Privacy policy

Information about data processing

V3 (August 2026)

Complex Pharmaceuticals GmbH uses the onlyfy Application Manager (by XING) to process job applications. This Privacy Policy will inform you about the processing of your data by the onlyfy Application Manager (by XING) and by Complex Pharmaceuticals GmbH.

Joint controllership

With regard to interaction within the company account of Complex Pharmaceuticals GmbH, Complex Pharmaceuticals GmbH and New Work SE have joint controllership pursuant to Article 26 GDPR, as they jointly determine the purposes and means of processing pursuant to Article 4 (7) GDPR. The current version of the agreement on joint controllership pursuant to Article 26 GDPR, which New Work SE concludes with companies that use onlyfy Application Manager, can be viewed here https://www.xing.com/terms/onlyfy-one to gain information on the key aspects of the agreement.

Data processing by New Work SE

onlyfy Application Manager is part of the extensive XING service operated by New Work SE, which pursues the aim of improving and simplifying users’ working lives with a variety of applications (onlyfy Application Manager, as well as the XING social and jobs network, kununu, etc.), and creates a more fulfilling world of work for individuals while boosting the performance of companies. As part of the extensive XING service, onlyfy Application Manager is an online platform on which or through which talent and companies meet.

With regard to data processing for which New Work SE is solely responsible or is responsible within the scope of the joint controllership with Complex Pharmaceuticals GmbH, detailed information is available in the XING Privacy Policy at https://privacy.xing.com/en/privacy-policy. You will also find contact details for New Work SE, as well as for the New Work SE data protection officer there.

Job applications with onlyfy Application Manager

When submitting an application, you enter into a user relationship with New Work SE for the purpose of processing applications. In addition, you will receive support and New Work SE can present you with other opportunities in support of your career. A public profile will not be automatically created for you on the XING social and jobs network. The legal basis for New Work SE processing your data is, in particular, Article 6 (1)(b) GDPR (processing necessary for the performance of a contract).

Notes on the special functions of onlyfy Application Manager

Calendar function

If the calendar function is used, your data is processed during and for the purpose of setting appointments within the application process. The legal basis is Article 6 (1)(f) GDPR. The calendar function is provided by an IT service provider (Cronofy Ltd., United Kingdom). The United Kingdom is classified as a secure third country based on the adequacy decision of the European Commission. Further information on data protection at Cronofy is available here: https://www.cronofy.com/gdpr/ and https://docs.cronofy.com/policies/privacy-notice/.

WhatsApp application and communication via WhatsApp

If you apply via WhatsApp or if Complex Pharmaceuticals GmbH contacts you via WhatsApp in connection with your application, the legal basis for the communication is your consent, which can be withdrawn at any time, pursuant to Article 6 (1)(a) GDPR. The communication may in particular be used to request application information, clarify follow-up questions, schedule appointments, send reminders, or enable other communication during the application process.

When applying via WhatsApp, the required applicant information is requested during a WhatsApp chat. The data is then transferred directly to onlyfy Application Manager via the service provider PitchYou and processed further there as part of and for the purpose of the normal application process. Candidate data from apply via WhatsApp are deleted from the apply via WhatsApp infrastructure in PitchYou immediately after the transfer. Further processing then takes place exclusively in onlyfy Application Manager.

The WhatsApp functions are provided by the IT service provider PitchYou, which may access your data for this purpose. More information is available here: https://www.pitchyou.de/en/pitchyou-gdpr. Please note that you use your personal WhatsApp account for the application or communication, and therefore processing by WhatsApp or Meta in their own responsibility takes place. A transfer, in particular to the USA, cannot be ruled out. WhatsApp data protection information is available here: https://www.whatsapp.com/legal/privacy-policy-eea.

You can withdraw your consent to communication via WhatsApp at any time with effect for the future. If you do not consent or withdraw your consent, no further communication via WhatsApp will take place.

Applicability of the Swiss Federal Data Protection Act (FADP)

The FADP applies to circumstances which have an impact on Switzerland, even if said circumstances are initiated outside of Switzerland. Correspondingly, this privacy policy applies to information in line with the EU GDPR and the FADP. Here, EU GDPR terminology is used in favour of FADP terminology. However, FADP terminology is used if the FADP applies and the terminology differs from EU GDPR terminology in a given language. The About this site section on XING contains the name and address of our representative in Switzerland.

Data processing by Complex Pharmaceuticals GmbH

Dear Applicant,

Thank you for your interest in our company. Below, we provide information on the processing of your personal data in the context of the recruitment process, the possible inclusion of your data in our group-wide applicant pool, and your related rights.

This Privacy Notice applies to applications submitted via our careers page, available at:
https://www.complex-pharma.com/stellenangebote.html, as well as to applications submitted to us by other means (e.g. via the HR software "onlyfy", by e-mail or by post), provided that the application data are entered into our applicant management system.

