Candidate Privacy Notice - Avolta

This Privacy Notice explains how Avolta AG and its affiliated companies (collectively, “Avolta Group” or “Avolta”) collect, use, and protect the personal data of job candidates throughout the entire recruitment process, from application to offer acceptance, on a global scale.

For information on how we use cookies and similar tracking technologies on our recruitment websites and online services, please refer to our Candidate Cookie Notice The Candidate Cookie Notice provides details on the types of cookies we use, their purposes, and how you can manage your preferences.

1. Who is the data controller?

The entity responsible for the processing of your personal data is the Avolta Group entity to which you have submitted or intend to submit your application. This entity will determine the purposes and means of the processing of your personal data and will therefore act as data controller (in this Privacy Notice referred to as “Company”, “we”, or “us”). The Company will be responsible for ensuring compliance with applicable data protection laws in its jurisdiction regarding your application.

The specific contact details of the Company are provided in the job posting or otherwise during the application process. If the contact details of the Company are not available in the job posting or otherwise, please refer to the team member you are interacting with during the recruitment process, or reach out to us by using the contact details in Section 10 below (“How can you contact us”).

2. What personal data do we process?

The personal data we collect from you is essential for managing your application, conducting our business operations, and meeting our legal obligations under applicable data protection laws around the world. We are committed to collecting only the personal data necessary for these specified purposes, as further described in Section 3 below (“How and why we use your personal data”).

Providing your personal data is not a statutory requirement; however, if you choose not to provide certain information, this may hinder or limit our ability to review your application.

Identification data, contact information, and other personal data

When you apply for a position at the Company, we collect and use the following categories of personal data:

  • Identification data: Your name, date of birth, gender, nationality, username, password, and any other information used to uniquely identify you for candidate profile creation, application management and communication purposes.
  • Contact information: Your address, email address, phone number, and other contact details to communicate with you throughout the recruitment process.
  • Responses to screening questions: Your answers to questions asked during the initial application or screening stages to assess your basic qualifications.
  • Background check information: Results of background checks, including criminal record checks (where legally permissible and relevant to the role, in compliance with local regulations).
  • Previous employment and education information: Details about your education history, past employers, job titles, responsibilities, and employment dates for assessing your experience and qualifications.
  • Work preferences, abilities, other job specific information: Your career interests, desired salary, availability (e.g., notice period at your current job), work permit status, your skills, and competencies.
  • Resume/CV: All the information you choose to share in your resume or curriculum vitae, such as education, work experience, and skills, used for evaluating your application.
  • Calendar availabilities and job interview notes: Information about your availability for job interviews, records and evaluations made by Avolta interviewers to assess your suitability for a given role.
  • Assessment results: Where applicable, scores and outcomes from any tests or assessments conducted as part of the recruitment process to evaluate your skills and abilities.

Sensitive Personal Data

Generally, we do not intentionally collect or process personal data revealing your racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, genetic data, biometric data for uniquely identifying purposes, or data concerning your health, sex life, or sexual orientation (“Sensitive Personal Data”).

However, in certain circumstances, local laws may require or permit us to process Sensitive Personal Data. For instance, Avolta might collect information about your racial/ethnic origin, gender, and disabilities for equal opportunities monitoring, to comply with anti-discrimination laws, or for government reporting obligations, as mandated by specific local legislation. Similarly, we may collect information about your physical or mental health to consider necessary accommodations during the recruitment process and/or for the job role, in accordance with local requirements.

Unless mandated or otherwise permitted by applicable law, the provision of Sensitive Personal Data during the recruiting process is generally not needed for the assessment of your application and for the other purposes listed in this Privacy Notice. We therefore kindly ask you to refrain from sharing any Sensitive Personal Data when submitting your application.

