Privacy Policy

HG Consulting GmbH, HOGO GmbH, HOGO Bau Solution GmbH (HOGO Group) -
Privacy policy for Applicants and Employees

This policy describes how We, HG Consulting GmbH (FN 371426s, hereinafter:
"HGC"), HOGO GmbH (FN 262358x, hereinafter: "HOG") and HOGO Bau Solution
GmbH (FN 108445 d; hereinafter: "HBG") (HGC, HOG and HBG hereinafter
: the "HOGO Group" or the "HOGO Companies") (“We") as jointly responsible for the
processing controller (Art. 26 GDPR), process your personal data.

The policy is addressed to the Users of our joint website www.hogo.cc (hereinafter
: “Users"), to all persons who register with a company (or several
companies) by means of the aforementioned website, in person, in writing, or in any other
manner for the purpose of entering into an employment relationship or the arranging of an
employment relationship (hereinafter: “Applicants"), to all independent
sales representatives, agents and commercial agents (hereinafter referred to as the "Freelancers") and to
all persons who are in an employment relationship (or freelance employment relationship) with a
company of the HOGO Group or are appointed to such a relationship (hereinafter:
“Employees") (Users, Applicants and Employees hereinafter also collectively: “You").

We are committed to protecting the personal information You entrust to us.
We will therefore process personal data in accordance with the applicable data protection law with
the greatest possible care. Of course, We comply with the provisions of the
General Data Protection Regulation (EU) 2016/679 (“GDPR"), as well as those of the
Data Protection Amendment Act 2018 (DPA), the Telecommunications Act and other
data protection regulations.

This Privacy Policy explains who We are, for what purposes and in what way We
process the personal data of our Applicants, who has access to these data and to
whom/where these data are passed on to, or from where access to this data is possible.
We also provide information about Applicants’ rights with regard to personal data.

As described in more detail below, all data processing is carried out as joint
processing within the meaning of Art. 26 of the GDPR. All companies of the HOGO Group are
therefore data controllers within the meaning of the GDPR. However, HG Consulting GmbH acts as the central
contact point for exercising your rights.

You can reach the data protection officer of HG Consulting GmbH using the following contact details:
Dominik Klinger
HOGO GmbH
Wallerer Straße 49
4600 Wels
T: +43 720 31 00 55 70
F: +43 720 31 00 55 30
D.KLINGER@HOGO.CC

1. Purposes of Data Processing

1.1. General purpose of Joint Data Processing

The companies of the HOGO Group mainly operate in the field of employee leasing
. In addition, the companies also carry out auxiliary operational activities that
support the leasing of employees. The purpose of joint data processing is the
provision of employee leasing services and associated
auxiliary services (e.g. accommodation of employees or catering for
employees).
We do not use your data for purposes other than those stated below. However, should this
be necessary in individual cases, We will inform you in advance, insofar as this does not conflict with statutory
confidentiality obligations and, if necessary,
obtain your consent.

1.2. Purpose of data processing through the hogo.cc website – General

The purpose of processing user data is to operate the website for the purpose of informing
the general public and, in particular, potential Applicants and customers of the
companies of the HOGO Group.

1.3. Purpose of data processing through the hogo.cc website – Contact Form
In addition, We process the data provided by Users or entered on our website
for the purpose of contacting the User, if the User so wishes. Specifically,
We provide Users the opportunity to contact us via an online form: Users
enter the necessary data, i.e. name, email, phone number and message into an
online form and send it to us via an encrypted connection. This
data will be stored by us and used for the clarification of all inquiries and comments as well as the
processing of the contact request.

1.4. Purpose of data processing through the hogo.cc website – Newsletter
You have the option of subscribing to our newsletter via our website. For this,
We need your email address and a declaration from You stating that You agree to receive the newsletter
. Once You have signed up for the newsletter, We will send You a
confirmation email with a link to confirm the registration. You can cancel your subscription to the newsletter
at any time. We will then immediately delete your data related
to the distribution of the newsletter.

1.4. Purpose of data processing through the hogo.cc website – Salary Advance
If You are our Employee, You can apply for a salary advance through our website
. To do this, You must enter your personnel master data (title, first name, last name,
date of birth, nationality, social security number, email address, telephone number) and
enter the amount of the desired salary advance in the online form. Then
We transmit this to ourselves via an encrypted connection. This data is stored by us
and used for processing the request and for payroll purposes
.