To ensure that you are fully informed about the processing of your personal data, we kindly ask you to read the following information.

1. Contact Details of the Controller and the Data Protection Officer

  1. a) Controller

The controller responsible for the processing of personal data within the meaning of the General Data Protection Regulation (GDPR) is:

Name: Complex Pharmaceuticals GmbH
Address: Storchengasse 1, 1150 Vienna, Austria
Telephone: +43 1 208 01 34
E-mail: office@complex-pharma.com

  1. b) Data Protection Officer

For all enquiries relating to data protection and for the exercise of your rights as a data subject (see Section 13 below), you may contact our Data Protection Officer at any time.

You can reach the Data Protection Officer at:

E-mail: dpo@complex-pharma.com

Postal address: Address stated above, marked "Attn: Data Protection Officer"

2. What are Personal Data?

Personal data means any information relating to an identified or identifiable natural person, i.e. information by which the identity of that person is established or can at least be determined. This includes, for example, name, date of birth, e-mail address, social security number, IP address, etc.

  1. For Which Purposes Do We Process Your Personal Data and on Which Legal Bases Do We Rely?

Your personal data are processed for the following purposes:

  1. Conducting the Recruitment Process

This includes assessing your suitability, administering the recruitment process and deciding whether to establish an employment relationship.

Applicant data are processed only to the extent necessary for deciding whether to establish an employment relationship.

Legal basis:
The necessity for taking pre-contractual steps prior to entering into an employment relationship pursuant to Article 6(1)(b) GDPR and our overriding legitimate interest pursuant to Article 6(1)(f) GDPR in conducting an efficient recruitment process.

The processing of special categories of personal data during the recruitment process takes place only where required by a specific legal obligation under Austrian employment or social security law (Article 9(2)(b) GDPR).

  1. Retention of Data in the Group-wide Applicant Pool

If you give us your consent, your data will, upon completion of the specific recruitment process, be stored in a group-wide applicant pool and may be used by Complex Pharmaceuticals GmbH, Orpha Trade GmbH, and affiliated companies for up to twelve (12) months in order to contact you regarding suitable future job opportunities. Within this period, we may contact you regarding an extension of the retention period (see Section 4 below).

Legal basis:
Your explicit consent pursuant to Article 6(1)(a) GDPR and Article 9(2)(a) GDPR, insofar as you voluntarily disclose personal data in your application documents that constitute special categories of personal data within the meaning of Article 9(1) GDPR (e.g. a photograph from which information regarding racial or ethnic origin may be inferred).

This consent is voluntary and has no effect on the ongoing recruitment process. You may withdraw your consent to inclusion in the applicant pool at any time with effect for the future, for example by sending an e-mail to dpo@complex-pharma.com.

The withdrawal of consent shall not affect the lawfulness of processing carried out on the basis of the consent before its withdrawal. Upon receipt of your withdrawal, your data will be deleted from the applicant pool and will no longer be used for this purpose (see Section 13 below).

  1. IT Security and System Administration for Online Applications

When you visit the application form on our careers page, usage and inventory data are processed in server logs for technical reasons in order to ensure the secure operation of the system and maintain IT security.

Legal basis:
Our legitimate interest pursuant to Article 6(1)(f) GDPR in ensuring the functionality, stability and security of our IT systems and careers page, as well as in preventing misuse or unauthorised access.

  1. Feedback and Satisfaction Surveys

With your consent, we may invite you to participate in a satisfaction survey regarding the recruitment process after its completion.

Legal basis:
Your consent pursuant to Article 6(1)(a) GDPR (see Section 13 below).

  1. Compliance with Legal Obligations

Compliance with legal obligations, for example under employment, corporate or tax law.

Legal basis:
Compliance with a legal obligation to which the Controller is subject pursuant to Article 6(1)(c) GDPR, for example in connection with the Austrian Employment of Persons with Disabilities Act (Behinderteneinstellungsgesetz – BEinstG).

  1. Defence and Enforcement of Legal Claims in Connection with Recruitment Procedures

Legal basis:
Article 6(1)(f) GDPR and, where applicable, Article 9(2)(f) GDPR with regard to special categories of personal data.

Our legitimate interest consists, for example, in establishing evidence in proceedings under the Austrian Equal Treatment Act (Gleichbehandlungsgesetz – GlBG).

  1. Further Processing of Your Data Upon the Establishment of an Employment Relationship

If an employment relationship is established with you, we will continue to process the personal data collected during the recruitment process for the purposes of the employment relationship. These data will become part of your personnel file.

Legal basis:
Performance of the employment contract pursuant to Article 6(1)(b) GDPR and compliance with legal obligations, in particular obligations under social security, tax and employment law (e.g. registration with the social security authorities), pursuant to Article 6(1)(c) GDPR.