3. How and why we use your personal data?

When you submit an application to the Company, your personal data is used for the following purposes and on the following legal bases:

  • To assess your capabilities and qualifications – We will use your personal data to administer the recruitment process efficiently on a global scale, to manage your application and communicate with you throughout the recruiting process, to assess the suitability of your profile for a given role, and to organize and conduct interviews (which may take place virtually or in person depending on your location and the role). The processing of your personal data for this purpose is based on the need to execute your request for selection.
  • To facilitate the onboarding process for successful candidates, which may involve international transfers and compliance with local employment laws.
  • To conduct background checks and screening – Where applicable and legally permitted in the location of your potential employment, we may conduct background checks and screening. These checks and screenings may be necessary for accessing secure areas relevant to our food & beverage and travel retail operations globally (e.g., duty-free zones, airports, cruise ships) or for otherwise assessing your suitability for a given position. The processing of your personal data for this purpose is based on the obligation to comply with a given legal obligation (where applicable) or for our legitimate interest in assessing the suitability of your profile for a given position.
  • To verify the accuracy of your application and obtain references – Your personal data and, where applicable, those of third parties (e.g., previous employers) provided by you, may be used to verify the accuracy of the information included in your application. For instance, we may check your employment history and obtain references by contacting your previous employers or by reviewing publicly available sources (e.g., LinkedIn). The processing of your personal data for this purpose is based on our legitimate interest in verifying the accuracy of the information provided by you and therefore the suitability of your profile for a given role. Where so required by applicable law, we may collect your consent prior to collecting references from your previous employers.
  • To prepare the offer letter if your application is successful – If your application is successful, we will also process your personal data to prepare an offer letter and the terms of your employment (or other agreement with you). The processing of your personal data for this purpose is based on the need to take steps prior to entering into an employment relationship or other agreement with you.
  • To contact you about future opportunities and potential inclusion in our Talent Pool: – If your application for a specific role is not successful, we may keep your candidate profile data in line with the retention period specified in paragraph 7. This allows us to contact you if your skills and experience appear suitable for other roles that may become available within Avolta. This processing is based on our legitimate interest in finding the best talent for our organization. Additionally, we may invite you to join our Talent Pool. You will receive clear information about the Talent Pool and we will retain your candidate profile data based on your consent to join. Being part of the Talent Pool allows us to consider you for a broader range of future opportunities across the Avolta Group.
  • To comply with legal obligations – Your personal data is processed for the purpose of meeting our legal obligations, including recordkeeping and internal and external reporting requirements under various global legal frameworks. This also includes compliance with any other applicable legal requirement in the relevant jurisdiction (e.g., immigration laws, tax obligations, or responding to legal requests from competent authorities). The legal requirements to which we are subject serve as the legal basis for the processing of your personal data for this purpose.
  • To protect our rights and interests and those of third parties – Where needed, your personal data may be used to investigate and address legal claims or to otherwise protect our rights and interests and those of third parties in legal proceedings, as well as in pre-contentious situations. This purpose also includes the processing of your personal data for ensuring the security of our systems and premises, and for reporting potentially illegal activities perpetrated against us. The processing of your personal data for this purpose is based on our legitimate interest in protecting our rights and those of third parties.
  • To improve our recruitment process and promote diversity and integration – Your personal data may also be used to improve our recruitment processes, by also monitoring diversity and equal opportunities within our candidate pool globally (where permitted by law) as a means to promote diversity, inclusion, and integration in our working environment. The processing of your personal data for improving our recruitment process is based on our legitimate interest in improving our recruitment process. The processing activities aimed at promoting diversity and integration may also be necessary to comply with a legal obligation or other regulatory obligation to which we are subject. In the absence of such legal or regulatory obligation and where Sensitive Personal Data is collected, we may also need to collect your explicit consent for the processing of such personal data.

Currently, we do not use automated decision-making processes or profiling in the recruitment process that may produce legal effects and that may otherwise significantly affect you.

Where required by applicable law, we have carried out balancing tests for the data processing based on our or a third party’s legitimate interests to ensure that such legitimate interest is not overridden by your interests, fundamental rights, or freedoms. For more information on our balancing tests, you may reach out to us by using the contact details in Section 10 below (“How can you contact us”).

