Recruitment Privacy Policy

This privacy policy explains how your personal data is processed in accordance with Art. 12 ff. GDPR in connection with our recruitment process.  

1. Controller
   • The controller responsible for processing your personal data under the GDPR is Novasign GmbH, Aspernbrückengasse 2/2, 1020 Vienna, Austria (“we,” “us,” “our”).
   • We can be reached by phone at +43 660 1017239 and by email at contact@novasign.at for questions regarding data processing.
2. Categories of Personal Data
   • The following categories of personal data are collected and processed during the recruitment process:
     • Identification and contact details (name, birthdate, address, email, phone number etc.).
     • Application materials (CV, cover letter, references, certificates, transcripts, resume, videos, links to social profiles, photographs).
     •  Salary.
     • Employment history, qualifications, and skills.
     • Results (such as your answers, score, or ranking) of interviews and assessments.
     • Facial image (for the purpose of facial matching and detection during testing).
     • Correspondence and notes.
     • Data from previous applications to us (if any).
     • Publicly available professional information (e.g. LinkedIn, research profiles).
     • Scoring and analytical results produced by AI tools used in our recruitment process.
     • IP-Adress, username and password (e.g. for HackerRank).
     • Any other personal data provided during recruitment process by you.
   • The provision of personal data for the purpose of the application and conclusion of an employment contract is neither required by law nor contractually stipulated. You are therefore not obliged to provide personal data. Please note, however, that this data is necessary for the application and conclusion of an employment contract with us.
3. Sources of Personal Data
   • We process personal data that we receive from you by mail, email, telephone, or online application portals (LinkedIn etc.) in connection with your application or previous applications to us (if any).
   • We may also receive your personal data from personnel service providers (recruitment consultants or personnel leasing companies) in the course of personnel recruitment.
   • We facilitate Workable to link the data you provide to us, with other publicly available information about you that you have published on the Internet – this may include sources such as LinkedIn and other social media profiles. Workable allows us to search various databases – some publicly available and others not, which may include your personal data (include your CV or Resumé), to find possible candidates to fill our job openings.
   • We may receive your personal data from a third party who recommends you as a candidate for a specific job opening or for our business more generally.
4. Purposes and Legal Bases of Processing
   • We process your personal data for the following purposes:
     • Consider your application and assessing your suitability for the role you have applied.
     • Consider your application in respect of other roles.
     • Conducting interviews, reference checks, and assessments.
     • Conducting tests and collection results, including your answers, score, or ranking, (e.g. by using HackerRank) and measures to prevent cheating by using AI and turning your webcam on.
     • Using AI tools to support efficient, transparent, and fair recruitment: Summarize and structure CVs and application documents, generate candidate scores, compare your profile with the requirements of the position.
     • Compliance with legal and regulatory obligations.
     • To communicate with you in respect of the recruitment process.
     • To enhance any information that we receive from you with information obtained from third party data providers.
     • To find appropriate candidates to fill our job openings.
   • The legal bases for processing your personal data are:
     • Article 6(1)(b) GDPR: processing necessary to take steps prior to entering into an employment contract.
     • Article 6(1)(f) GDPR: legitimate interests in efficient and fair recruitment processes.
     • Article 6(1)(c) GDPR: compliance with legal obligations (where applicable).

5. Use of AI Tools
   • As part of the recruitment process, we use AI-based tools that may involve profiling within the meaning of Article 4(4) GDPR. Profiling includes the automated analysis of your application materials, prior applications, and publicly available professional data to generate structured summaries, match your qualifications to job requirements, and assign candidate scores.
   • In particular, we may use Workable to select appropriate candidates for us to consider based on criteria expressly identified by us, or typical in relation to the role for which you have applied. The process of finding suitable candidates is automatic, however, any decision as to who we will engage to fill the job opening will be made by our staff.
   • However, no decision with legal or similarly significant effects is based solely on automated processing. All AI-generated summaries and scores are reviewed and interpreted by human recruiters and hiring managers. The final hiring decision is always made by humans and not by an algorithm.
   • If you participate in an assessment, test, or interview, we may use HackerRank’s artificial intelligence or machine learning to capture your facial image taken from your webcam or device at intervals during your participation and analyze those images for the purpose of detecting changes to the facial images, or to analyze patterns of your coding and interactions and behavior within an assessment, test, or interview to indicate whether answers may be copied from or generated or assisted by using another unauthorized source.
6. Recipients of Personal Data
   • We may transfer your personal data to the following categories of recipients: group companies, social security institutions, severance pay fund, Federal Office for Social Affairs and Disability (Social Ministry Service), tax office, legal advisors, company pension funds, external payroll accounting/bookkeeping.
   • We also transfer your personal data to processors such as IT/hosting service providers or other service providers, including Workable and HackerRank.
   • We basically transfer your personal data to recipients within the European Economic Area (EEA). If personal data is transferred to recipients in third countries for which no adequacy decision has been made by the European Commission, we take appropriate measures such as concluding EU Standard Contractual Clauses (SCC) to ensure an adequate level of data protection. Upon request, we will provide you with a copy of any SCCs that may have been concluded.
7. Retention Period
   • We store your personal data in principle only for as long as is necessary for the recruitment process.
   • Nevertheless, we retain your personal data for seven (7) months after the recruitment process ends, unless you consent to longer storage in our talent pool or the personal data is required for the defence or exercise of legal claims.
8. Your Rights
   • Under the GDPR, you have the right to (i) access under Art. 15 GDPR; (ii) rectification under Art. 16 GDPR; (iii) erasure under Art. 17 GDPR; (iv) restriction of processing under Art. 18 GDPR; (v) data portability under Art. 20 GDPR; (vi) objection under Art. 21 GDPR; and (vii) complaint to a supervisory authority under Art. 77 GDPR.
   • In Austria, the Data Protection Authority (dsb.gv.at), Barichgasse 40-42, 1030 Vienna, Austria, email: dsb@dsb.gv.at, telephone: +43 1 521520 is the competent supervisory authority.
   • You have the right to withdraw any consent you may have given in accordance with Art. 6 (1)(a) GDPR or Art. 9 (2)(a) GDPR for the processing of your personal data with effect for the future at any time.