Where special categories of personal data are processed during the employment relationship (e.g. health data for continued remuneration in the event of illness or trade union membership data for the deduction of union membership fees), such processing shall take place only to the extent necessary for the exercise of rights and the fulfilment of obligations under employment law and the law relating to social security and social protection, pursuant to Article 9(2)(b) GDPR.

4. Inclusion in the Group-wide Applicant Pool and Retention of Your Data

If you expressly consent, we may store your application documents in our group-wide applicant pool beyond the specific recruitment process (so-called retention of applicant data). This enables us to consider you for future vacancies within the Group and, where appropriate, to contact you if your profile matches the requirements of a suitable position (comparison of your profile with the requirements of vacant positions).

The inclusion in the group-wide applicant pool is voluntary. You may withdraw your consent at any time with effect for the future. Refusing to provide consent or withdrawing your consent at a later date shall have no effect on the ongoing recruitment process (see Section 3 above).

Within the framework of the group-wide applicant pool, your personal data may be transferred to the following Group companies and may be accessed and used there for the purposes stated above:

  • Complex Pharmaceuticals GmbH
  • Orpha Trade GmbH, and
  • Companies affiliated with these entities within the meaning of Section 15 of the Austrian Stock Corporation Act (AktG) and Section 115 of the Austrian Limited Liability Companies Act (GmbHG), in particular subsidiaries.

Your data are processed within the framework of joint controllership of the Group companies pursuant to Article 26 GDPR, which jointly determine the purposes and means of the processing. The joint controllers have concluded an agreement defining their respective responsibilities under data protection law. Upon request, we will be pleased to provide you with a summary of the essential contents of this agreement.

Irrespective of this, you may exercise your rights as a data subject against any of the participating companies, for example by sending an e-mail to dpo@complex-pharma.com (see Section 13 below).

5. Which Categories of Personal Data Do We Process?

We process only data that are related to your application. This includes, in particular:

  • Master data: first name and surname, title, gender, date of birth, nationality/right to work, address, contact details (telephone number, e-mail address) and, where applicable, social security number.
  • Application documents: curriculum vitae (CV), cover letter, educational and professional qualification certificates, references, salary expectations and letter of motivation.
  • Interview and selection information: notes taken during interviews, results of internal assessment and selection procedures (e.g. evaluations) and, where conducted and legally permissible, information obtained from personnel screening carried out as part of security checks.
  • Usage and inventory data relating to online applications: IP address, browser type and version, operating system, date and time of access and volume of data transmitted.
  • Other information: any other information that you voluntarily provide during the recruitment process (e.g. possession of a driving licence). Such information may include special categories of personal data within the meaning of Article 9(1) GDPR (e.g. severe disability, medical fitness for work, religious affiliation or trade union membership).

Please only include such information in your application documents if it is relevant to the advertised position and the recruitment process.

We expressly point out that we do not require any information that may not be taken into consideration under the Austrian Equal Treatment Act (Gleichbehandlungsgesetz – GlBG) or the Austrian Employment of Persons with Disabilities Act (Behinderteneinstellungsgesetz – BEinstG), such as information relating to race, ethnic origin, gender, religion or belief, disability, age or sexual identity. Likewise, we ask you not to provide any special categories of personal data within the meaning of Article 9(1) GDPR, such as information concerning your health, pregnancy, political opinions, religious or philosophical beliefs, trade union membership or your sex life, unless such information is expressly required for the specific position.Furthermore, please do not submit any content that may infringe the rights of third parties (e.g. copyrights, personality rights, trade secrets or other confidential information).

 

6. From Which Sources Do We Obtain Your Data?

We process personal data that we receive directly from you in the course of your contact with us or your application (e.g. via online forms, by e-mail or by post). Application documents may also be submitted via web forms on external job platforms (e.g. karriere.at, AMS Job Room or comparable platforms) on which our job advertisements are published.

Furthermore, we may receive personal data from recruitment agencies, temporary employment agencies or other personnel service providers in the course of personnel recruitment.

Where this is necessary for carrying out the recruitment process and is legally permissible, we may also use publicly available, professionally relevant information (e.g. from professional social networks such as LinkedIn) in order to verify or supplement the information you have provided.

7. To Whom Do We Disclose Your Data?

Within Complex Pharmaceuticals GmbH, your data are disclosed only to those persons who are involved in the recruitment process (Human Resources Department, the relevant specialist department and the Management Board).

Within the framework of the group-wide applicant pool, your personal data may be transferred to companies affiliated with us within the Group, insofar as this is necessary for the assessment of your application or for contacting you regarding future job opportunities within the Group (see Section 4 above).

