Privacy policy

Information about data processing

V3 (August 2026)

EVVA Sicherheitstechnologie GmbH uses the onlyfy Application Manager (by XING) to process job applications. This Privacy Policy will inform you about the processing of your data by the onlyfy Application Manager (by XING) and by EVVA Sicherheitstechnologie GmbH.

Joint controllership

With regard to interaction within the company account of EVVA Sicherheitstechnologie GmbH, EVVA Sicherheitstechnologie GmbH and New Work SE have joint controllership pursuant to Article 26 GDPR, as they jointly determine the purposes and means of processing pursuant to Article 4 (7) GDPR. The current version of the agreement on joint controllership pursuant to Article 26 GDPR, which New Work SE concludes with companies that use onlyfy Application Manager, can be viewed here https://www.xing.com/terms/onlyfy-one to gain information on the key aspects of the agreement.

Data processing by New Work SE

onlyfy Application Manager is part of the extensive XING service operated by New Work SE, which pursues the aim of improving and simplifying users’ working lives with a variety of applications (onlyfy Application Manager, as well as the XING social and jobs network, kununu, etc.), and creates a more fulfilling world of work for individuals while boosting the performance of companies. As part of the extensive XING service, onlyfy Application Manager is an online platform on which or through which talent and companies meet.

With regard to data processing for which New Work SE is solely responsible or is responsible within the scope of the joint controllership with EVVA Sicherheitstechnologie GmbH, detailed information is available in the XING Privacy Policy at https://privacy.xing.com/en/privacy-policy. You will also find contact details for New Work SE, as well as for the New Work SE data protection officer there.

Job applications with onlyfy Application Manager

When submitting an application, you enter into a user relationship with New Work SE for the purpose of processing applications. In addition, you will receive support and New Work SE can present you with other opportunities in support of your career. A public profile will not be automatically created for you on the XING social and jobs network. The legal basis for New Work SE processing your data is, in particular, Article 6 (1)(b) GDPR (processing necessary for the performance of a contract).

Notes on the special functions of onlyfy Application Manager

Calendar function

If the calendar function is used, your data is processed during and for the purpose of setting appointments within the application process. The legal basis is Article 6 (1)(f) GDPR. The calendar function is provided by an IT service provider (Cronofy Ltd., United Kingdom). The United Kingdom is classified as a secure third country based on the adequacy decision of the European Commission. Further information on data protection at Cronofy is available here: https://www.cronofy.com/gdpr/ and https://docs.cronofy.com/policies/privacy-notice/.

WhatsApp application and communication via WhatsApp

If you apply via WhatsApp or if EVVA Sicherheitstechnologie GmbH contacts you via WhatsApp in connection with your application, the legal basis for the communication is your consent, which can be withdrawn at any time, pursuant to Article 6 (1)(a) GDPR. The communication may in particular be used to request application information, clarify follow-up questions, schedule appointments, send reminders, or enable other communication during the application process.

When applying via WhatsApp, the required applicant information is requested during a WhatsApp chat. The data is then transferred directly to onlyfy Application Manager via the service provider PitchYou and processed further there as part of and for the purpose of the normal application process. Candidate data from apply via WhatsApp are deleted from the apply via WhatsApp infrastructure in PitchYou immediately after the transfer. Further processing then takes place exclusively in onlyfy Application Manager.

The WhatsApp functions are provided by the IT service provider PitchYou, which may access your data for this purpose. More information is available here: https://www.pitchyou.de/en/pitchyou-gdpr. Please note that you use your personal WhatsApp account for the application or communication, and therefore processing by WhatsApp or Meta in their own responsibility takes place. A transfer, in particular to the USA, cannot be ruled out. WhatsApp data protection information is available here: https://www.whatsapp.com/legal/privacy-policy-eea.

You can withdraw your consent to communication via WhatsApp at any time with effect for the future. If you do not consent or withdraw your consent, no further communication via WhatsApp will take place.

Applicability of the Swiss Federal Data Protection Act (FADP)

The FADP applies to circumstances which have an impact on Switzerland, even if said circumstances are initiated outside of Switzerland. Correspondingly, this privacy policy applies to information in line with the EU GDPR and the FADP. Here, EU GDPR terminology is used in favour of FADP terminology. However, FADP terminology is used if the FADP applies and the terminology differs from EU GDPR terminology in a given language. The About this site section on XING contains the name and address of our representative in Switzerland.

Data processing by EVVA Sicherheitstechnologie GmbH

Below you will find information from EVVA Sicherheitstechnologie GmbH, Wienerbergstraße 59-65, 1120 Vienna (hereinafter referred to as “EVVA”) regarding data processing for which EVVA is solely responsible or within the framework of joint responsibility with New Work SE.

Transparency and a trusting handling of your personal data is an important basis for good cooperation. Therefore, we inform you about how we process your data and how you can exercise your rights under the General Data Protection Regulation (GDPR). The information below provides you with an overview of the collection and processing of your personal data in connection with the performance of the application process. Please read this Privacy Policy carefully before applying to us.

  1. Data protection contact person

If you have any questions about data processing, please contact: datenschutz@evva.com or office@spwr.at

  1. What is personal data?

Personal data are processed in accordance with Art. 4 (1) GDPR all information relating to an identified or identifiable natural person; An identifiable person is any natural person who, directly or indirectly, in particular by assignment to an identifier such as a name, to an identification number, location data, to an online identifier or to one or more special characteristics expressing the physical, physiological, the genetic, mental, economic, cultural or social identity of that natural person.

