Permobil's Global Candidate Privacy Notice

Global(GDPR)

1. Controller of personal data
Permobil (entity) for which you have applied for a position is the data controller of the personal data that Permobil obtains from you and other sources. "Data Controller" means that it is Permobil that decides on the purpose and means for the processing of your personal data. As Data Controller, Permobil is responsible for the processing of your personal data under applicable data privacy laws and regulations.

2. Sources of personal data
Permobil takes data privacy like all legal and compliance requirements very seriously, and it is Permobil policy to comply with all applicable Data Protection and Privacy laws and regulations. Permobil recognizes the importance of protecting the confidentiality, security, and integrity of personal data provided or obtained in the course of the recruitment process. In this context, we are committed to keeping you fully informed about our activities involving the processing of your personal data.

We mainly collect personal data directly from you when you apply for a job in our application-management system, attend a recruitment event, or submit your interest in any other ways, as well as when you participate in an interview or online or face-to-face candidate assessment.

Permobil may search publicly available sources such as LinkedIn or comparable professional sites for information about your abilities, experience, or qualifications (only relevant to your professional life).

We may also receive personal information when you apply through third parties like recruitment agencies or consultants. In such cases, the third party may also act as a Data Controller of your personal information. To exercise your data protection rights for the processing activities carried out by such third parties; you may need to contact the third party through which you have applied for a position with us. We may also receive your information (email address) when an employee has referred you for a position with us under the employee-referral program. In such cases, you are notified that you have been referred by an employee, but your contact information is not retained after sending you a notification email. Through the notification email, you will be asked to apply in our application management system. We have documented employee referral guidelines in place.

Some information is generated automatically when you use or otherwise interact with our application-management system to create an account and manage your job applications.

3. Categories of personal data, legal grounds and purposes of processing

3.1 Personal data

For the purposes of this Candidate Privacy Notice, regardless of when it came into existence and originated from which sources, "personal data" (also known as personal information or personally identifiable information) means any information relating to a candidate, in any form (e.g. paper documents, data processed in systems, softwares, apps, transferred via emails, instant messages, voicemails, etc.). upon a natural person is or can be identified as an individual, as himself/herself. In other words, it is any piece of information that can be linked to you.

3.2 Processing of personal data

For the purposes of this Candidate Privacy Notice, the term "process" or "processing" refers to any of the following actions performed on personal data:
○ collection and recording
○ accessing
○ storage, organisation, structuring
○ use, adaptation, combination, consultation, alignment
○ alteration, amendment, deletion, retrieval
○ disclosure or otherwise making available/accessible
○ transfer o restriction, blocking
○ erasure or destruction.

3.3 Processed personal data

Permobil collects and utilizes only the personal data (including special category, sensitive data) required to process your job application and operate the recruitment process. To determine whether you have the necessary professional skills and experience for the position, as well as to do any necessary legal checks.

Permobil may process the following categories of data which, in itself or in combination with other data, may constitute personal data and for the general purposes stated in Table 1 below.

Please keep in mind that the list below is exemplative and is not meant to be exhaustive, and that Permobil may not process all of the data. Furthermore, some of the processing purposes overlap, and there may be multiple purposes that justify our use of your personal data.

3.4 Legal grounds of processing personal data

For the purpose of recruitment, Permobil will process your personal data based on either of the following legal grounds

3.4.1 Legitimate interests

Permobil may process your personal data if such processing is necessary for the purposes of a legitimate interest pursued by Permobil or a third party. It is generally considered to be in Permobil's legitimate interest to manage its daily operations, secure its facilities and equipment and keep internal control. Permobil needs to process certain personal data about candidates whereas Permobil's legitimate interest is to enable administration of their user profiles and/or to otherwise administrate their application for a position at the Permobil Group.

3.4.2 Consent

In exceptional cases or if no other legal ground can be applied, Permobil may ask for your explicit consent to process certain personal data. Such consent is your choice and is entirely voluntary and revokable.

