Candidate privacy notice

Last modified 03 February 2025

This privacy notice describes how Avaloq Group AG and its affiliates may process your personal data when you decide to apply for a job at Avaloq. In addition to this privacy notice, we may inform you about the processing of your personal data separately, for example in specific consent forms, terms and conditions, additional privacy notices, forms, and other notices in specific applications.

We may occasionally update this privacy notice. We encourage you to periodically review this privacy notice to be informed of how we process your information.

1. Who we are

We are the Avaloq Group Ltd., a Swiss company registered at Allmendstrasse 140, 8041 Zurich, Switzerland. The term ‘we’, ‘us’ or ‘our’ means the Avaloq entity with whom you are interacting, for example the entity that published the job vacancy you applied for.

2. How we obtain personal data

We may collect and receive personal data from you through our online career portal, email, phone call, and/or any other means of communication. Personal data means any information relating to an identified or identifiable natural person.

We collect personal data that you choose to voluntarily provide to us as part of your job application process.

3. What types of personal data we may obtain

Job application and recruiting process

We may obtain and process personal data when you submit your job application, including:

• your name and contact details (e.g., salutation, first name and last name, email address, phone number, city and ZIP/post code, country of residence, nationality);
• your account details (such as username);
• your CV data (e.g., qualifications, experience, information relating to your employment history, skills and experience);
• your answers to application questions (may vary depending on the role you apply for);
• your correspondence details if you contact us;
• where applicable, image, audio and/or video of your interview with us;
• where applicable, transcripts of your interview with us;
• where applicable, your assessment (technical, behavioural, psychometric, and aptitude) results;
• traffic data (such as your internet usage);
• your answers to diversity and inclusion questions, if you chose to answer them on a voluntary basis (such answers are always anonymised); and
• information on your use of the career portal.

Additional personal data may be collected should you wish to provide further information to better match your application data with the job vacancies listed on our career portal.

Hiring decision process

We may obtain and process hiring-related personal data to determine your qualifications for employment and to make a hiring decision. This includes assessing your skills, qualifications and background for a particular role, verifying your information, carrying out reference and background checks (where applicable and legally permissible) and generally managing the hiring process and communicating with you about it.

We may collect other types of personal data if required under applicable law or if necessary, for the purposes listed below.

4. What are the purposes and legal bases for processing

Recruiting and hiring

We will only collect your personal data for our recruiting and hiring purposes. We use information held about you in the following ways:

• to consider your job application in respect of a role for which you have applied;
• to consider your job application in respect of other roles;
• to communicate with you in respect of the recruitment and hiring process;
• to assess your skills, qualifications and background for a particular role
• to assess anonymised diversity and inclusion information to advise on hiring process improvement/best practice and trends.

The personal data processing takes place at your request (consent) during the job application, recruiting and hiring process particularly for the purpose of preparation for an employment relationship with us.

We also rely on legitimate interest as the lawful basis on which we collect and use your personal data. Our legitimate interest is the recruitment and hiring of staff for our business purposes.

Staffing of particularly sensitive job positions may require further background checking. Our background checking is executed in compliance with applicable laws and regulations. The copies of your criminal records and debt register extracts (if applicable) will be thereafter screened accordingly and stored in the country of the job position you applied to.

If you become a member of one of our talent pools upon invitation, you have the option to publish your data entered by you including all the job applications in the respective country for all the team members of the recruiting team, also across the region. By becoming a member of the talent pool, you consent to be informed about interesting open job positions and events.

Complying with legal obligations

We may further process your personal data when cooperating with public and government authorities, courts or regulators in accordance with our legal obligations under applicable laws to the extent this requires the processing or disclosure of personal data to protect our rights or is necessary for our legitimate interest in protecting against misuse or abuse of our online career portal or job application process, protecting personal property or safety, pursuing remedies available to us and limiting our damages, complying with judicial proceedings, court orders or legal processes, respond to lawful requests, or for auditing purposes.

5. How we may store and share personal data

Only the people involved in the hiring decision (e.g., line managers and HR employees) have access to your personal data including your full candidate profile and documents for the purposes mentioned in Section 4. In this context, your data may be shared with a person involved in the hiring process who is within a different legal entity from the one in which you have applied to.

In case of your appointment, your data is transferred from our job application management system to our HR-administration systems. In this process, your data may be transferred to a different legal entity and will thereafter be processed as employee data. An exchange of your personal data with our other legal entities takes place especially in order to fulfil the employment contract as well as for our legitimate interest to organize our internal workflows.

We may further store the personal data we collect and receive, and share it on a need-to-know basis with the following parties:

1. Other affiliates of the Avaloq group (see here list of Avaloq group companies and locations), NEC (see here list of NEC group companies and locations) or their agents;
2. Third-party providers that perform services for us (refer to Annex 1 “List of Subprocessors”);
3. Competent public authorities or other third parties (if required by law or reasonably necessary to protect the rights, property and safety of ourselves or others).

We may also transfer your personal data in the event that we sell or transfer all or a portion of our business or assets on a need-to-know basis. Should such a sale or transfer occur, we will use reasonable efforts to direct the transferee to use personal data you have provided to us in a manner that is consistent with applicable law and this privacy notice.