Furthermore, we engage processors within the meaning of Article 28 GDPR, such as operators of applicant management portals, hosting service providers or providers of HR software (e.g. "onlyfy"). These service providers process personal data solely on our instructions and are subject to strict contractual obligations.

Personal data will be transferred to public authorities, courts or external advisors (e.g. recruitment agencies) only where we are legally obliged to do so or where we pursue legitimate interests (e.g. for the establishment, exercise or defence of legal claims).

8. Transfer of Your Data to Third Countries

Personal data will only be transferred to third countries (outside the European Economic Area – EEA) where this is necessary to fulfil the purposes described above and where the specific requirements of Articles 44 et seq. GDPR are met. We use EU Standard Contractual Clauses or rely on adequacy decisions.

Where a service provider located in the United States is engaged, the transfer is carried out on the basis of the EU–US Data Privacy Framework.

We will be pleased to provide you with further information upon request.

9. Data Security and Protection of Your Data

Data security is a matter of course for us. We have implemented appropriate technical and organisational security measures in accordance with Article 32 GDPR to ensure the confidentiality and security of your personal data.

In particular, with regard to online applications, we ensure secure transmission channels and traceable data processing. For this purpose, we implement appropriate security measures, such as encrypted data transmission (e.g. HTTPS) as well as logging and monitoring mechanisms.

10. How Long Do We Store Your Data?

We store your personal data only for as long as necessary for the recruitment process.

If you are hired, we will transfer the required data to your personnel file.

If you are not hired, we will generally delete your data seven (7) months after completion of the recruitment process, unless statutory retention obligations apply or longer storage is required in an individual case for the establishment, exercise or defence of legal claims.

If you have consented to a longer retention of your personal data, we will store your data in accordance with your declaration of consent.

If you consent to inclusion in the group-wide applicant pool, we will store your data for up to twelve (12) months after completion of the recruitment process. During this period, we may contact you regarding an extension of the retention period.

After expiry of this period, your data will be deleted automatically unless you provide renewed consent (see Section 3 above).

Log data relating to online applications (e.g. IP addresses and browser information) are stored only for the period necessary to ensure IT security and are subsequently deleted.

11. Requirement to Provide Your Personal Data

You are not obliged to provide all personal data.

Please note, however, that certain information (in particular contact details and application-related data such as your name and application documents/information relevant to your application) is required in order for us to assess your application. Without this information, the recruitment process cannot be continued.

We therefore recommend that you provide only such personal data as are necessary for the establishment and performance of the employment relationship.

12. No Automated Decision-Making

No automated decision-making, including profiling within the meaning of Article 22 GDPR, takes place.

The decision on whether to establish an employment relationship with you is not based exclusively on automated processing of personal data but is always made with the substantial involvement of a natural person.

13. Your Rights as a Data Subject

You may exercise the following rights at any time:

  • Right to withdraw consent (Article 7(3) GDPR): Where the processing of your data is based on your consent, you have the right to withdraw your consent at any time with effect for the future and to request the deletion or destruction of your data without giving reasons (see Section 14 below). The withdrawal shall not affect the lawfulness of processing carried out before the withdrawal. Please note that we may nevertheless be required to retain certain data for a specified period due to statutory retention obligations.
  • Right of access (Article 15 GDPR): You may request information regarding the origin of your data, the categories of personal data processed, the storage period, the recipients, the purposes of processing and the manner in which your personal data are processed.
  • Right to rectification (Article 16 GDPR) and right to erasure (Article 17 GDPR): If the personal data concerning you are inaccurate or incomplete, you may request the rectification of inaccurate data or the completion of incomplete data. You may also request the deletion of data processed unlawfully.
  • Right to restriction of processing (Article 18 GDPR): If it is unclear whether the personal data concerning you are inaccurate, incomplete or unlawfully processed, you may request restriction of processing until this issue has been finally clarified.
  • Right to object (Article 21 GDPR): Even where the personal data concerning you are accurate and complete, you may object to the processing of such data. However, this applies only where we process your data on the basis of our overriding legitimate interests pursuant to Article 6(1)(f) GDPR, and only in special circumstances which you must explain.
  • Right to data portability (Article 20 GDPR): You may receive the personal data concerning you that you have provided to us in a machine-readable format specified by us or instruct us to transmit those data directly to a third party designated by you, provided this is technically feasible and does not involve disproportionate effort or conflict with statutory or other confidentiality obligations to which we are subject.
  • Right to lodge a complaint with a supervisory authority (Article 77 GDPR): Finally, you have the right to lodge a complaint with the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, Austria (https://www.dsb.gv.at/), if you believe that the processing of your personal data violates applicable data protection laws.

 

14. Contact

If you have any questions regarding data protection in connection with the recruitment process or wish to exercise your rights, you may contact our Data Protection Officer at any time:

E-mail: dpo@complex-pharma.com