Table 1

Data categories	Purposes of Processing	Legal Ground(s)
Individual data, such as name, date of birth, gender, nationality, preferred language and photo, video, sound recording made via remote conferencing platforms, on-site CCTV or voice recordings for security purposes	Enabling registration of candidates in Permobil's recruitment systems General administration of applications	Legitimate interest (to manage applications)
Contact data, such as home address, location preferences, email and telephone number	Enabling communication with candidates	Legitimate interest (to communicate with candidates)
IT-related data, such as e-mail and password for the Permobil recruitment system including automatic messages and other communication, electronic identification and systems access data (e.g. picture or facial image, publicly available profiles on social media, online identifiers/cookies, user name, passwords, secret questions and answers, system login and activity logs, access and connection times	Enabling the use of and communication through Permobil's recruitment system	Legitimate interest (to manage applications)
Competence data, such as CV, including information on work related experience, education, trainings, professional memberships, diplomas, certifications, reference letters as well as other data that you provide us during interviews at our premises or via digital channels	Enabling assessment of the candidates' skills and qualifications for the position	Legitimate interest (to assess candidates)
Performance and evaluation data, such as personal and analytical tests including your responses and supplier generated reports and evaluations in connection with recruitment processes	Enabling assessment of the candidate's skills and qualifications for the position	Legitimate interest (to evaluate the candidate's competences for the position) Consent (regarding certain tests)
Health data, such as results from health examinations and drug tests, disability	Enabling assessment of the candidate's health status	Consent
Security data, such as information obtained through background checks (only for certain positions and only when legally permitted in your country)	Enabling assessment of the candidate's background (if needed for the specific position)	Consent (to enable relevant third parties to release information about you)
Other information that you voluntary share with us about yourself	Enabling assessment of your eligibility for the role	Consent
If your application is unsuccessful, keep all of the above information in our Talent Pool for 12 months.	Consideration with other potential positions within the Permobil Group and keep you informed regarding potential career opportunities that suit your profile.	Consent
Other purposes, and/or legal grounds and further data categories Please be advised that for other purposes and/or on other legal grounds other/additional personal data of yours might be processed by us. For instance, if (either as part of the recruitment process) you visit our websites, or in person our offices, production sites, you might be the subject of other data processing activities of ours (like cookie management or CCTV monitoring, and so forth). Data privacy rules regarding these activities are laid down in the respective (separate) data privacy notices that will be communicated with you as website or physical site visitor, etc. in due course via the respective channels. Permobil might also process your personal data if doing so is required to comply with a legal obligation, such as court orders or legal reporting requirements. Permobil might process your personal data to protect your and others' vital interests if Permobil has reasonable grounds to believe that such processing will prevent or minimize any serious potential harm to you or others.

4. Special category (sensitive) data and special purposes of data processing

Special categories (sensitive) personal data

Certain aspects of health and security data may be considered special category (sensitive) personal data under applicable data privacy regulations and must be handled with more care and require additional safeguards.

Insofar as strictly necessary and legally permitted, your sensitive personal data will be collected only if you voluntarily allow for disclosure or (we obtain your explicit consent) or, if we are required by law (such as visible or reported disabilities or protected group belonging, religion or church affiliation, diversity and inclusion related information, labor union membership).

Automated decision-making

Permobil online recruitment system may incorporate screening questions to determine whether individuals meet predefined minimum conditions for open positions. Please keep in mind that if you respond negatively to any of the screening questions, you may be automatically eliminated from the recruitment process by the recruitment system's automatic determination algorithms. In this instance, you will receive an automatic message informing you that your application has been rejected.

5. Recipients of personal data

Permobil ensures that recipients of the personal data are limited to our employees who have the role and responsibility of managing the recruitment process. Additionally, Permobil may share data with external parties such as service providers supporting our recruitment procedure that process Personal Data under Permobil's instructions.

In the course of our activities and for the same purposes as those listed in this Candidate Privacy Notice, your personal data can be accessed by, or transferred to the following categories of recipients or third parties, on a need-to-know basis to achieve such purposes:
● our personnel (including personnel, departments of any controlled entities of Permobil);
● our services providers that provide services and products to us;
● our IT systems providers, cloud service providers, database providers and consultants;
● any third party to whom we assign or novate any of our rights or obligations; and
● our advisors and external lawyers in the context of the sale or transfer of any part of our business or its assets.

The above referred third parties are contractually obliged to protect the confidentiality and security of your personal data, in compliance with applicable law.

