Information about data processing

V2 (022024)

CBRE GmbH uses the onlyfy one service (by XING) to process job applications. This Privacy Policy will inform you about the processing of your data by the onlyfy one service and by CBRE GmbH.

Shared responsibility

With regard to interaction within the company account of CBRE GmbH, CBRE GmbH and New Work SE have shared responsibility pursuant to Article 26 GDPR, as they jointly determine the purposes and means of processing pursuant to Article 4 (7) GDPR. The current version of the agreement on shared responsibility pursuant to Article 26 GDPR, which New Work SE concludes with companies that use onlyfy one, can be viewed here https://www.xing.com/terms/onlyfy-one to gain information on the key aspects of the agreement.

Data processing by New Work SE

onlyfy one is part of the extensive XING service operated by New Work SE, which pursues the aim of improving and simplifying users’ working lives with a variety of applications (onlyfy one, as well as the XING social and jobs network, kununu, etc.), and creates a more fulfilling working world of work for individuals while boosting the performance of companies. As part of the extensive XING service, onlyfy one is an online platform on which or through which talent and companies meet.

With regard to data processing for which New Work SE is solely responsible or is responsible within the scope of the shared responsibility with CBRE GmbH, detailed information is available in the XING Privacy Policy at https://privacy.xing.com/en/privacy-policy. You will also find contact details for New Work SE, as well as for the New Work SE data protection officer there.

Job applications with onlyfy one

When submitting an application, you enter into a user relationship with New Work SE for the purpose of processing applications. In addition, you will receive support and New Work SE can present you with other opportunities in support of your career. A public profile will not be automatically created for you on the XING social and jobs network. The legal basis for New Work SE processing your data is, in particular, Article 6 (1)(b) GDPR (processing necessary for the performance of a contract).

Pausing your online application

You can pause the creation of your online application at any time and continue at a later point. Cookies are used for this purpose. The data you provide to create the user account, as well as any uploaded documents, are recorded in the company account of CBRE GmbH in onlyfy one. The data remains recorded even if an application is paused and/or not completed. In this case, your application is flagged as incomplete and the data remains visible to CBRE GmbH only.

Visibility of your data

The data you have provided as part of the online application can be read, edited, or updated in your candidate profile at any time.

Notes on the special functions of onlyfy one

Calendar function

If the calendar function is used, your data is processed during and for the purpose of setting appointments within the application process. The legal basis is Article 6 (1)(f) GDPR. The calendar function is provided by an IT service provider (Cronofy Ltd., United Kingdom). The United Kingdom is classified as a secure third country based on the adequacy decision of the European Commission. Further information on data protection at Cronofy is available here: https://www.cronofy.com/gdpr/ and https://docs.cronofy.com/policies/privacy-notice/

WhatsApp application

If you use the apply using WhatsApp function, your consent, which can be withdrawn at any time, forms the legal basis for communication (Article 6 (1)(a) GDPR). When applying via WhatsApp, all required applicant information is requested during a WhatsApp chat. The data is then sent directly to onlyfy one through a service provider, and is processed further there as part of and for the purpose of the normal application process.

The apply via WhatsApp function is provided by an IT service provider (PitchYou) that can gain access to your data for this purpose. More information is available here: https://www.pitchyou.de/en/pitchyou-gdpr. Candidate data from apply via WhatsApp are transferred to onlyfy one via an interface. Immediately after this transfer, candidate data are deleted from the apply via WhatsApp infrastructure in PitchYou. Further processing then takes place exclusively in onlyfy one.

Please note that you use your personal WhatsApp account for applications, and therefore we cannot rule out that messages will be transferred, to the USA in particular. WhatsApp data protection information, such as its processing or exercising of data protection rights with regard to WhatsApp is available here: https://www.whatsapp.com/legal/privacy-policy-eea.

Subject to your consent, your application will be sent from WhatsApp via the PitchYou infrastructure to onlyfy one. You have the right to withdraw your consent to this at any time. Either way, your application data will be deleted from the PitchYou infrastructure once transferred to onlyfy one, meaning that PitchYou will not process your data any further.

Applicability of the Swiss Federal Data Protection Act (FADP)

The FADP applies to circumstances which have an impact on Switzerland, even if said circumstances are initiated outside of Switzerland. Correspondingly, this privacy policy applies to information in line with the EU GDPR and the FADP. Here, EU GDPR terminology is used in favour of FADP terminology. However, FADP terminology is used if the FADP applies and the terminology differs from EU GDPR terminology in a given language. The About this site section on XING contains the name and address of our representative in Switzerland.

1. Data privacy policy

   Preamble

   This data protection notice informs you of the reasons why CBRE GmbH ("we") collect your personal data and how we process them in connection with the application you entered through the e-recruiting system “Prescreen”.

    

   This document is for informational purposes only. The legally binding version is always the German version of this document. Prescreen International GmbH, Mariahilfer Straße 17, 1060 Vienna, Austria (hereinafter referred to as “Prescreen”) offers the e-recruiting system “Prescreen” on the *.jobbase.io domain (hereinafter referred to as “jobbase.io”), where companies can advertise job vacancies and receive and manage applications. Within the framework of these activities, Prescreen processes personal data on behalf of and for the purposes of CBRE with regard to your application. In terms of data protection legislation, CBRE is designated as a controller within the meaning of Art. 4 (7) of the General Data Protection Regulation (GDPR). Prescreen acts in this relationship as a processor within the meaning of Art. 4 (8) GDPR. The protection and confidentiality of your data are of particular importance to CBRE. Of course, your data are processed exclusively in accordance with the relevant data protection provisions, in particular the Austrian Data Protection Act (DSG), the Austrian Telecommunications Act (TKG), the German Federal Data Protection Act (BDSG) and the German Telemedia Act (TMG).. Under no circumstances will CBRE  transmit your personal details to third parties for advertising, marketing or other purposes without authorisation. If you have any questions about this Data Protection Policy, you can contact CBRE by email at dataprotection.austria@cbre.com

