Processing of (personal) data by the entity in charge of the online application process
Summary Notice on Employee Data Processing
MicroVision GmbH (Germany)
This Summary Notice summarizes our detailed Full Notice (further below) which describes our practices as a data controller with respect to the processing of your Personal Data (such as collection, use, storage, disclosure or erasure) in connection with your employment with MicroVision GmbH, Amsinckstraße 71, 20097 Hamburg, Germany (“we” or “MicroVision”).
Categories of Personal Data processed
We process the following personal data as data controller, which we collect during the application process and in the course of employment, from you, your supervisor or authorized third parties (i.e., recruitment agencies and public authorities): Your name, other identification data, bank account details, information related to your job, health-related information, salary and benefits, equity compensation, information related to your use of company equipment and resources, your communications, your performance, and any disciplinary actions against you (“Personal Data”). For more details, see the Full Notice (I).
Processing purposes
We process your Personal Data for the following purposes: Administration of the employment relationship, providing payments and benefits, managing your daily job activities, compliance with laws and regulations and our policies and procedures, monitoring job performance, security and fraud prevention, compliance with corporate responsibilities, audit requirements, cost and budgeting analysis and controls. For more details, see the Full Notice (II).
Legal justifications for the processing of your Personal Data
Data protection law, in particular, the General Data Protection Regulation (EU) 2016/679 (“GDPR”) requires any processing of Personal Data to have a legal justification. We generally rely on the following legal justifications: The processing is necessary for (i) employment-related purposes where necessary for hiring decisions, carrying out or terminating the employment contract (Sec. 26 (1) German Federal Data Protection Act) (“Contract Justification”); (ii) compliance with a legal obligation (GDPR Art. 6(1)(c) (“Legal Obligation Justification”)); or (iii) pursuing our legitimate interests not overriding your interests and rights and freedoms (GDPR Art. 6(1)(f) (“Legitimate Interest Justification”)). For more details on purposes of processing and corresponding legal justifications see the Full Notice (III).
Data transfers and recipients
We transfer your Personal Data to our group companies (“MicroVision Group”) and third parties (e.g., business partners, customers, benefits providers), acquiring or acquired entities, service providers, and, in accordance with applicable law, governmental authorities, courts, external advisors, and similar third parties. Some recipients are located outside the EU. For more details, see the Full Notice (IV).
Retention periods and deletion
Your Personal Data will be deleted once no longer needed for the purposes of the original collection or as required by applicable law. For more details, see the Full Notice (V).
Your statutory rights
You may have a number of rights with regard to your Personal Data, subject to conditions of applicable law, including the right to get access to your data, to have it corrected, erased or handed over. Please refer any questions to your local People Operations representative or contact our data protection officer at privacy@microvision.com. For more details, see the Full Notice (VI).
Changes of this Summary and the Detailed Privacy Notice
This Summary and Full Notice are subject to change. We will notify you of such changes.
How to contact us
If you wish to exercise your data subject rights or if you have questions concerning this Summary Notice or the Full Notice, please address your request to us via your local People Operations representative or contact our data protection officer at privacy@microvision.com.
Kindly note that any requests sent through privacy@microvision.com will be distributed to certain members of the MicroVison’s legal team based on their need to know, and subsequently forwarded to the DPO.
_________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________Full Notice on Employee Data Processing
MicroVision GmbH (Germany)
I. Categories of Personal Data
We process non-sensitive Personal Data (“Employee Data”) and certain special categories of Personal Data (i.e., data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation (“Sensitive Employee Data”)), to the extent required and permitted under applicable law.
We process the following Employee Data about you:
Name, job title/code, supervisor, office/personal e-mail, work/personal phone and cellular phone number, employment location, employee number, identification photographs and other generally work-related contact information (“Basic Contact Data”);
Passport, national insurance number, tax ID, citizenship, date of birth, gender, language skills, work permit and visa information, emergency contact information, driver’s license information, home address, employment status (hire/rehire/termination), employee type, educational information, previous employer information, hire, sabbatical and seniority dates, work period (weekly/monthly/etc.), compensation information, bank account information for payroll processing, birth country/location, cost center, job performance information, marital status, number of children, job qualifications, reference checks, training and skills checks, and similar data (“General Human Resources Data”);
Name, citizenship, e-mail address, social security number (U.S. employees) / employee number (non-U.S. employees), date of hire, termination date, tax withholding and reporting information, car allowance information, accounting information, home address, date of birth, grant, vesting and exercise information, contributions to health insurance, pension contributions, and details of applicable bonus and incentive plans, and other information necessary for stock plan administration services (“Stock and Benefit Plan Data”); and
Information regarding your access and use of MicroVision Group facilities and computer systems, such as your username, IP address, emails and other electronic communications, documents, files, websites accessed and log files on MicroVision computer systems, reporting information, security badge information, and camera and video images (“Security and Access Control Data”).