4. Where do we collect your personal data?

We primarily obtain your personal data directly from you when you submit your application and during the recruitment process. We also generate personal data about you internally, such as interview notes and assessment results.

Additionally, we may collect certain personal data from third parties, including:

  • Previous employers: To verify your employment history and obtain references (with your consent, where required by applicable local law).
  • Recruitment agencies: If you apply through an agency operating in your region or internationally.
  • Background check providers: To conduct background checks in accordance with local legal requirements.
  • Publicly available sources: Such as your professional profiles on platforms like LinkedIn (where you have made this information public).
  • Public authorities: We may need to obtain security clearances from relevant authorities (e.g., port, airport, railway, immigration authorities) for roles requiring access to restricted areas in various global locations.
  • Internal referral: If you have been referred for a position following a referral from an Avolta employee, we may receive certain personal data from those Avolta employees.

Third parties from which we may collect your personal data are required to ensure that they have a legal basis for sharing such personal data with us. Once we receive your personal data, we will process it in accordance with this Privacy Notice and applicable laws.

5. With whom do we share your personal data?

Your personal data will only be shared within the Avolta Group globally where it is lawful to do so and for legitimate recruitment-related purposes (e.g., where other entities of the Avolta Group are involved in the recruiting process). Avolta takes appropriate measures to ensure that anyone receiving your personal data maintains its confidentiality and security in accordance with global standards and local requirements.

We may also share your personal data with the following categories of third parties globally, in accordance with applicable data protection laws:

  • Governmental organizations or agencies: Including law enforcement, immigration authorities, and port/airport/railway authorities in various countries, as required by law or for security clearance purposes.
  • External advisors: Such as legal counsel and auditors operating internationally or in specific regions.
  • Employee benefits providers: If your application is successful, we will share necessary data for benefits administration in your location.
  • Insurance providers and brokers: For insurance-related purposes, if your application is successful and as required by local regulations.
  • Commercial partners: Only if permitted by applicable laws and relevant for a joint evaluation of your application for specific roles, and with appropriate safeguards in place.
  • Third-party service providers: These include recruitment platform providers, background check services, assessment tools, and IT support providers who process personal data on our behalf under strict contractual agreements that ensure data security and confidentiality in line with global best practices and local legal obligations. These providers generally act as data processors on our behalf.

6. How does Avolta protect your personal data?

Avolta implements and maintains appropriate technical and organizational measures designed to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, regardless of where your personal data is processed globally. These measures are regularly reviewed and updated to ensure a high level of security that aligns with international standards and local legal requirements.  

7. For how long do we retain your personal data?

  • Successful Candidates: If your application is successful and you become an employee of Avolta in any of our global locations, your personal data will be retained in accordance with our internal data retention policies applicable to employee data, which may vary based on local legal requirements.
  • Unsuccessful Candidates: If your application is not successful, we will generally retain your personal data related to the application for 6 months from the end of the application process for recordkeeping purposes and to be able to contact you in case your profile may become relevant for other positions that may arise at Avolta. A longer retention period may also be justified, where needed in the event of legal claims in relevant jurisdictions that may arise during and / or as a result of the recruiting process. This retention period may be adjusted based on local legal requirements.
  • Candidate Profiles: If you created a candidate profile on our application portal but did not apply for a specific role or your application was unsuccessful, your profile and associated personal data (excluding application data which are subject to the retention described above respectively for “Successful Candidates” and “Unsuccessful Candidates”) will be retained for 12 months from your last interaction (log-in) with the portal, unless you provide consent for a longer retention period by joining our Talent Pool as described in paragraph 3, or as required by local law.
  • Candidate profiles shared via a recruiting agency or internal referral: If your candidate profile is shared with us through a recruiting agency or an internal referral, we will retain your personal data for 21 days from the date you receive a formal invitation to apply for a specific position. This allows us to process your initial referral or shared profile and confirm your interest in applying.

Please note that the retention periods indicated above may be subject to changes in specific jurisdictions, as needed to comply with applicable legal requirements.