1.4. Purpose of the processing of applicant data
The purpose of the processing of applicant data is the initiation of contracts, the selection of suitable
(future) Employees and the handling of the application process, the keeping of records in order to
provide Applicants (irrespective of the establishment of an employment relationship) information on
potential job opportunities and interesting vacancies or to advise them further in their career planning
and ultimately the provision of general information on
other services of the HOGO Group.

1.4. Purpose of the processing of employee data
The purpose of the processing of employee data is the conclusion of the employment relationship as well as
the performance of all tasks arising within the scope of the employment relationship (such as, for example,
registration, re-registration, de-registration with the responsible social insurance institutions,
payroll accounting and the fulfilment of the employer's duty of care) and the
fulfilment of all tasks arising within the framework of employee leasing (such as,
for example, the fulfilment of employer obligations in accordance with the AÜG (Austrian Employee Leasing Act), the conclusion of a
leasing agreement or the issuance of a leasing notice, moreover, in
certain cases, the selection of suitable accommodation); in addition, keeping records in order to
provide Employees or former Employees information about possible job opportunities and
interesting vacancies or advise them further in their career planning, and
ultimately the provision of general information about other services of the
HOGO Group.

1.5. Purpose of the processing of freelancer data
The purpose of the processing of freelancer data is the conclusion of the contractual relationship
(agency agreement, commercial agency agreement, etc.) as well as the fulfilment of all tasks arising within the framework of the
contractual relationship.

1.5. Purpose of the processing of customer data
The purpose of the processing of customer data is the initiation of employee leasing, the
handling of leasing relationships (including fulfilment of the statutory
obligations, in particular pursuant to the AÜG, and the settlement of receivables from
the customer).

2. Type of data processing
We identify, collect and store the data ourselves (in our capacity as joint
data controllers within the meaning of Art. 26 GDPR). Your data will not be sold, nor made available to
other unauthorized third parties. We assure that the data will only be forwarded within the
Companies of the HOGO Group, to our independent sales partners (in their
capacity as contracted data processors) and to customers, in each case on a limited basis
to the extent required in the process.

Other third parties may only gain access to your personal data as (commissioned by us and subject to our instructions)
contracted data processors (e.g. IT service providers,
independent distributors, hosting providers). We require
contracted data processors to implement and maintain security measures to ensure
the confidentiality and security of the data You entrust to us, and
to collect, process and use personal data only in accordance with our instructions and as contractually agreed
.

3. Processed data

We only identify, collect and process personal data that
is required for the performance and processing of our services or that You have voluntarily provided
.

3.1. Data processed during data processing through the hogo.cc website – General

Every visit to the website is logged by us. Specifically, the
anonymized IP address in particular is logged and stored to optimize the usability of the website
(for cookies, see section 8 of this Privacy Policy).
Furthermore, We collect data about every visit to the website for the purpose of creating
server log files. The access data includes the name of the accessed website, file, date
and time of the visit, amount of data transferred, message about successful access, browser type
and its version, the operating system of the user, the previously visited page as well as the IP address
and the requesting provider. We use the log data only for statistical
purposes, namely to evaluate the purpose of the operation, security and optimization of the
website appearance. However, We reserve the right to review the log data at a later date,
if there is reasonable suspicion of unlawful use of the website.

3.2. Data processed during data processing through the hogo.cc website – Contact Form
In addition, We process the data provided by Users or entered on our website
for the purpose of contacting the User, if the User so wishes. Specifically,
We provide Users the opportunity to contact us via an online form: Users
enter the necessary data, i.e. name, email, phone number and message into an
online form and send it to us via an encrypted connection.

3.3. Data processed during data processing through the hogo.cc website – Newsletter
You have the option of subscribing to our newsletter via our website. For this,
We need your email address and a declaration from You stating that You agree to receive the newsletter
.

3.4. Data processed during data processing through the hogo.cc website – Salary Advance
If You are our Employee, You can apply for a salary advance through our website
. To do this, You must enter your personnel master data (title, first name, last name,
date of birth, nationality, social security number, email address, telephone number) and
enter the amount of the desired salary advance in the online form. Then
We transmit this to ourselves via an encrypted connection.