In addition, we process the following Sensitive Employee Data:
Number of sick days;
Information on work-related accidents;
Information on disability if you have disclosed it;
Information on parental leave;
Trade union membership where applicable; and
Religious affiliation for church tax purposes where applicable.
II. Processing purposes
We process your Personal Data to the extent permitted or required under applicable law, for the following purposes:
Facilitating global communication, cooperation and team work within the MicroVision Group and providing for a global directory and internal Intranet-based social network (“Communication Purposes”);
Managing human resources and workflow within the MicroVision Group, including staffing employee evaluations, promotions, cross-border teamwork, global recruitment, secondments, transfers within the MicroVision Group, accounting, compensation and benefit program administration, payroll training, performance management, succession planning, stock option administration, other tangible and intangible benefits, and business travel and work assignments (“General Human Resources and Travel Purposes”);
Facilitating stock and benefit plan administration services (including third-party administrators) (“Stock and Benefits Purposes”);
Complying with applicable laws and employment-related requirements and administration of those requirements, such as income tax, national insurance deductions, and employment and immigration laws (“Regulatory-related Purposes”);
Communicating with your designated contacts in case of an emergency (“Emergency Contact-related Purposes”);
Facilitating and managing security and access control regarding MicroVision Group offices and premises, labs, equipment, and systems (“Security and Access Control Purposes”);
Supporting any claim or defense that the MicroVision Group could face before any jurisdictional and/or administrative authority, arbitration or mediation panel and to cooperate with – or to inform – law enforcement or regulatory authorities to the extent required by law (“Litigation-related Purposes”); and
If the business for which you work may be sold or transferred in whole or in part (or such a sale or transfer is being contemplated), your Personal Data may be transferred to the new employer or potential new employer as part of the transfer itself, or as part of an initial review for such transfer (i.e. due diligence), subject to any rights provided by applicable law, including jurisdictions where the new employer or potential new employer are located (“Acquiring Entities Purposes”).
III. Legal justification for the Processing of your Personal Data
Generally, the processing of your Personal Data is necessary for the conclusion and/or performance of the employment contract. In general, you are required to provide your Personal Data, except in limited instances when we indicate that certain data is voluntary. If you do not provide your Personal Data, certain HR processes might be delayed or impossible.
We rely on the following legal justifications for the processing, of your Personal Data:
FOR PROCESSING OF Employee Data | ||
Processing Purposes | Categories of Employee Data involved | Legal basis |
Communication Purposes
| Basic Contact Data | Contract Justification; or Legitimate Interest Justification to facilitate communications within the MicroVision Group. |
General Human Resources and Travel Purposes | Basic Contact Data General Human Resources Data | Contract Justification; Legal Obligation Justification; or Legitimate Interest Justification to appropriately administer relationships with employees and effectively manage employees. |
Stock and Benefits Purposes | Basic Contact Data Stock and Benefit Plan Data | Contract Justification; Legal Obligation Justification; or Legitimate Interest Justification to facilitate stock and benefits plan administration services. |
Regulatory-related Purposes | Basic Contact Data General Human Resources Data Stock and Benefit Plan Data Security and Access Control Data | Contract Justification; Legal Obligation Justification; or Legitimate Interest Justification to comply with applicable laws and employment-related requirements and administration of those requirements. |
Emergency Contact-related Purposes | Basic Contact Data General Human Resources Data | Legitimate Interest Justification to facilitate communication with your designated contacts in case of an emergency; or The processing is necessary in order to protect your vital interests or those of another natural person (GDPR Art. 6(1)(d)). |
Security and Access Control Purposes | Basic Contact Data General Human Resources Data Security and Access Control Data | Contract Justification; Legal Obligation Justification; or Legitimate Interest Justification to facilitate and manage security and access controls regarding MicroVision Group offices and premises, labs, equipment, and systems. |
Litigation-related Purposes | Basic Contact Data General Human Resources Data Stock and Benefit Plan Data Security and Access Control Data | Legal Obligation Justification; or Legitimate Interest Justification to support any claim or defense that the MicroVision Group could face before any jurisdictional and/or administrative authority. The processing is necessary to detect crimes if there is a documented reason to believe that the employee has committed a crime while employed, the processing of such data is necessary to investigate the crime and is not outweighed by the data subject’s legitimate interest and in particular type and extent are not disproportionate (Sec. 26 (1) 2 FDPA). |
Acquiring Entities Purposes | Basic Contact Data General Human Resources Data Stock and Benefit Plan Data | Contract Justification; Legal Obligation Justification Legitimate Interest Justification to appropriately administer relationships with employees and effectively manage employees; or Legitimate Interest Justification to facilitate stock and benefits plan administration services. |
Regarding processing activities based on Legitimate Interest Justification: more information on the balancing test is available upon request.
