please contact our data protection officer if you would like to exercise any of your privacy rights.

7.5 We also encourage you to let us know if you have any concern about how we are processing your personal data so we can try to resolve your concerns. However, if you consider that we are in breach of our obligations under data protection laws, you are entitled to submit a complaint with the competent supervisory authority, in particular, in the EU Member State of your habitual residence, place of work or an alleged infringement of the GDPR (Article 77 GDPR). This right is without prejudice to any other administrative or judicial remedy.