3.5. Processed data for job applications (including online applications), Employees and
Freelancers

Within the scope of the application process, the handling of employment relationships and the
provision of our services, personal data is
processed exclusively for a specific purpose in accordance with a legal basis (in particular an explicit
declaration of consent) in good faith and in accordance with the GDPR or applicable
data protection regulations. We do not process data of persons
who have not yet reached the age of 14. Should We notice that We have fallen below this limit,
We will delete your data immediately.
In the case of Applicants, for the purpose of initiating a contract or providing our services, We require
personal data of the applicant, which they provide during registration or
application. These are the data that must be provided.
As far as the processing of applicant data is concerned, data regarding the
qualification profile of the applicant (educational and professional background, professional
qualifications, additional qualifications, references, driver's license, language skills, possible
health restrictions), work preferences (occupational field, form of employment,
area of operation, etc.), personal data (name, address, date of birth, gender),
identity card, contact details, photo, marital status, bank details, social security number,
nationality, registration data and information on official authorization to work
in Austria (residence permit) are processed. From time to time, the identification and processing of additional
personal data may also become necessary. If the information You provide, e.g. your résumé,
contains special categories of data, such as information
about an individual and his or her racial and ethnic origin, political opinions, religion
or similar belief systems, trade union membership, physical
or mental health or condition, sex life, or genetic or
biometric data or data relevant to criminal law, your declared
consent expressly includes this information.
We would like to point out that data transmission via the Internet (e.g. communication by email)
may have security gaps. Complete protection of the data against access by
by third parties is not possible.

4. Disclosure to third parties

In order to be able to offer the services we primarily provide in the field of employee leasing,
it is regularly necessary to pass on your personal data to third parties.
This may require disclosure to the following third parties:

A. Our customers; i.e. potential employers of a
employee leasing relationship to be initiated.
B. Contracted data processors (see section 2)
as well as, insofar as You are or become an Employee:
C. To your Employer with whom You are specifically employed;
D. To the Labour Market Service to apply for integration allowance or other subsidies for your
employment relationship
E. If applicable, to the Social and Continuing Education Fund to provide funding for education or
further training, if You wish to do so
Insofar as customers or contracted data processors are not located in a member state of the EU
and therefore do not have the level of protection that is standardized within the EU, We will
take precautionary measures in accordance with the applicable data protection regulations,
those companies that are not based in the EU and process your
personal data, will guarantee adequate protection for such processing of data
.
Your data will only be forwarded in accordance with the applicable
data protection regulations (in particular the provisions of the GDPR) and to
fulfil your order or based on your prior consent. The transmission to
state institutions and authorities entitled to receive information is only carried out within the framework of the legal
obligations to provide information or if We are legally obligated to provide information by a court decision
.

5. Legal bases of the processing

Art. 6(I)(a) GDPR serves as the legal basis for processing operations in which We
obtain consent for a specific processing purpose. If the processing
of personal data is necessary for the performance of a contract to which the data subject
is a party, as is the case, for example, with processing operations that are necessary for
a supply of goods or the provision of any other service or consideration,
the processing is based on Art. 6(I)(b) GDPR. The same applies to such
processing operations that are necessary for the implementation of pre-contractual measures, such as
in cases of inquiries about our products or services. If We are subject to a legal
obligation by which the processing of personal data becomes necessary, such as
for compliance with tax obligations, the processing is based on Art. 6(I)(c)
GDPR. In rare cases, the processing of personal data may become necessary
to protect vital interests of the data subject or of another natural
person. Then the processing would be based on Art. 6(I)(d) GDPR. Ultimately,
processing operations could be based on Art. 6(I)(f) GDPR. Processing operations
that are not covered by any of the aforementioned legal bases are based on this legal basis
if the processing is necessary to protect a legitimate interest of our company
or of a third party, provided that the interests, fundamental rights and freedoms of the
data subject are not overridden. Such processing operations are permitted to us in particular
because they have been specifically mentioned by the European legislator. In this respect, he
considered that a legitimate interest could be assumed if
the data subject is a customer of the data controller (recital 47, second sentence, GDPR).