  1. What data will be processed?

To carry out the application process, the following data or Data categories processed:

  • Applicant master data (first name, last name, title, e-mail address, telephone number, address, date of birth, citizenship)
  • Qualification data (letter, cover letter, CV, previous activities, professional qualifications and competencies)
  • voluntary information, such as an application photo, information on severely disabled status or other information that you voluntarily provide to us in your application or voluntarily upload
  • Additional questions depending on the respective tender (e.g. driver’s licence)
  • communication between you and us, as well as comments and reviews written about you as part of your application process
  • Other data/data categories, e.g. publicly available, work-related data, e.g. a profile on professional social media networks such as XING or LinkedIn 
  • Special categories of personal data: If you provide information in your application documents, the special categories of personal data within the meaning of Art. 9 Abs. 1 GDPR (e.g. information that allows conclusions to be drawn about your sexual orientation; Information about your health; information that allows conclusions to be drawn about your ethnic origin or religion), we will also only process this data to the extent permitted by law.
  1. For what purposes do we process your data and on what legal basis?

Data processing for the purpose of Beschäftigungsverhältnisses

Your personal data will be processed for the purposes of recruitment to fill open positions, i.e. to initiate an employment contract. The necessity and scope of data collection are assessed, among other things, according to the position to be filled. If your intended position involves carrying out particularly confidential tasks, increased personnel and/or financial responsibility, or is linked to certain physical and health conditions, more extensive data collection may be required. Your data may also be used to remind you to complete your application. 

Consent - Art. 6 para. 1 lit. an and Art. 9 para. 2 lit. a GDPR

If you have given us voluntary consent to the processing of certain personal data, this consent forms the legal basis for the processing of this data.

In the following cases, we process your personal data on the basis of your consent:

  • For longer data storage for our company, i.e. we store the application documents in our company account beyond the current application process for consideration in subsequent application processes of our company.
  • Forwarding of documents to other Group companies/Group-wide applicant pool. The data you have already provided during the application process will be processed for this purpose.

If we base data processing on your consent, you have the right to withdraw your consent at any time with effect for the future. If possible, you can send your revocation by e-mail to datenschutz@evva.com. The Rechtmäßigkeit processing of your data up to the time of revocation remains unaffected.

Data processing on the basis of legitimate interest - Art. 6(1)(f) GDPR

In certain cases, we process your data to safeguard a legitimate interest of us or of third parties. A legitimate interest exists, for example, if your data is used to assert, exercise or defend legal claims as part of the application process (e.g. claims under the General Equal Treatment Act). In the event of a legal dispute, we have a legitimate interest in processing the data for evidence purposes.

  1. Who will your data be shared with?

Your data is mainly processed by our HR department. However, other internal and external parties may also be involved in the processing of your data.

Internal positions can be specialist departments or the works council of our company.

As an external service provider, we use New Work SE. New Work SE, Strandkai 1, 20457 Hamburg operates onlyfy one, the online platform we use to bring talents and companies together. You can find more information about onlyfy one above.

If you apply via onlyfy one, your personal data will be collected directly in onlyfy one. We can also transfer your data to onlyfy one in the event of a postal or e-mail application.

  1. How long will your data be stored in our onlyfy one company account?

We store your personal data for as long as necessary to make a decision about your application. Insofar as there is no agreement between you and Beschäftigungsverhältnis us, we may also continue to store data insofar as this is necessary for the defence against possible legal claims. Regelmäßig Your data will be deleted within six months of the end of the application process for our company.

Insofar as this is not the Beschäftigungsverhältnis case, but you have given us your consent to the further storage of your data ("EVVA applicant pool"), we will store your data until you withdraw your consent, but for a maximum of three further years. On specific grounds, we may also store your data for a longer period of time for the purpose of defence against possible legal claims.

If you withdraw your application before the end of the application process, i.e. Deleting your data and your account means that the stored data will be blocked for the period of the ongoing application process and deleted for our company six months after the end of the application process.

If you do not make any further changes to your candidate profile, for example, complete an ongoing application, start a new application or change the data of an existing application, your data will be deleted within six months of the end of the last active application process for our company.

If you no longer use your candidate profile and have not consented to the longer storage of data in our applicant pool, the data will be deleted for our company within six months of the end of the application process.

You can request the deletion of your candidate profile and application documents at any time. 

  1. What rights do you have in connection with the processing of your data?

You can request information as to whether we have stored personal data about you. If you wish, we will let you know what data is involved, for what purposes the data is processed, to whom this data is disclosed, for how long the data is stored and what other rights you have in relation to this data.

You also have the right to have your data corrected or erased. You may also request that we provide any personal data you have provided to us in a structured, commonly used and machine-readable format either to you or to an individual or company of your choice.

You also have the right not to be subject to a decision based solely on automated processing - including profiling - which has legal effect against you. As part of the application process, we do not use exclusively automated processing processes for decision-making.

You also have the right, for reasons relating to your particular situation, to object at any time to the processing of personal data concerning you that is based on Art. 6(1) lit. e GDPR (data processing in the public interest) or pursuant to Art. 6 para. 1 lit. GDPR (data processing for the protection of a legitimate interest), this also applies to profiling based on this regulation. In the event of your objection, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that outweigh your interests, rights and freedoms, or the processing serves the assertion, exercise or defence of legal claims.

In addition, you have the right to lodge a complaint with the competent data protection supervisory authority.

To exercise your rights, you can contact us by e-mail at datenschutz@evva.com or office@spwr.at. We will process your requests as soon as possible and in gemäß accordance with legal requirements, and will inform you of the measures we have taken or will take.

  1. Is there an obligation to provide your personal data?

The provision of personal data is neither legally nor contractually required, nor are you obliged to provide the personal data. However, the provision of personal data is necessary for the performance of the application process. This means that if you do not provide us with personal data when applying, we will not be able to carry out the application process.

***