Information about data processing
V3 (August 2026)
Austrian Power Grid AG uses the onlyfy Application Manager (by XING) to process job applications. This Privacy Policy will inform you about the processing of your data by the onlyfy Application Manager (by XING) and by Austrian Power Grid AG.
Joint controllership
With regard to interaction within the company account of Austrian Power Grid AG, Austrian Power Grid AG and New Work SE have joint controllership pursuant to Article 26 GDPR, as they jointly determine the purposes and means of processing pursuant to Article 4 (7) GDPR. The current version of the agreement on joint controllership pursuant to Article 26 GDPR, which New Work SE concludes with companies that use onlyfy Application Manager, can be viewed here https://www.xing.com/terms/onlyfy-one to gain information on the key aspects of the agreement.
Data processing by New Work SE
onlyfy Application Manager is part of the extensive XING service operated by New Work SE, which pursues the aim of improving and simplifying users’ working lives with a variety of applications (onlyfy Application Manager, as well as the XING social and jobs network, kununu, etc.), and creates a more fulfilling world of work for individuals while boosting the performance of companies. As part of the extensive XING service, onlyfy Application Manager is an online platform on which or through which talent and companies meet.
With regard to data processing for which New Work SE is solely responsible or is responsible within the scope of the joint controllership with Austrian Power Grid AG, detailed information is available in the XING Privacy Policy at https://privacy.xing.com/en/privacy-policy. You will also find contact details for New Work SE, as well as for the New Work SE data protection officer there.
Job applications with onlyfy Application Manager
When submitting an application, you enter into a user relationship with New Work SE for the purpose of processing applications. In addition, you will receive support and New Work SE can present you with other opportunities in support of your career. A public profile will not be automatically created for you on the XING social and jobs network. The legal basis for New Work SE processing your data is, in particular, Article 6 (1)(b) GDPR (processing necessary for the performance of a contract).
Notes on the special functions of onlyfy Application Manager
Calendar function
If the calendar function is used, your data is processed during and for the purpose of setting appointments within the application process. The legal basis is Article 6 (1)(f) GDPR. The calendar function is provided by an IT service provider (Cronofy Ltd., United Kingdom). The United Kingdom is classified as a secure third country based on the adequacy decision of the European Commission. Further information on data protection at Cronofy is available here: https://www.cronofy.com/gdpr/ and https://docs.cronofy.com/policies/privacy-notice/.
WhatsApp application and communication via WhatsApp
If you apply via WhatsApp or if Austrian Power Grid AG contacts you via WhatsApp in connection with your application, the legal basis for the communication is your consent, which can be withdrawn at any time, pursuant to Article 6 (1)(a) GDPR. The communication may in particular be used to request application information, clarify follow-up questions, schedule appointments, send reminders, or enable other communication during the application process.
When applying via WhatsApp, the required applicant information is requested during a WhatsApp chat. The data is then transferred directly to onlyfy Application Manager via the service provider PitchYou and processed further there as part of and for the purpose of the normal application process. Candidate data from apply via WhatsApp are deleted from the apply via WhatsApp infrastructure in PitchYou immediately after the transfer. Further processing then takes place exclusively in onlyfy Application Manager.
The WhatsApp functions are provided by the IT service provider PitchYou, which may access your data for this purpose. More information is available here: https://www.pitchyou.de/en/pitchyou-gdpr. Please note that you use your personal WhatsApp account for the application or communication, and therefore processing by WhatsApp or Meta in their own responsibility takes place. A transfer, in particular to the USA, cannot be ruled out. WhatsApp data protection information is available here: https://www.whatsapp.com/legal/privacy-policy-eea.
You can withdraw your consent to communication via WhatsApp at any time with effect for the future. If you do not consent or withdraw your consent, no further communication via WhatsApp will take place.
Applicability of the Swiss Federal Data Protection Act (FADP)
The FADP applies to circumstances which have an impact on Switzerland, even if said circumstances are initiated outside of Switzerland. Correspondingly, this privacy policy applies to information in line with the EU GDPR and the FADP. Here, EU GDPR terminology is used in favour of FADP terminology. However, FADP terminology is used if the FADP applies and the terminology differs from EU GDPR terminology in a given language. The About this site section on XING contains the name and address of our representative in Switzerland.