8. Do we transfer your personal data outside the country/region in which you apply?

As a global company operating in the food & beverage and travel retail sectors worldwide, we may need to transfer your personal data to countries outside your country or region. This may occur, for example, when the entities of the Avolta Group or its service providers are located in other countries that may have different data protection laws than your country of residence.

For all such international transfers, we implement appropriate safeguards in accordance with applicable data protection laws, including but not limited to:

  • Standard contractual clauses approved by relevant authorities (e.g., the European Commission's EU Standard Contractual Clauses) alongside any necessary supplementary measures where applicable.
  • Adequacy decisions adopted by the European Commission or other competent body in the relevant jurisdiction under which it is established that the recipient country provides an adequate level of data protection.
  • Binding Corporate Rules, where applicable.
  • Any other lawful transfer mechanisms as permitted by local laws.

We will also implement any necessary supplementary measures to ensure that your personal data receives an adequate level of protection in the recipient country, in accordance with applicable legal requirements. We will also be mindful of any data localization requirements in specific regions.

9. What are your rights?

Depending on the data protection laws applicable in your jurisdiction, you may be entitled to exercise the following rights:

  • Access: to obtain confirmation as to whether or not your personal data is being processed and to access such personal data.
  • Rectification: to request the correction of inaccurate or incomplete personal data.
  • Erasure (or “right to be forgotten”): to request the deletion of your personal data under certain circumstances as defined by local law.
  • Restriction: to request the restriction of the processing of your personal data under certain circumstances as defined by local law.
  • Data portability: to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another data controller, where applicable under local law.
  • Object: to object to the processing of your personal data in certain situations, such as for direct marketing purposes or based on legitimate interests, as permitted by local law.
  • Withdraw consent: If the processing of your personal data is based on your consent under applicable law, you have the right to withdraw that consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
  • Lodge a complaint: You have the right to lodge a complaint with the relevant data protection supervisory authority in the country of your habitual residence, place of work, or place of any alleged infringement, if you believe our processing of your personal data infringes applicable laws.

The specific rights available to you may vary depending on your location and the applicable data protection laws.

10. How can you contact us?

If you wish to exercise your rights or to otherwise request additional information on the processing of your personal data, you can contact us by sending a written request to the following e-mail address: privacy@avolta.net or to the following postal address: Avolta AG Brunngässlein 12 Basel, 4052 Switzerland Attention: Global Data Protection Office.

To process your request, we may need to verify your identity. In compliance with applicable data protection law, we aim to respond to your request within one month of receipt. If we are unable to respond within this timeframe, we will inform you of this delay and the reasons for it. Please note that, in some cases, it is possible that our response will be delayed, limited, or excluded based on applicable local legislation.

We will generally respond to your requests free of charge. However, under certain circumstances (e.g., if your requests are manifestly unfounded or excessively repetitive), we may charge a reasonable fee based on administrative costs, as permitted by applicable law. In some jurisdictions, rights related to the personal data of deceased individuals may be exercised by their legal representatives as per local regulations.

11. What is not covered by this Privacy Notice?

This Privacy Notice explains and covers the processing activities we carry out as data controller. This Privacy Notice does not cover processing carried out by parties other than the Company. It does not cover processing activities conducted by parties other than the Company. Specifically, it excludes processing by third parties involved in the recruitment process as autonomous data controllers, such as recruitment agencies, social media platforms (e.g., LinkedIn), job boards, and other third parties. We do not assume responsibility for the processing of your personal data by these third parties.

Please note that if your application is successful and you are hired, the personal data you provide during the application and recruitment process will become part of your employee records and may be used for other employment-related purposes. You will receive a specific Employee Privacy Notice detailing these additional purposes.

12. Changes to our Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in our global practices or legal requirements. Any changes will be effective when posted on our website. We encourage you to review this Privacy Notice periodically. In the event of substantial changes, we will notify you of such changes, as required by applicable law. If you do not agree with any changes, you should refrain from continuing to use our services or access our websites.

Last updated: 29. May 2025