If you are located or are applying to work outside of the European Union/EEA, please also review the Annexes applicable to your region for further information about our collection, use and processing of your personal data:
• Annex III – Middle East and Africa ("Middle East and Africa Annex)"
In the event of conflict between the content of this Privacy Notice and the applicable regional annex, the latter shall prevail.
Annex III – Middle East and Africa ("Middle East and Africa Annex")
Reference to controller, data subject, personal data, process, special categories of personal data and supervisory authority in this Privacy Notice and Middle East and Africa Annex shall include the equivalent terms under applicable laws in the Middle East and Africa region.
DATA CONTROLLER AND CONTACT DETAILS
The Beiersdorf entity that you are making an application to work for is the data controller collecting and processing your personal data as described in this Privacy Notice. Details of the relevant Beiersdorf entity is available here: Global Business | About Us - Beiersdorf .
You can find the contact details of the Data Protection Officers or representative of the relevant Beiersdorf entity below.
For each of Kenya, South Africa, and Nigeria, the contact details for privacy-related inquiries are as follows:
COLLECTION OF PERSONAL DATA
In principle, your personal data will be collected directly from you by automated and non-automated means.
In line with local data protection laws, where we collect your personal data from third parties, we will do so only as permitted by law. This includes where you have consented, made the data publicly available, or where collection is necessary for a legitimate purpose (such as verifying application details). The legal basis for this collection, as well as the types of personal data and sources involved, are outlined in the relevant sections of this Privacy Notice.
PURPOSES OF AND LEGAL BASES FOR PROCESSING
In the Middle East and Africa, where the legal basis set out in the Legal Basis for Processing section in the Privacy Notice above does not apply under applicable law, or where required by applicable law, we will obtain your consent to the collection, use, transfer and other processing of your personal data or we will rely on another lawful basis for processing as recognized by applicable data protection laws.
The specific legal basis we rely on will depend on the nature of the processing and the applicable local law. Where consent is required, we will ensure that it is obtained in accordance with applicable data protection laws.
DATA RETENTION
Supplemental Information for South Africa: Notwithstanding the general data retention principles outlined above, for South Africa, we retain both your Candidate Profile Data and your Application Form Data, Application Documents Data, Online Assessment Data, Referee Data, and Public Professional Data for 6 months after the last activity or finalization of the recruitment process, respectively, in line with the applicable limitation periods for employment-related claims under South African law.
In each case, personal data may be retained longer where required to comply with legal obligations or for the establishment, exercise, or defense of legal claims, as further described above.
DATA SHARING
Where we share your personal data with third parties, we will put in place adequate measures such as binding contractual arrangements with the third parties to ensure they process your personal data in accordance with our instructions and applicable laws; including undertakings that the third parties will adopt appropriate security measures to protect your personal data.
DATA SHARING OVERSEAS TRANSFERS
To the extent required by applicable laws, and where we will be sharing, transferring, or storing your personal data outside of the location where you reside and/or work and/or the location in which the personal data was initially collected, including in the European Union, the APAC region, the Americas, and the EMEA region, including any subsequent onward transfers through additional countries (for example, data first hosted in the European Economic Area and then accessed from another location), we will ensure that every step of such transfers of personal data comply with applicable laws and this Privacy Notice and that the recipient entities provide an adequate level of data protection that is at least comparable to the protection set out under applicable laws to protect the integrity and security of your personal data. Where the recipient entities are not subject to adequate data protection laws the recipient entities will be required to enter into a binding agreement containing adequate data protection provisions and restrictions on further transfers of personal data. To the extent that the transfer of any personal data (including special category or sensitive personal data – such as health or disability information) requires any additional requirements under applicable laws are satisfied prior to transfer such as prior authorisation / regulatory approval from the relevant supervisory authority in a particular country, we will ensure that such prior authorisation / regulatory approval has been obtained prior to transferring the personal data.
LEGAL RIGHTS IN RELATION TO PERSONAL DATA AND HOW TO EXERCISE THEM
Depending on where you are located, you may have one or more of the following data subject rights, subject to applicable laws (including without limitation as listed in Article 11 of the Turkish Law No. 6698 on the Protection of Personal Data):
- right to request access to a copy of your personal data;
- right to request rectification or correction of your personal data;
- right to request the destruction or deletion of your personal data (in certain circumstances)
- right to object on reasonable grounds to the processing of your personal data (such as where the processing is on the basis that it protects your legitimate interests or is necessary for pursuing our legitimate interests or the legitimate interests of a third party to whom the personal data is supplied);
- right to object to the processing of your personal data for the purposes of direct marketing and for the purposes of conducting statistical surveys (unless the processing is necessary for purposes of public interest or in violation of any applicable laws);
- right not to be subject to a decision which is based solely on the basis of automated processing of your personal data;
- right to withdraw consent (where such consent was obtained and relied on for the purposes of the processing);
- right to institute civil proceedings;
- right to be informed of a violation or breach of your personal data within the legally prescribed timeframe, where required under applicable data protection laws (for example, in some jurisdictions, when the breach is likely to result in a material risk to your rights and freedoms);
- right to request data portability (in a format that is technically feasible); and
- right to lodge a complaint with the relevant supervisory authority. Information about the relevant supervisory authority is as follows:
- South Africa:
Information Regulator
Website: https://inforegulator.org.za/
Complaints form: POPIA Form 5
Email: POPIAComplaints@inforegulator.org.za
- Kenya:
Office of the Data Protection Commissioner
Website: https://www.odpc.go.ke/
Complaints form: https://www.odpc.go.ke/file-lodge-a-complaint/
- Nigeria:
Nigeria Data Protection Commission
Website: https://ndpc.gov.ng/
Email: info@ndpc.gov.ng
If you are based elsewhere, you may contact the supervisory authority relevant to your jurisdiction as outlined in this Annex or in the general privacy notice.
You are encouraged to report any complaint or concern about your data privacy through the representative of the data controller or applicable data protection officer as set out in the Data Controller and Contact Details section of the Privacy Notice. We shall take action to redress any grievance within a reasonable timeframe and in any event within 30 working days, or as otherwise prescribed under applicable data protection laws. If this extends for any reason, you will be duly notified and appropriate measures will be taken to ensure that your rights and interests are protected. If you have any questions on whether you have these rights, or how to exercise these rights, please contact the data controller or applicable data protection officer as set out in the Data Controller and Contact Details section of the Privacy Notice.
DATA SECURITY
We use appropriate technical and organizational measures aimed at the protection of your personal data against accidental or unlawful destruction, loss, alteration, and unauthorized disclosure or access.
Where we share your personal data with service providers or third parties, we instruct them in writing to hold your data securely and in line with the requirements of applicable law. Service providers and third parties must implement appropriate technical and organizational measures to ensure the security of your data. Where we share your personal data with processors / operators who process personal data on our behalf we conclude binding agreements with such processors / operators containing the mandatory provisions required by applicable laws.