Data processing by Austrian Power Grid AG
The lawful handling of personal data is an important foundation for the day-to-day work of Austrian Power Grid AG (APG, also referred to in the following as “we” and “us”).
1. Name and address of the controller and method of contacting the data protection officer
Austrian Power Grid AG
Wagramer Straße 19
1220 Wien (IZD-Tower)
Österreich
If you have any questions or you would like to exercise any affected rights, you can contact our data protection officer Datenschutzbeauftragten at datenschutz@apg.at.
2. Data processing
2.1 Application management
2.1.1 Subject matter and purpose of processing
APG provides applicants with a facility to make an online application. The personal data that is processed as part of an online application includes:
- key applicant details (name, title, e-mail address, postal address, telephone number, date of birth, citizenship, candidate ID);
- CV, in particular details of professional experience and education;
- cover letter from the applicant;
- photograph (optional);
- qualifications, awards and language skills;
- files and documents (for example certificates) that may be uploaded;
- details in additional data fields;
- interview notes from job interviews;
- result from the PEP (politically exposed person) check
- results from the personality questionnaire (LPP)
- criminal record extract
- self disclosure form security check (dependent on position)
- personal assessment (head of departments, team leads, project leads)
APG processes your personal data for the purpose of corresponding with you and handling your application. In addition, we may process personal data insofar as this is necessary to defend us against legal claims made against us.
2.1.2 Retention period
We process personal data for a period of six months, starting from the day on which the selection process ends. If you consent to us keeping your details on file, APG shall store personal data for a period of up to three years.
2.1.3 Legal basis
The legal basis for processing this personal data is provided by the employment contract, should one be concluded. The legal basis in this case is Article 6(1)(b) GDPR.
If you have consented to us keeping your details on file, the legal basis for the processing of this personal data is provided by your voluntary consent in accordance with Article 6(1)(a) GDPR.
2.1.4 Recipients
We use the services of New Work SE, Strandkai 1, 20457 Hamburg, Germany as the processor for the technical and administrative aspect of processing your data. On the occasion data will be passed on to HR Diamonds GmbH, Weihburggasse 4/27, 1010 Vienna for conducting personal assessments.
3. Rights of data subjects
You have the following rights with regard to the processing of your personal data:
Right to revoke consent
Insofar as we process data concerning you on the basis of your consent (Article 6(1)(a) GDPR), you can revoke your consent at any time. We will no longer process your personal data from the receipt of your revocation. However, revocation of consent does not affect the lawfulness of processing operations that occurred up until the time of revocation.
Right of access
You can request access to the personal data concerning you that is being processed. Upon request, we shall provide you with a copy of the personal data concerning you that is being processed. Please note that access is not granted if this puts at risk trade or business secrets of the controller or a third party.
Right to rectification
If we process data concerning you that is inaccurate or incomplete, you can request that it is rectified or completed.
Right to erasure
You have the right to request that we erase personal data concerning you. We are happy to erase personal data insofar as this is provided for in the GDPR. For instance, personal data shall not be erased if the processing of the data is required to fulfil a legal obligation or to assert, exercise or defend legal claims.
Right to restrict processing
Under certain conditions you can request that we restrict the use of your personal data. This is the case, for instance, if the accuracy of the personal data concerning you is in dispute, specifically for the time needed to check the accuracy.
Right to object
Insofar as your personal data is processed on the basis of legitimate interests (Article 6(1)(f) GDPR), you are entitled to file an objection for reasons arising from your particular situation. In this case we shall no longer process your data unless there are imperative grounds for processing that merit protection which override your interests, rights and freedoms, or the processing serves the purpose of asserting, exercising or defending legal claims.
Right to data portability
If we process personal data provided by you on the basis of your consent or in order to perform a contract, you can request to receive this data or that we transmit it to another controller.
Right to complain
If you believe that the processing of your personal data infringes the GDPR, you are, of course, welcome to contact us at datenschutz@apg.at at any time.
In addition, you are entitled to file a complaint with the Austrian Data Protection Authority.