Applicant Privacy Notice

I. Data Controller

The controller responsible for the processing of personal data described in this Applicant Privacy Notice is:

Further company information and contact details are available in our Imprint.

II. Personal Data We Process

We process the personal data that you provide to us in connection with your application. This may include, in particular contact details, information about your professional background, qualifications and employment history, salary expectations, and where relevant for the position or the applicant’s circumstances, information regarding your right to work or work authorisation, as well as any other information contained in your application documents or otherwise provided by you during the recruitment process.

III. Purposes of Processing and Legal Basis

We process your personal data for the purpose of assessing your suitability for the position applied, conducting the recruitment process and deciding whether to stablish an employment relationship with you.

For applications relating to employment in Germany, the legal basis for this processing is Section 26(1) sentence 1 of the German Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG).

Where necessary after completion of the recruitment process for the establishment, exercise or defence of legal claims, the legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the establishment, exercise or defence of legal claims.

Where special categories of personal data within the meaning of Article 9 GDPR are processed, such processing will only take place where permitted under applicable law, in particular Section 26(3) BDSG in conjunction with Article 9(2) GDPR.

IV. Data Obtained from Other Sources

In addition to the information you provide directly to us, we may where relevant to the recruitment process, process professional information obtained from publicly accessible sources, such as professional networking platforms or other publicly available sources.

This may include information about your professional background, qualifications and employment history. Such information is processed only where relevant for assessing your suitability for the position applied for and where permitted under applicable data protection law.

The legal basis for such processing is Article 6(1)(f) GDPR. Our legitimate interest is to assess the suitability of applicants for the relevant position.

V. Recipients of Personal Data

Within our company, access to your application data is limited to those persons who require it for the recruitment process, in particular employees in Human Resources and the managers or departments involved in the relevant recruitment decision.

Personal data may also be processed by service providers acting on our behalf, in particular hosting and IT service providers. Where they process personal data on our instructions, they act as processors in accordance with Article 28 GDPR.

VI. Retention of Personal Data

If your application is unsuccessful, we retain your application data for six months after completion of the recruitment process in order to establish, exercise or defend legal claims, unless a longer retention period is required or permitted by law.

If you are hired, relevant application data may be transferred to your personnel file and processed further for employment-related purposes.

If you have consented to being considered for future vacancies, we may retain your application data for the period covered by your consent. You may withdraw your consent at any time with effect for the future.

VII. Data Subject Rights

Subject to the conditions set out in applicable data protection law, you have the following rights regarding your personal data:

• the right of access in accordance with Article 15 GDPR;
• the right to rectification in accordance with Article 16 GDPR;
• the right to erasure in accordance with Article 17 GDPR;
• the right to restriction of processing in accordance with Article 18 GDPR;
• the right to data portability in accordance with Article 20 GDPR;
• the right to object to processing in accordance with Article 21 GDPR.

Where processing is based on your consent, you also have the right to withdraw your consent at any time with effect for the future in accordance with Article 7 (3) GDPR.

VIII. Right to Object

Where we process your personal data on the basis of Article 6(1)(f) GDPR, you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data.

IX. Data Protection Officer

You can contact our Data Protection Officer at:

datenschutz@abx-cro.com

You may contact our Data Protection Officer directly with any questions regarding to the processing of your personal data or the exercise of your data protection rights.

X. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data infringes applicable data protection law.

The supervisory authority competent for us is:

Sächsische Datenschutz- und Transparenzbeauftragte

(Saxon Data Protection and Transparency Commissioner)

Maternistraße 17

01067 Dresden

Germany

Email: post@sdtb.sachsen.de

You may also lodge a complaint with another competent supervisory authority, in particular in the EU Member State of your habitual residence, place of work or the place of the alleged infringement.

XI. Where We Process Personal Data

Applicant data is processed within the European Economic Area (EEA).

Last updated: 11 September 2026