6. Agreement on joint data processing as joint

controllers
Our data processing operations are carried out as joint processing within the meaning of Art. 26
GDPR because this
is in the common interest of the HOGO Companies due to the group affiliation of the companies of the HOGO Group, but above all also because
this enables the placement of Employees beyond the boundaries of the individual entities under company law
and thus increases the probability of a successful placement,
which is ultimately also in the interest of Applicants, Employees and customers of the
HOGO companies.
To this end, We have stipulated in a transparent manner in an agreement which of us will fulfil which
obligation in accordance with the GDPR. For the text of this Agreement, please refer to
Annex 1 of this Privacy Policy.

7. Retention period

Applicant data will be deleted 3 years after the date of application. Before
deleting your data, We will contact You and inform You of the deletion.
If You would like to continue using our services, You can
apply to us again.
Employee data is stored for the duration of the employment relationship. After termination
of the employment relationship, employee data will be kept on record, provided that You consented to this
as part of your application. You have the option to revoke this consent (as well as
the data processing in general) at any time. If You have not consented to your data being kept on record
or if You revoke your consent, your personal data will be archived
in order to comply with the statutory retention periods. In this case, only the
Data Protection Officer has access to this data. After expiry of the statutory
retention periods, your data will be deleted.

8. Cookies / Goolge Analytics

Our website uses so-called cookies. These are small text files, which are
stored on your end device with the help of the browser. They do not cause any damage. We
use cookies to make our website user-friendly. Some cookies remain stored on
your end device until you delete them. They allow us to recognize your browser
the next time You visit our website. If You do not want this, You can set up your browser
so that it informs You about the use of cookies and You have to allow their use in individual cases
. When disabling cookies, the functionality of our website may
be limited.

Google Analytics

This website uses Google Analytics, a web analytics service provided by Google Inc. Google Analytics uses so-called cookies. These are text files that are stored on your computer to enable an analysis of the use of the website. The information generated by the cookie about your use of the website (including your IP address) will be transmitted to and stored by Google on servers in the United States. Your IP address will be anonymized immediately after collection, therefore only a rough localization is possible.

Google will use this information for the purpose of evaluating your use of the website and compiling reports on website activity. Our interest in terms of the GDPR (legitimate interest) is in the improvement of our service and our web presence.

We have concluded a corresponding contract with the provider for order data processing.

9. References and links

Insofar as (hyper)links provide access to other, third-party websites, We are
not responsible for any third-party content contained therein. We do not adopt the external content as our
own and there is no assumption of performance. If We become aware of any unlawful
content on external websites, the electronic reference or link will be removed immediately
. At the time of the initial linking to the external website in question, no
violation of the rules was apparent.
This website also offers the possibility to interact with various social networks via plugins
. These are:

• Facebook, operated by Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland
• Linked In, operated by LinkedIn Inc., 2029 Stierlin Court, Mountain View, CA 94043, USA
• Twitter, operated by Twitter Inc., 795 Folsom Street, Suite 600, San Francisco, CA 94107, USA
• Instagram, operated by Instagram LLC, 1601 Willow Rd, Menlo Park CA 94025, USA
• Xing.com, operated by XING SE, Dammtorstraße 30, 20354 Hamburg, Germany

When You click on a plugin of one of these social networks, it is activated and a
connection to the respective server of this network is established. We have no influence on the
scope and content of the data that is transmitted to the respective operator of the
respective social network by clicking on the plugin. If You wish to find out more about the nature, scope and purpose
of the data collected by the operators of these social networks, We
request that You read the privacy policy of the respective social network.
10. Your rights in connection with personal data
Among other things, You have the right (i) to verify whether and what personal data We process
about You and to obtain copies of such data, (ii) to request the correction, completion or
deletion of your personal data to the extent that it is inaccurate or not
processed in accordance with the law, (iii) to request us to restrict the processing of your
personal data, (iv) to object to the processing of personal data in certain circumstances
or to revoke consent previously given for the processing
provided that a revocation shall not affect the lawfulness of the processing carried out prior to the withdrawal
, (v) to request data portability to the extent that You are our customer, (vi)
to be informed of the identity of third parties to whom your personal data is transferred
and (vii) to lodge a complaint with the data protection authority.

