Privacy Notice
Information Regarding Data Protection for Employees and Applicants
This CHINESE APPENDIX forms part of the general “Privacy Notice – Information Regarding Data Protection for Employees and Applicants” (“General Privacy Notice”) and applies to the employees and applicants of the SupplyOn Consulting (Shanghai) Co., Ltd (“SupplyOn China”).
1. Name and contact details of the controller
SupplyOn Consulting (Shanghai) Co., Ltd.
36/E, Global Harbor Tower B
No. 1188 North Kai Xuan Road
Putuo District
Shanghai-200063
China
Telephone: +86 21 6040 2283
E-Mail: dpo@supplyon.com
2. Purposes, categories, legal basis of personal data processing
A) During the application process
When we receive your application, we process your personal data required for recruiting. This may include contact data, any data related to the application (CV, certificates, qualifications, answers to questions, etc.) and, if applicable, bank details (to reimburse travel expenses). We process your personal data based on Art. 13 (2) PIPL, for the purpose of selecting applicants to enter into an employment relationship.
Your personal data is provided to us directly by you in your online application or by a head-hunter. In the case of online application, you yourself determine the scope of the data you wish to provide to us. If certain information is required due to a specific job description, we will point this out. In the case of recruiting via a head-hunter, the head-hunter is contractually obliged by us to obtain your consent before transferring your personal data to us. We will only request the data that is necessary for the recruitment and inform you about the source of your personal data at the time of first contact.
We process the data exclusively for the purpose of selecting applicants. Data processing for other purposes does not take place. Applications are transferred to our personnel department (to the responsible recruiter) and processed there as quickly as possible. As a rule, applications will also be forwarded to the heads of the recruiting departments.
Due to our affiliation as a group of companies, the application data of the final selected candidate might be transferred to the management of our headquarter in Germany for approval. The legal basis for this data transfer is the conclusion of the employment contract.
If your application is unsuccessful, your documents will be deleted after the recruitment decision is made. If we intend to keep your application data for future job opportunities, we will ask your consent during the recruitment process. We will then process your data on the basis of Art. 13 (1) PIPL.
B) During the Employment
We may collect master data from you which is necessary for the establishment of the employment relationship, for example name, address, date of birth, gender, ID-number, bank account etc. We may also collect your contact information such as e-mail address and phone number, in so far as this is required by the nature of the employment relationship.
We may also collect and store information about your employment with us, your qualifications and your career to date. This includes, for example, information regarding your highest level of education or vocational training and the information you provided as part of the application process. Data concerning current second jobs is relevant for us in order to enable us to check compatibility with your employment.
We may also collect tax and social security relevant data. This includes, among other things, your marital status, information regarding your social security status and housing found etc.
During the employment relationship, we collect and process further personal data, including information on access control, sick leave, absences (vacation, special leave, etc.) and working hours, for the purpose of performance of the employment relationship and carrying out human resource management.
We maintain a personnel file in which we store all central information required for the employment relationship. If you would like to view the contents of your personnel file, please contact the human resources department.
As an employee of SupplyOn China, we process your personal data in connection with the use of SupplyOn-Services for the purpose of the employment relationship on the legal basis of Art. 13 (2) PIPL. Further relevant information on the use of SupplyOn-Services can be found under: https://www.supplyon.com/en/privacy_notice/information-regarding-data-protection-for-users-of-supplyon-services/ .
Further, the entrance of the office of SupplyOn China is monitored with video-surveillance for the purpose of monitoring the entrance of the company and remote door-opening. Your image might be recorded as you entered into the monitored area. However, we don’t keep or store any video-footage.
3. Sensitive personal data
Sensitive personal data is data that once leaked or illegally used will easily lead to infringement of personal dignity or endanger personal or property security, such as biometrical data, religion, special identity, medical and health data, financial account data, location tracking data and personal data related to children under 14 years old.
We don’t usually process sensitive personal data. However, if we process sensitive personal data on an exceptional basis, we will only do this if it is strictly necessary for a pre-defined purpose and we will inform you separately. For children under 14 years old, we will obtain consent from the legal guardian of the children.
4. Providing personal data to a third party
SupplyOn China engages service providers to process personal data on our behalf, such as the payroll service provider. These service providers are contractually obligated to only process personal data in accordance with the instructions of SupplyOn China. Further obligations of the services providers, as well as the scope, purpose and type of the commissioned data processing will be laid down in a data processing agreement.
During the conclusion or performance of the employment contract, your personal data may be provided to a third party, for example to our headquarter or partnered insurance company. We will only provide your personal data to a third party if this is necessary for the conclusion or performance of the employment contract or if you have given us your separate consent for the data sharing.
We only publish business contact data of certain employees on the company’s website, whose position involves contact with external visitors or business partners by nature. In this case, the disclosure of personal data is either necessary for the performance of the employment contract or based on the separate consent of the concerned employee. Beyond that we do not publicly disclose your personal data.
5. Cross-border data transfer
Due to business operation purposes, your personal data might be transferred outside of China, for example in the course of using business software that is provided and administrated by the German headquarter. We will make sure that the data is transferred in accordance with the cross-border data transfer rules laid down in the PIPL.
6. Measures to protect your personal data
The measures we have taken to protect your personal data as well as the certificates received for our data security standards can be found under: https://www.supplyon.com/en/data-security/.
In addition, we take measures to protect your personal data in transit and at rest. During the transfer, personal data will either be encrypted or protected with password. Data kept in paper form is protected with access control.
7. Rights of the data subject and how to exercise your right
Under the PIPL, you have the right to be informed about the personal data concerning you. You may also request access to and a copy of the personal data processed concerning you.
You also have the right to have incorrect or incomplete data corrected or completed. In addition, you may request the deletion of your personal data, e.g., if the data is no longer required for the purposes pursued or the consent for the data processing is revoked. You also have the right to limit the processing or ask us to transfer your personal data to other data controllers.
If you wish to exercise the aforementioned data subject rights or have any questions or complaints regarding this privacy notice or our data protection measures, please contact us under the name and contact details laid down in section 1 of this CHINESE APPENDIX. We will respond to your request in a timely manner.