Recruitment – Data privacy policy

Version: 01-2023

Information on the processing of your personal data within the application process at Oviva

We are delighted that you applied for a position at Oviva. Transparency and a trustful handling of your personal data are an important basis for a good cooperation. We, therefore, inform you about how we process your data and how you can exercise your rights under the General Data Protection Regulation (GDPR). The following information will give you an overview of the collection and processing of your personal data in connection with the recruitment process in our company.

1. Who is responsible for the processing?

Oviva AG

Zürcherstrasse 64

8852 Altendorf

Oviva AG eine Gesellschaft schweizerischen Rechts mit Zweigniederlassung in der

Dortustraße 48

14467 Potsdam

Oviva Limited 

Runway East

20 St Thomas Street

London, SE1 9RS

Oviva SAS

71 rue Desnouettes

75015 Paris

(together referred to as “Oviva Group” or “we”)

2. How can I contact the data protection officer?

You can reach our data protection officer as follows:


Oviva AG

z.H. Datenschutzbeauftragter

Sihlstrasse 37

8001 Zürich



Oviva AG eine Gesellschaft schweizerischen Rechts mit Zweigniederlassung in der

z.H. Datenschutzbeauftragter

Dortustraße 48

14467 Potsdam



Oviva Limited 

Data protection officer

Runway East

20 St Thomas Street

London, SE1 9RS



Oviva SAS

Responsable de la protection des données

71 rue Desnouettes

75015 Paris


3. Which personal data do we use?

We process your personal data as far as it is necessary for carrying out the recruitment process. As such, the following type of data may be processed:

General Data:

  • Name, surname, address, birthday and place, nationality, job position
  • Application (cover letter, CV, former activities, qualifications)
  • Certificates of employment
  • Login-data (e-mail, password)

Special information based on the specific job

  • Police clearance certificate
  • Results of a screening test
  • Results of a medical examination (suitable, not suitable, conditionally/restrictedly suitable)

Other data

  • Publicly available job data, such as a profile in social media networks
  • Voluntary data, such as photos, indications regarding a disability or other data voluntarily provided during the recruitment process

4. From which sources does the data come?

We process personal data that we receive from you during the recruitment process. Furthermore, we may process data obtained from publicly available sources, such as social media networks.

5. For what purposes do we process your data and on what legal basis? 

Oviva Group, as data controller, processes your personal data in the context of the conclusion and performance of your employment contract, in accordance with the applicable regulations and, in particular, with the EU General Data Protection Regulation of April 27, 2016 (GDPR), as well as local laws on the protection of personal data (in France: the amended “Informatique et Libertés” law of January 6, 1978; in Germany, the BundesDatenSchutzGesetz (BDSG); in the United Kingdom: the Data Protection Act 2018 (DPA 2018) and the UK General Data Protection Regulation (UK GDPR); and in Switzerland the Federal Act on Data Protection (FODP), each in its applicable version). For more information, please refer to information contained in your employment contract and/or Oviva Privacy Policy

In the application process, we ask you for your consent to the data processing of your personal data in the context of the application process. 

Based on your consent to process the data, Oviva will process the data received from you in the application process. This consent is the legal basis for the processing of this data.

6. To whom will your data be passed on to?

Your data will be processed mainly by our human resources department and the department responsible for the respective processing purpose. In some cases, however, other internal and external bodies are also involved in the processing of your data.

Internal departments:

  • HR
  • Heads of Departments

of Oviva AG and affiliated companies.

External Services Providers:

  • Service provider for recruitment management services
  • Service provider for hosting and maintenance services
  • Service provider for file and data destruction
  • Investigation authorities

7. Will your data be transferred to countries outside the European Union (so-called third countries)?

Countries outside the European Union (and the European Economic Area “EEA”) handle the protection of personal data differently from countries within the European Union. We also use service providers that may have parent companies located in third countries outside the European Union, in particular the U.S, to process your data. We have, therefore, taken special measures to ensure that your data is processed as securely in such third countries as within the European Union. That means that we have concluded the so-called standard clauses provided by the Commission of the European Union for service providers in third countries. These clauses provide appropriate guarantees for the protection of your data for service providers in third countries.

8. For how long do we store your data?

We store your data as long as it is necessary for the conclusion of the recruitment process. If an employment relationship is not established between you and us we may store your personal data for purposes of preservation of evidence to protect against possible legal claims. Generally, we delete your personal data within a time period of six months in Switzerland, UK and Germany and 2 years in France following the conclusion of the recruitment process.

If no employment relationship is established between you and us, we may store your personal data for a longer period if you have given us the consent to store your data for purposes of our applicant’s pool. We will request separate consent from you for this purpose. 

9. What rights do you have in connection with the processing of your data?

  • Right to be informed

Data subjects have the right to be informed of the ways in which a controller will be processing their personal data.

  • Right to access

Data subjects have the right to obtain access to their personal data and certain information about it. You may exercise your right to information by submitting an informal request to Oviva without stating reasons. Please contact the respective data protection officer for this purpose.

  • Right to rectification

Data subjects have the right to obtain rectification of inaccurate personal data concerning them, and have incomplete data completed by means of a supplementary statement.

  • Right to erasure

Data subjects have the right to obtain erasure of their personal data in certain circumstances (also known as ‘the right to be forgotten’).

  • Right to data portability

Data subjects have the right to receive their personal data in a structured, commonly used, and machine-readable format. They also have the right to transmit their personal data to another controller (and can request that the controller transmits it directly, where this is technically feasible).

  • Right to restriction of processing

Data subjects have the right to obtain the restriction of data processing in certain limited circumstances.

  • Right to Object

Data subjects have the right to object at any time to the processing of personal data concerning them, this also applies to profiling based on this provision.

In the event of an objection, Oviva will no longer process the personal data unless Oviva can prove compelling grounds for processing that outweigh. 

  • Revocation of consent

Data subjects can revoke their consent to the processing of their personal data at any time. Please note that the revocation is only valid for the future.

In addition, you have the right to have your data corrected or deleted. If there is no reason for further storage, we will delete your data, otherwise we will restrict processing. In addition, there is a right to lodge a complaint to the responsible data protection supervisory authority.

To exercise your rights, you can contact the data protection officer. We will process your enquiries immediately and in accordance with legal requirements and inform you of the measures we have taken.

10. Is there an obligation to provide your personal data?

There is neither a legal nor a contractual requirement to provide your personal data. However, the making available of your personal data is required in order to carry out the recruitment process. That means that if you do not provide your personal data we cannot consider your application.

 11. Changes to this information

If the purpose or manner of processing your personal data changes significantly, we will update this information in time and inform you about the changes.