11. Contact

The central point of contact for exercising your rights or for this data protection declaration is the HOGO
GmbH or its data protection officer (see the contact details at the beginning of this
Privacy Policy).
We will contact You within one month regarding your request and
inform You about the steps taken. We reserve the right to extend this period by a further two months
if necessary, taking into account the complexity or the number of applications
. If there is any doubt about your identity, We will ask You
to confirm it by appropriate means, e.g. by presenting an official valid
photo ID.
If You wish to lodge a complaint, You can reach your
supervisory authority responsible for You at the following address: Österreichische Datenschutzbehörde,
Wickenburggasse 8, 1080 Vienna; email: dsb@dsb.gv.at
A revocation can be submitted to any HOGO company. However, We request that You
contact the data protection officer (see the contact details at the beginning of this
Privacy Policy).
HG Consulting GmbH
HOGO GmbH
HOGO Bau Solution GmbH

Annex 1
HG Consulting GmbH, HOGO GmbH, HOGO Bau Solution GmbH
(HOGO Group)
—
Agreement on joint data processing
as joint controllers according to Art. 26 GDPR

1. HG Consulting GmbH (FN 371426s, hereinafter: "HGC"), HOGO GmbH
(FN 262358x, hereinafter: "HOG") and HOGO Bau Solution GmbH (FN
108445 d; hereinafter: "HBG") (HGC, HOG and HBG hereinafter
: the "HOGO Group" or the "HOGO Companies") are all
limited companies with registered office in Wels and with business address 4600 Wels,
Wallererstraße 49.

2. The companies of the HOGO Group mainly operate in the field of
employee leasing. For the purposes of this business activity, the
Companies of the HOGO Group process, as joint controllers
within the meaning of Art. 26 of the General Data Protection Regulation (EU)
2016/679 ("GDPR”), in joint data processing operations
a) Data of applicants;
b) Data of employees; and
c) Data of customers
d) Data of self-employed sales representatives (Freelancers).

3. The purpose of the joint data processing is the provision of employee leasing services
. The purpose of the processing of applicant data is
the initiation of a contract, the selection of suitable (future) employees and the
handling of the application process, the keeping of records in order to provide applicants with
(regardless of the establishment of an employment relationship) information on
potential job opportunities and interesting vacancies or to advise them further in their
career planning, and ultimately the provision of
general information about other services of the HOGO Group.

4. The purpose of the processing of employee data is the conclusion of the
employment relationship as well as the fulfilment of all tasks arising within the framework of the employment relationship
(such as the registration, re-registration, de-registration with the
the responsible social insurance agencies, payroll accounting and
the fulfilment of the employer's duty of care) as well as the fulfilment of all
tasks arising within the framework of employee leasing (such as, the
fulfilment of employer obligations in accordance with the AÜG (Austrian Employee Leasing Act), the conclusion of a
leasing agreement or the issuance of a leasing notice);
moreover, the keeping of records in order to provide employees or former employees
information about possible job opportunities and interesting vacancies
or to advise them further in their career planning, and ultimately the
provision of general information about other services of the
HOGO Group.

5. The purpose of processing customer data is the administration of the provision of services
from the field of personnel services/employee leasing, the billing
of these services and, if necessary, the collection of outstanding receivables.

6. The data processing operations are carried out as joint processing within the meaning of Art. 26
GDPR because this
is in the common interest of the HOGO Companies due to the group affiliation of the companies of the HOGO Group, but above all
also because this enables the placement of employees beyond the boundaries of the individual
entities under company law and thus increases the
probability of a successful placement, which is ultimately
also in the interest of applicants, employees and customers of the HOGO Companies
.

7. As far as the processing of applicant data is concerned, data
regarding the qualification profile of the applicant (educational and professional
background, professional qualifications, additional qualifications, references)
work preferences (occupational field, form of employment, area of operation, etc.)
personal data (name, address, date of birth, gender), identity card
contact details, photo, marital status, bank details, social security number, nationality
registration data and information on official authorization to work in
Austria (residence permit) are processed. From time to time, the identification and processing
of additional personal data may also become necessary.

8. As far as the processing of employee data is concerned, in addition to the
data mentioned in the above paragraph, employee data is also
processed for personnel administration tasks as well as tasks in the area of HR and
personnel management, such as working time sheets, remuneration data,
bank data, leave notifications, accident notifications, etc. From time to time,
additional personal data may be necessary, in particular depending on nationality or specific industry.