We do not sell, rent, or trade your personal data.

6. How we may transfer data outside the EEA

The personal data we collect or process through the online career portal will be stored primarily in Germany.

Some of the recipients with whom we share your personal data may be located in countries other than the country in which your personal data was originally collected. The laws in those countries may not provide the same level of data protection compared to the country in which you initially provided your data. Personal data may be transferred to Singapore, the Philippines, India, Japan, Hong Kong, and the United States among others.

Nevertheless, when we transfer your personal data to recipients located in other countries, we will protect your personal data as described in this privacy notice and in accordance with applicable law, such as by entering into the European Commission’s Standard Contractual Clauses for the transfer of personal data to a processor located outside of Switzerland, UK, and the EEA and/or equivalent local transfer mechanism.

7. Links

Our online career portal may contain links to other sites. We are not responsible for the content or privacy practices of such other sites. Pay attention when you leave our online career portal and read the privacy notices of any other website that collects personal data. Your data protection and privacy rights under these third-party websites will be governed by their respective privacy practices.

8. How we protect personal data

We use a variety of technical and organizational security measures, in the context of our recruiting and hiring process including encryption, to maintain the security of your personal data. Your personal data is transmitted over a secure connection with state-of-the-art encryption methods and contained behind secured networks and is only accessible by a limited number of people who have special access rights to these systems. We limit access to your personal data to those who have a genuine business need to know it. Those processing your information will do so only in an authorized manner and are subject to a duty of confidentiality.

Further, we maintain appropriate organizational, physical, and technical security measures designed to protect your personal data against accidental, unlawful, or unauthorized destruction, loss, alteration, access, disclosure, or use. In order to protect your data, we have – among others – implemented physical access control measures suitable for preventing unauthorized persons from gaining access to data processing systems with which personal data are processed or used. We implemented technical and organisational measures designed to prevent data processing systems from being used by unauthorized persons and measures to ensure that those authorized to use a data processing system can only access the data subject to their access authorization and that personal data cannot be read, copied, modified, or removed without authorization during processing, use and after storage. When feasible we pseudonymize personal data, which means the processing of personal data in such a way that the data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to appropriate technical and organisational measures. To secure transfer control we took different measures to ensure that personal data cannot be read, copied, altered or removed by unauthorized persons during electronic transmission or while being transported or stored on data media, and that it is possible to verify and establish to which entities personal data are intended to be transmitted by data transmission equipment, e.g. use of VPN, logging of accesses and retrievals and provision of encrypted connections. Additionally, we ensure that personal data is protected against accidental destruction or loss (e. g. fire protection, data backups, secure storage of data media, virus protection, raid systems, disk mirroring, etc.) and that our systems are capable of rapidly restoring the availability of and access to personal data in the event of a physical or technical incident. However, due to the inherent open nature of the Internet, we cannot guarantee that communications between you and us or the personal information stored are absolutely secure. We will notify you of any data breach that is likely to have unfavourable consequences for your privacy in accordance with applicable law.

9. How long we retain personal data

The job application, recruiting and hiring process can be discontinued by us or you at any time.

Your personal data will be completely and permanently erased within six (6) months after the job vacancy you have applied for has been filled unless you have consented to a longer retention period.  

If you have consented to a longer retention period, your data will be completely and permanently erased within twenty-four (24) months from your data submission.  

Hired candidates’ personal data will be completely and permanently erased within twelve (12) months after the job vacancy applied has been filled.  

Alternatively, you can visit the Login website and delete your profile (in the submenu ‘options’) or submit an erasure request to dataprotection@avaloq.com. Your data will be erased pursuant to our erasure practices. Any personal data in our online career portal will be erased without undue delay. Any erasure undertaken will anonymize your data and render it unidentifiable.

Personal data that must be retained by us for legal reasons will be kept in accordance with the applicable data protection laws and regulations.

10. What are your rights

You have the following rights in relation to your personal data:

• The right to obtain, at reasonable intervals and free of charge, information on whether your personal data are being processed and to receive the personal data that is being processed in an intelligible form;
• The right to have your personal data rectified, blocked, or deleted if your personal data are incorrect, incomplete, inaccurate, irrelevant, outdated or processed unlawfully;
• The right to withdraw your consent at any time;
• The right to transfer your personal data to another controller, to the extent possible;
• The right to object on legitimate grounds to the processing of your personal data.
• The right to data portability;
• The right to file a complaint and
• The right to damages or indemnification.

To exercise these rights, please contact us using our contact details set out below. We may request you to provide a copy of your ID card or otherwise evidence of your identity. We will respond to your request within the applicable statutory term.

11. How to contact us

If you have any comments or inquiries about the information in this privacy notice, if you would like us to update your personal data, or if you want to exercise your rights, please contact our Data Protection Officer by email at dataprotection@avaloq.com.

12. Children

Avaloq understands the importance of protecting children’s privacy, especially in an online environment. Our website is not intentionally designed for or directed at children 13 years of age or younger. It is Avaloq’s practice never knowingly to collect or maintain information about anyone under the age of 13.