We may share personal data you submit with selected service providers or consultants acting on our behalf that may assist us in recruiting talent, performing data analysis, providing talent or application management systems, providing IT or related infrastructure, providing communication or reach out services, administering and evaluating pre-employment screening and testing, and improving our recruitment process. Your personal information can also be accessed by or transferred to any national and/or international regulatory, enforcement, public body or court, where we are required to do so by applicable law or regulation or at their request.

If your application concerns a job in the UK , we will also check your details against fraud databases, including background checking contractor and if you have submitted fraudulent information in your application we will record this information on the database. This information will be available to other organisations, including law enforcement agencies.

6. Data transfer

Recipients may be located both within and outside of the jurisdictions of yours as candidate, also in countries that do not have the same data protection rules as those found within the jurisdiction.

If such data transfer occurs, Permobil takes the appropriate measures to ensure the security and integrity of your information, as well as that it is processed in accordance with the standards of these jurisdictions. For instance, transfer of data within the Permobil is governed by Group Data Processing Agreement and transfer to vendors and service providers are subject to EU Standard Contractual Clauses.

7. Legal Disclosures

Permobil will disclose your Personal Information when required by law or legal process, in litigation, and/or to respond to requests from public and governmental authorities within or outside your country of residence. We are also required to disclose information about you if we determine that for purposes of national security, law enforcement, or other issues of public importance, disclosure is necessary or appropriate. When we receive information requests, we require that it be accompanied by the appropriate legal documents such as a subpoena or search warrant. We believe in being as transparent as the law allows about what information is requested from us. We carefully review any request to ensure a valid legal basis for it, and we limit our response to only the data law enforcement is legally entitled to for the specific investigation.

8. Timeframe of processing personal data

Permobil will normally keep your personal data until the recruitment process has been concluded, and two (2) years thereafter (or longer dependent on applicable employment legislation) to satisfy the need to use such personal data in the event of an actual, threatened or anticipated dispute or claim. If consent has been given to store personal data for future recruitment needs, it will be stored until a future recruit or withdrawal of your consent.

9. Safeguarding personal data

We use industry-standard technologies, such as firewalls, encryption techniques, and authentication procedures, among others, designed to protect the security of your Personal Data and to protect Permobil accounts and systems from unauthorized access.

Although we strive to keep your Personal Information secure, no security measures are perfect, and we cannot guarantee that your Personal Information will never be disclosed in a manner inconsistent with this Candidate Privacy Notice (for example, as the result of unauthorized acts by third parties that violate the law or this Candidate Privacy Notice). Permobil is in no way liable for any claims or losses of any kind related to the use or misuse of your Personal Data due to the activities of third parties outside of Permobil's control or due to your failure to maintain the confidentiality and security of your Personal Data. We are not responsible if someone else accesses your account through registration information they have obtained from you or through a violation by you of this Candidate Privacy Notice or the applicable laws.

10. Your data protection rights

You may be entitled, where provided for under applicable data privacy laws and regulations, to:
● Request access to the personal data Permobil process about you: this right entitles you to know whether we hold personal data about you and, if we do, to obtain information on and a copy of the specific pieces and categories of personal data.
● Request a rectification of your personal data: this right entitles you to have your personal data corrected if it is inaccurate or incomplete.
● Object to the processing of your personal data: this right entitles you to request that Permobil no longer processes your personal data.
● Request the erasure or deletion of your personal data: this right entitles you to request the erasure or deletion of your personal data, including where such personal data would no longer be necessary to achieve the purposes.
● Request the restriction of the processing of your personal data: this right entitles you to request that Permobil processes your personal data only in limited circumstances, including with your consent.
● Request portability of your personal data: this right entitles you to receive a copy (in a portable and, if technically feasible, readily usable format) of your personal data, or request Permobil to transmit such personal data to another data controller.
● In the event that our processing of your personal data or part thereof is based on your consent, to withdraw at any time your consent, in which case Permobil will cease any further processing activities of your personal data or the relevant part thereof (however such withdrawal will not affect the legality of the data processing activities prior to the withdrawal).

Please keep in mind that Permobil is not necessarily required to fulfill a request for deletion, restriction, objection, or data portability. Permobil's legal obligations and exceptions to such rights may be assessed on a case-by-case basis. You also have the right to file a complaint with a supervisory body over Permobil's processing of your personal data.