   1. What are personal data?
      
      Personal data are considered to be all information that allows conclusions to be drawn about your personal or material circumstances, or from which it is possible to identify you. 
   2. What data are collected?
      1. For the automated processing of your application, the following data are collected and processed:
         1. first name, surname, email address and, as necessary, address/location, date of birth, title, telephone number, nationality
         2. Additional questions depending on the respective job vacancy (e.g. driving licence)
         3. CV, in particular information about professional experience and training
         4. Skills (e.g. Photoshop, MS Office)
         5. Application photo
         6. Qualifications, awards and linguistic skills
         7. Covering letter
         8. Any files and documents that you upload
      2. We store the written electronic communication that takes place between you and us. In addition, we process comments and assessments that are written about you in the course of your application process.
      3. To allow us to adapt our services to your needs in future and facilitate easy use of our website, Prescreen as our data processor records statistical information about your surfing behaviour on their website (e.g. the areas of the website you click on or the times when you log in). This data may be recorded for the purposes of support or service optimisation and viewed at any time by the Prescreen administrator, as required. 
   3. Purpose of data collection 
      We process and use the personal data for the evaluation of the professional and personal skills of applicants and the filling of vacant positions.
   4. What are cookies?
      1. We use “cookies” to operate our website. These are used to make our website content more user-friendly, more effective and more secure. Cookies are small text files that are stored on your computer. “Session cookies” are deleted as soon as you leave our website. In contrast, permanent cookies (e.g. to enable you to return to the application process at a later stage) remain on your computer’s hard drive until they are deleted by your browser. You can prevent the installation of cookies on your computer by adjusting your browser software accordingly. Please note, however, that in this case some functions may not be available to you to their full extent.
      2. Cookies may be required to maintain the “functionality” of the website. Use of such cookies does not require consent and cannot therefore be deactivated. Cookies that are used to “analyse” your behaviour on our website are saved only with your consent. If we use cookies that require consent, when you first access our website there will appear a cookie banner on which you can agree to the use of cookies that require consent. If you wish to change your cookie settings at a later date, you can make the change on the website in the “Cookies” section.
      3. Below is a list of the cookies used:

   PHPSESSID	Session Cookie	Function	This cookie is used to identify the user during his/her use ofthe e-recruiting system. The cookie is essential for the website to function properly. The cookie ceases to be valid once the browser is closed.	jobbase.io
   REMEMBERME	Persistent Cookie	Function	This cookie is used to restore a session that has timed out. The cookie ceases to be valid after two weeks.	jobbase.io

   5. Are data transferred to or collected by third parties?
      
      Data collected within the context of your application are not published or forwarded without authorisation, i.e. without your consent, to third parties. Apart from our employees who process your data in the course of providing our services, we transfer your data to the following recipients: 
      1. Sub-contracted processors acting as IT service providers help us provide our services and in the context of hosting services. They have registered offices in Austria and Germany. If other processors are commissioned with maintenance work, those processors may gain access to your data in the course of their work. In such cases, CBRE undertakes to oblige them contractually to comply with the applicable data protection provisions and with the provisions regarding data protection and confidentiality under this Agreement.
      2. CBRE may be legally obliged to disclose your data if the data are required to assert, exercise or defend legal claims in respect of the authorities.

   
   If CBRE  wishes to use your data in a way that goes beyond that described above, CBRE  will first obtain your express consent. 

   6. Storage periods
      1. Personal data of rejected applicants are stored for a maximum of seven months, starting from the date of rejection of the application. If you prefer a longer storage period for your application process (to continue your application at a later date, for example), we request that you adjust the settings accordingly when you register.
      2. Longer storage periods may also result from the fact that the data are required to assert, exercise or defend legal claims in respect of the authorities or if statutory storage periods apply. The data will be stored as long as necessary to fulfil these purposes.

    

   7. Your rights with regard to stored data
      1. You have the right to free information about the personal data about you that we process, as well as the right to correct and erase data, to limit data processing, and the right to data transferability. If you wish to assert these rights or obtain further information about them, please send an email to  dataprotection.austria@cbre.com. As a matter of principle, our Data Protection Policy and our responsibility and liability in this connection does not cover websites of third-party providers to which we provide links or to which you are forwarded. We are also not responsible for subsequent data processing by the operators of those websites in such cases.

    

   8. Withdrawal option
      1. You may at any time withdraw any consent you may have given as required by data protection law, with effect from that point forward. If you wish to exercise your right to withdraw, please send an email to  dataprotection.austria@cbre.comIf we use cookies that require consent on our website and you have also agreed to their use, you can withdraw that consent on our website in the “Cookies” section. .

    

   9. Validity of the Agreement (severability clause)
      
      The legal inadmissibility, ineffectiveness, invalidity or unenforceability of parts of these data protection provisions and conditions of use does not affect the effectiveness and validity of the remaining provisions. 
   10. Complaints to the data protection authorities
       
       If you believe that we are processing your data in contravention of applicable legal regulations, you can make a complaint to the Austrian data protection authorities or other responsible supervisory authority (in particular in the member state of your place of residence or work). 
   11. Contact details of the controller company under data protection legislation
       
       recruiting.vienna@cbre.com  or dataprotection.austria@cbre.com