9. With regard to all data processing mentioned in this Agreement,
all companies of the HOGO Group are jointly responsible for data protection
. These therefore operate the data processing operations as
joint controllers within the meaning of Art. 26 GDPR.

10. In view of this, the companies of the HOGO Group, as joint
controllers, enter into the following agreement:
-HGC undertakes the operational management of the above-mentioned
data processing activities. The determination of the data subject is carried out either online
via the web platform operated by HGC for the entire HOGO Group
at www.hogo.cc or in personal contact with customers or data subjects
via the companies of the HOGO Group (including their respective
independent sales partner as contracted data processors). The data will then be processed
uniformly by HGC for the purposes of all
companies of the HOGO Group.
-The HGC acts as a single point of contact for data subjects.
Notwithstanding the above, data subjects may
assert their rights under data protection law with and vis-à-vis any company of the HOGO Group.
-The companies of the HOGO Group shall, in the event of any other liability for damages,
immediately send to HGC all requests for information, requests for correction, requests for deletion,
requests for surrender, objections and any other
declarations of data subjects under data protection law.
HGC will handle all declarations relevant to data protection
. The other companies of the HOGO groups shall support HGC in
this context to the best of their ability.
-HGC is responsible for compliance with the information obligations pursuant to Art. 13 and Art. 14
GDPR. The other companies of the HOGO Group
undertake to provide HGC with the
best possible support in fulfilling its information obligations.
-HGC also uniformly makes the decision on all declarations relevant to data protection
.
-With regard to the joint data processing (as
applicable), HGC shall assume the obligations regarding data protection impact assessment
and risk assessment (Art. 24 in conjunction with Art. 32 GDPR), consultation with the
supervisory authority (Art. 36 GDPR), documentation of the selection of the technical-organizational
measures (Art. 24 GDPR), including their review and
updating, the use of processors or
sub-processors and their review (Art. 28 GDPR), the maintenance
of the inventory of processing activities (Art. 30 GDPR), the process
for reportable data breaches (Art. 33, 34 DS-GVO) and the appointment of a
data protection officer (Art. 37 GDPR).
-The other companies in the HOGO groups undertake to
ensure a high standard of technical-organizational measures in the area
of data protection; such as, in particular, by ensuring
confidentiality; primarily through access control. The other
companies of the HOGO Group will
monitor the effectiveness of the technical and organizational measures on a regular basis and also
on an ad hoc basis. In the event that there is
a need for optimization and/or change, they will inform HGC in each case
.
-Within the meaning of Art. 26 (3) GDPR, the companies of the HOGO Group shall
make the internal compensation arrangement that each company in the HOGO Group shall remain responsible for
its own data protection responsibilities in accordance with the
provisions of this Agreement and
shall indemnify and hold the other companies harmless in this respect. To the extent that HGC
assumes responsibility under data protection law pursuant to this Agreement and is
dependent on the cooperation and assistance of another company to fulfil its obligations,
the company in question is liable to pay damages
if it fails to fulfil its obligation to cooperate and assist
. For data breakdowns and data leaks (and any damages resulting therefrom), the
party in whose sphere the cause of the data breakdown or data leak lies shall be exclusively liable
and shall indemnify and hold harmless all other parties to this Agreement
.
-All companies of the HOGO Group are obliged to
maintain confidentiality about data they obtain when processing data.
They undertake to observe the same rules on the protection of secrets as would be incumbent upon them
as the (sole) data protection controller. The
other companies of the HOGO Group are obligated to inform HGC of any
special rules on the protection of secrets. The companies of the HOGO Group
will oblige all employees in written form to treat all data of the
joint data processing operations confidentially.

11. This Agreement is effective as of 25.5.2018 and for an indefinite period of time. It can be
terminated at the end of the calendar year subject to a notice period of at least 12 months
.

12. All companies of the HOGO Group acknowledge and agree that
this Agreement is made available to the data subjects in accordance with Art 26(2) GDPR
.

13. This Agreement shall be governed by Austrian law to the exclusion of the
conflict-of-law rules of private international law as well as the UN Convention on Contracts for the International Sale of Goods. This
Agreement is not a contract in favour of third parties; protective effects in favour of third parties
are excluded as far as legally possible.

Wels, on 22.5.2018
HG Consulting GmbH
HOGO GmbH
HOGO Bau Solution GmbH