For more information about these rights and how to exercise them, please contact us by via email or submitting a request form . You also have the right to lodge any complaints you may have in regards with Permobil's processing of your personal data to a supervisory authority.

Future Changes

Permobil may update this Candidate Privacy Notice from time to time. When changed it in a material way, a notice will be posted on our website along with the updated Candidate Privacy Notice. Please check here from time to time for changes.

What happens if there is a change in ownership?

Personal Data will be shared and transferred as part of any merger, acquisition, sale of company assets or transition of service to another provider. This also applies in the unlikely event of an insolvency, bankruptcy or receivership in which customer and user records would be transferred to another entity as a result of such a proceeding.

California Residency Candidate Privacy Notice

1. Purpose
Permobil ("Permobil" or "We") provides this Privacy Notice for California Residents to explain our practices regarding the collection, use and other processing of certain individually identifiable information about members of the Permobil workforce in California ("Personal Information"), as required by the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, as amended ("California Privacy Law"). This notice supplements our Global Data Privacy Notice and Candidate Privacy Notice. Please note that your use of Permobil’ systems, including but not limited to any and all telephone conversations or transmissions, electronic mail or transmissions, or internet access or usage, may be monitored or intercepted by Permobil as permitted by law at any times by any lawful means.

We do not sell your Personal Information or share it for cross‐context behavioral advertising. Permobil does not engage in providing financial incentives for the disclosure of California personal information. We do not engage in any use or disclosure of sensitive personal information except as necessary to provide benefit services or as otherwise permitted by California Privacy Law to comply with federal, state, or local laws.

To the extent you are not a current Permobil employee but are applying for a role within Permobil, please note that some of the Personal Information described below would not be collected from you unless you are employed by Permobil. To learn about the personal data that is collected from non-employees who are applying for roles within Permobil, please review the Candidate Privacy Notice.

2. Categories of Personal Information

Permobil may collect, use, or otherwise process the following categories of Personal Information (and any other categories of Personal Information reasonably necessary for us to carry out our legal or regulatory obligations). Some of the following categories of Personal Information may be supplied by you voluntarily in your sole discretion (for example, certain characteristics of protected classifications).

2.1.Identifiers, such as name, postal address, unique personal identifier such as BRID number, email address, telephone number, social security number, driver’s license number, passport or other government identification number

2.2.Professional and employment-related information, including but not limited to staff information such as job title, cost center and attendance; work authorization documentation (e.g., permits, visas); photos/images of you taken or obtained for business-related purposes or during events organized or sponsored by Permobil; information contained in recruitment application and assessment forms (e.g., CV information, interview feedback, academic/professional qualifications); payroll information; performance management details (such as appraisals, objectives and learning/training records); entry and exit times at Permobil premises; and emergency contact information.

2.3.Internet and other electronic network activity information , relating to the use of and access to Permobil' IT system/hardware, including but not limited to IP address.

2.4.Geolocation data, only when you voluntarily enable geolocation tracking via a Permobil-provided mobile app.

2.5.Education information, as contained in your recruitment application and assessment forms, including education details, academic qualifications and professional certifications.

2.6.Characteristics of protected classifications including, for example, race, gender, ethnicity, national origin, gender identity, sexual orientation, date of birth, medical condition, and personal status (e.g., marital status, maternity leave information). As noted above, some of these characteristics may be provided voluntarily by you in your sole discretion.

2.7.Biometric information, consisting of imagery of your fingerprints (this only applies to specific teams, and you’ll be made aware if this is applicable to you).

3. Purposes and Basis for Processing Personal Information

Permobil may process Personal Information for the following purposes:
● Administering the employment relationship and providing compensation
● Administering and providing benefits and other work-related allowances
● Administering the workforce
● Complying with labor-related laws and requirements
● Monitoring and ensuring compliance with applicable laws, regulatory requirements, and Permobil policies or procedures
● Fraud prevention
● Communicating with you, other Permobil workforce members, and third parties
● Communicating with your designated contacts in case of an emergency
● Initiating legal action, and responding to and complying with requests and legal demands
● Complying with corporate financial responsibilities
● Managing corporate information technology and security
● Conducting security screenings
● Using precise geolocation of devices assigned to you, only when you voluntarily enable geolocation tracking via a Permobil-provided mobile app, for purposes of providing you with security assistance that you request
● Fingerprint images for security purposes and where required by law or regulation; these may be shared with our regulators where required
● Conducting other activities needed for legitimate business purposes

4. Security

The security and confidentiality of your Personal Information matters to us. That’s why we have technical, administrative, and physical controls in place to protect your Personal Information from unauthorized access, use, and disclosure.

