Privacy statement for job applicants pursuant to the EU General Data Protection Regulation (EU 2016/679) (“EU-GDPR”) and United Kingdom General Data Protection Regulation (“UK-GDPR”) under Data Protection Act 2018
Dear Job Applicant,
Within the meaning and the purposes of Art. 13 of the EU Regulation 2016/679 on the protection of personal data (hereinafter, “Regulation” or “GDPR”), we inform you as follows:
1. Data controller. In this notice, the term “we,” “our,” and “us” refers to the Westlake legal entity to whom you have submitted your employment application. We act as data controller with respect to your employment application and are responsible for deciding how we hold and use personal information about you.
2. Purposes of the processing and legal basis for the processing
We process personal data of our job applicants for the following purposes:
- Conducting the application process, in particular, reviewing applications, contacting the applicant and conducting interviews to evaluate and select suitable applicants.
- Participation in the works council in the hiring process to fulfil legal obligations.
- Comply with any legal requirements or obligations.
- Retention for evidentiary purposes to assert legal claims or defenses.
- If you give us your consent to do so, we will store your data collected during the application process for a period of 12 months in the event that you are not hired, in order to consider you for future job offers, in particular to check your suitability for future job offers and to contact you to initiate an application process.
- Data protection-compliant deletion, destruction or anonymization of personal data
Depending on the purpose of processing, the following legal bases apply to data processing:
- Art. 6 (1) (b) GDPR (processing for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract)
- Art. 6 (1) (c) GDPR (processing for compliance with a legal obligation to which the controller is subject)
- Art. 6 (1) (f) GDPR (processing for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data)
- Art. 6 (1) (a) GDPR (the data subject has given consent to the processing of his or her personal data for one or more specific purposes)
3. Processed categories of personal data.
We process the following categories of personal data, but of course only to the extent necessary for the above purposes:
- Master data (e.g.: name, date of birth, nationality, marital status)
- Contact data (e.g.: private transcript, e-mail address, telephone number)
- Application data (e.g.: contents of application documents (in particular, photo, resume, and references), correspondence regarding the application and form interview notes, perceptions from job interviews, feedback, and evaluations or examinations
4. The recipients of your personal data, including transfers to a third country.
In principle, we do not pass on personal data of applicants to third parties. In exceptional cases, however, it may be necessary for us to pass on your data to the following categories of recipients for the above[1]mentioned purposes, but of course only to the extent necessary in each case for the above-mentioned purposes:
Westlake Corporation, 2801 Post Oak Blvd., Ste. 600, Houston, TX 77056, USA
The Westlake Group, to which we belong, is a globally active company headquartered in the USA. In order to meet the needs of its customers, many of which are also international companies, the Westlake Group operates within a matrix organization and therefore requires its employees to work with colleagues, supervisors and managers across the Group at all locations. Although the position is organizationally located in the EU and/or UK in accordance with the job description and/or the employment contract, the employee performs his work in a group-wide environment, which requires interaction and information exchange between different Westlake companies, in particular with the group parent company Westlake Corporation in the USA. This exchange of information serves primarily to grant certain Group-related employee benefits and compensation components, to compile Group-wide employee statistics, to engage in Group-wide personnel planning, training, and development, and to manage employees within the Group, and is legitimized by executed EU - standard contractual clauses.
5. Transfer of your personal data to a third country. The Data Controller is a subsidiary of Westlake Corporation (“Westlake”). As explained in par. 4, Westlake and its subsidiaries operate under a matrix organizational structure whereby employees are expected to coordinate and interact with colleagues, managers, and senior leadership in international locations for operational and other business purposes.
For the same purposes mentioned in par. 2, your personal data may be transferred to Westlake in the USA or to Westlake subsidiaries that are based in the EU. In particular, to fulfil any of the purposes described in par. 2, your personal data may be transferred, in electronic or other form, to human resources personnel and senior management employed by Westlake Management Services, Inc., a U.S.- based subsidiary of Westlake (“WMS”), Westlake Germany GmbH & Co. KG, Westlake Vinnolit GmbH & Co. KG, Westlake Epoxy GmbH, German-based subsidiaries of Westlake, or Westlake Epoxy B.V., a Netherlands-based subsidiary of Westlake.
The Data Controller has entered into contractual commitments with Westlake and its subsidiaries to secure your personal data in accordance with applicable law. The Data Controller, Westlake, and Westlake’s subsidiaries are committed to maintaining stringent privacy and security practices.
There is no adequacy decision by the EU Commission within the meaning of Art. 45 (3) of the GDPR for transferring personal data to Westlake and WMS in the USA. This transfer of personal data to Westlake and WMS is subject to standard contractual clauses pursuant to Art. 46 (5) of the GDPR and Art. 26 (4) of Directive 95/46/EC. A copy of the standard contractual clauses can be obtained via [email protected].
6. Means of the processing. The processing of your personal data is carried out by either automated and non[1]automated means, either in digital and paper format, always respecting the rules of confidentiality and security provided for in the Regulation and in any other current legislation. Other than by the Data Controller, your personal data may be processed by other specifically authorised subjects (natural and/or legal person) within the framework of this Privacy Policy, such as employees.
7. Data retention period. Your personal data will be stored for the time of duration of the employment relationship and for a variable period after the termination, depending on the legal statute of limitations of the rights for which retention of the data is necessary. In the event that your application was not successful and you have not given us your consent for further storage, your application documents will be deleted after 12 months.
8. Your rights. Your data will be processed lawfully, fairly and in a transparent manner. You have the following rights, which may be exercised at any time: (1) the right to lawful access to your personal data; (2) the right to rectify your inaccurate personal data and supplement incomplete personal data; (3) the right to erase your personal data if there is no (longer a) lawful ground for us to process your personal data and withdraw your consent where the processing was based on your consent (without affecting the lawfulness of processing based on consent prior to your withdrawal); (4) the right to restrict the processing of your personal data (and unless we have compelling legitimate grounds for the processing, we will then cease the processing); (5) the right to data portability; (6) the right to object to the processing of your personal data; (7) the right not to be subject to an automated individual decision-making, including profiling; and (8) the right to lodge a complaint with a data supervisory authority (EU/EEA) or the Commission (UK). You are also entitled to send us specific instructions regarding the use of your personal data after your death.
To exercise your rights, you may contact your local Human Resources representative or send an e-mail to the following address: [email protected].