Our outside service providers must also protect your Personal Information and use it only to meet our business needs. We also take steps to protect our systems from unauthorized access. And we comply with all laws that apply to us.

5. Retention Periods

We store your Personal Information strictly and to the extent necessary for the performance of our obligations, and for the time necessary to achieve the purposes for which the Personal Information was collected, in accordance with our record retention obligations, legal holds, or any applicable laws. When we no longer need to use your Personal Information, we will remove it from our systems and records and/or take steps to properly render it unintelligible, unless a legal reason exists to retain it.

6. California Rights

Under California Privacy Law, individuals who are residents of California have rights to request access (right to know), correct, and delete their own Personal Information to the extent required by applicable law. To exercise these rights, or for any questions, please email the Subject Access Request team at privacy@permobil.com and include in the subject line "CPRA Request."

In general, Permobil will not provide access (right to know) to Personal Information in internal investigations files, legal files, ethics files, and audit work papers that are protected as Permobil proprietary Information, Attorney-Client and/or Attorney Work Product Privileged Information. Permobil may apply any exceptions or other conditions available under law when responding to any access (right to know) requests, including exceptions to protect against full disclosure of sensitive personal information (e.g., only providing last 4 digits of social security number); to limit productions in response to requests that are manifestly unfounded or excessive, would compromise Permobil' ability to comply with law, would interfere with legal privilege/evidentiary rights, or otherwise interfere with the ability to exercise or defend legal claims.

Additionally, on receipt of an access request, Permobil is not required to search and provide Personal Information that is not maintained in a searchable or readily accessible format; is maintained solely for legal or compliance purposes; and is not sold or used for any commercial purpose (we do not sell your Personal Information or use it for any commercial purpose). If you submit a request to access your Personal Information, and we determine that these conditions are met as to any category of Personal Information, we will let you know in our response to your request.

Permobil may rely on any exceptions, preemptions or other conditions available under law when responding to correction, deletion or other requests. Permobil will generally fulfill requests for access, correction and deletion within 45 days of receiving a valid request. Permobil may extend the response time by another 45 days by notifying you of the time extension.

By choosing 'I agree' below, you are agreeing to your information being held and used as described above.

If for any reason your personal data held here is incomplete or inaccurate or if you object, on a legitimate ground, to the use of your personal data on this system, you can make request for the amendment, or the deletion of your personal data. If you would like to make such a request or if you have any question in relation to the above, please send an email to privacy@permobil.com

By registering with or logging into this area of the website, you accept the use of cookies.

China – Personal Information Protection Act Notification

In compliance with the Personal Information Protection Act of the Republic of China (the "PIPA"), we would like to notify you, as a data subject, of the following:

	Items	Notification
1	Purposes of Collection	Your personal information may be collected, processed, used and transmitted internationally by us for the following purposes: 1. processing your application for employment; and 2. purposes as defined by the Ministry of Justice of the Republic of China ("MOJ") in Schedule 1 of this letter.
2	Categories of Personal Information	The categories of your personal information which may be collected, processed, used and transmitted internationally, as defined by the MOJ, are specified in Schedule 2 of this letter.
3	Location	Your personal information may be collected, processed, used and transmitted internationally within or outside the Republic of China in the jurisdictions where the relevant Permobil Group Entity is located, or to such other locations as may in the future be notified to you.
4	Relevant Entities	Your personal information may be collected, processed, used and transmitted nationally or internationally by the relevant Permobil Group Entity, its employees, agents, professional advisors, third party service provider who provides administrative, management, human resources support and management services, or other services to the relevant Permobil Group Entity, and any other party which is not restricted by the competent authority for international transmission of the personal information. Some of the recipients of your personal information listed above may be located in countries with legislation containing a different level of protection of personal information as your country of residence.
5	Method	Your personal information may be collected, processed, used and transmitted internationally by automatic machines or other non-automatic means in compliance with the applicable laws and regulations on personal information protection (including but not limited to electronic documents, physical documents or any other appropriate means under the then existing scientific techniques).
6	Your Rights	Under and in accordance with the PIPA, any data subject has the rights: 1. to access or to request for review or copy of his personal information, in which case we have the right to charge a reasonable fee in accordance with the laws; 2. to request for supplement or correction of his personal information upon appropriate justification by the data subject; and 3. to request for discontinuance of collection, processing, use or international transmission, and deletion, of his personal information; provided that we may refuse such request to the extent such collection, processing, use or international transmission of personal information is necessary for our business operation. If you wish to exercise any of the above rights, you may submit a written request together with the supporting documents to us. We will notify you of our decision on your request within fifteen (15) days after the next day following receipt of your written request. If necessary, such fifteen (15) days period may be extended for another fifteen (15) days in which case we will notify you in writing. In connection with a request to access or review the personal information, you shall, upon receiving our response, arrive at the location specified by us within the specified period to access or review the documents. Failing which you will need to submit a new written request to us.
7	Consequences of Not Providing Your Personal Information	You have the sole discretion to decide whether you wish to provide your personal information to us, unless required by law. If you refuse to provide your personal information, we may in our sole discretion decide whether we will proceed with your application for employment.
8	Other Matters	You agree that we have the right to revise this letter from time to time. In the event this letter is revised, we will provide you with the hyperlink to the website containing the revised notification letter. If applicable, please review the contents of the designated website carefully and follow the instructions thereon to indicate your acceptance if necessary.

Schedule 1: The Specific Purposes as Defined by the MOJ (002) human resources management; (003) arrival, departure and immigration; (059) the collection, process and use by financial service enterprises according laws and regulations and for the need of financial supervision; (060) financial dispute resolution; (061) financial supervision, management and examination; (063) the collection, process and use of personal information by non-government agency for fulfillment of regulatory obligations; (064) health and medical services; (068) trust business; (069) contractual, quasi-contractual or other legal relationship affairs; (090) consumer and customer management and services; (104) billing management and credit transaction business; (114) labor administration; (120) tax administration; (129) accounting and relevant services; (136) information (tele-) communication and database management; (137) information (tele-) communication security and management; (150) auxiliary and back-office supporting management; (154) credit checks; (157) investigation, statistics and research analysis; (166) securities, futures, securities investment trust and consulting relevant business; (168) passport, visa, and verification documents processing; (177) other financial management business; (181) other business conducted under the business registration items or organizational articles of incorporation; (182) other advisory and consulting services.

Schedule 2: The Specific Categories of Personal Information as Defined by the MOJ
1. Identification category
(C001) for identification of individual; (C002) for identification of finance; (C003) for identification in government documents;
2. Characteristic category
(C011) individual description; (C012) description of bodies;
3. Household status
(C021) household status; (C023) details of other members in the family;
4. Social status
(C031) residence and facilities; (C032) properties; (C033) immigration status; (C034) travel and other transportation details; (C038) occupation;
5. Education, examination and election, techniques or other professions
(C051) academic records; (C052) qualification or techniques; (C053) occupational group member qualification; (C054) occupational expertise; (C057) record of students (members) and examination takers;
6. Employment status
(C061) current employment status; (C062) employment history; (C063) jobs leaving history; (C064) work experiences; (C065) work, travel and attendance records; (C066) health and security records, (C068) salaries and withholding amount; (C070) details of work management; (C071) evaluation details of work; (C072) training records; (C073) security details;
7. Financial details
(C083) credit ratings; (C086) note credit; (C087) allowances, benefits, gifts; (C088) insurance details; (C089) social security payment, home care payment and other retirement payment; (C091) properties or services provided by the subject of the personal information; (C093) financial transactions; (C094) indemnification;
8. Business information
(C102) arrangement or agreement; (C103) licenses related to business; (C111) health records; (C116) criminal suspicion information;
9. Other categories of information
(C131) search of written documents; (C132) non-categorized information.

Note: Schedules 1 and 2 may be amended in accordance with the specific purposes and categories of personal information as promulgated by the MOJ from time to time.

Last Updated: July 1, 2023

Global Candidate Privacy Notice

Introduction

Global(GDPR)

California Residency Candidate Privacy Notice

China – Personal Information Protection Act Notification