FOR PROCeSSING OF SENSITIVE Employee Data | ||
Processing Purposes | Categories of Sensitive Employee Data involved | Legal basis |
General Human Resources Purposes, including administering payroll | Number of sick days Information on parental leave Religious affiliation for church tax purposes where required Information on work-related accidents Information on disability | The processing is necessary (i) for employment-related purposes, if it is necessary to exercise rights or comply with legal obligations derived from labor law, social security and social protection law, and there is no reason to believe that the data subject has an overriding legitimate interest in not processing the data (FDPA Sec. 26(3)); (ii) protecting your vital interests as a data subject (e.g. in the case of a workplace accident) (GDPR Art. 9(2)(c)); (iii) for the assessment of the working capacity of an employee or the provision of health or social care or treatment (GDPR Art. 9(2)(h)) |
Managing workflow | Number of sick days Information on parental leave Information on work-related accidents Information on disability | |
Regulatory-related Purposes | Number of sick days; Information on parental leave Religious affiliation for church tax purposes where required. Information on work-related accidents Information on disability | |
Acquiring Entities Purposes | Information on parental leave Information on work-related accidents Personal Data relating to claims or defenses before any jurisdictional and/or administrative authority. | |
Litigation-related Purposes | Personal Data relating to claims or defenses before any jurisdictional and/or administrative authority. | The processing is necessary for the establishment, exercise or defense of legal claims (GDPR Art. 9(2)(f)). |
IV. Data transfers, recipients and legal justification for such transfers
Recipients of your Personal Data
Other MicroVision Group companies: In some cases, it is necessary to share Employee Data that was collected locally within the MicroVision Group, including with MicroVision, Inc. in the United States. We do so to facilitate internal communication and task management within the MicroVision Group, group-wide HR planning and administration, including staffing, succession planning, forecasting and budgeting, investment decisions, training and performance management, and to be able to fulfil the employment relationship within our global structure, such as to facilitate global cooperation and employee travel or transfers within the group. The legal basis for such transfers is Contract Justification and Legitimate Interest Justification and our legitimate interests are the above mentioned. Access to Employee Data is provided only on a need-to-know-basis and subject to an access concept.
Benefits Providers, Insurance Carriers, Professional Advisors, Business Partners, Suppliers, and Customers: Benefits providers (such as payroll processors or pension plan providers), insurance carriers (such as health plan administrators and life insurance providers), professional advisors (such as audit firms and benefits consultants), business partners (such as university or technical consortia), suppliers (such as supply chain partners), customers, and other benefits administrators and service providers may also receive information about an employee’s salary, benefits, and equity compensation as necessary in connection with our business operations, in particular to administer and provide compensation, administer and provide applicable benefits and other work-related allowances, administer the workforce, comply with applicable laws and employment-related requirements, communicate with you and third parties, and respond to and comply with requests and legal demands. To the extent these providers do not act as Processors (as below), the legal basis for such transfer is the Legitimate Interest Justification.
Third-party service providers: Certain third-party service providers, whether affiliated or unaffiliated, will receive your Personal Data to process such data under appropriate instructions (“Processors”) as necessary for the processing purposes, in particular to carry out certain HR management activities or IT-related tasks. The Processors will be subject to contractual obligations to implement appropriate technical and organizational security measures to safeguard your Personal Data, and to process your Personal Data only as instructed.A list of currently engaged Processors can be provided upon request to privacy@microvision.com.
Government Agencies, Regulators and Professional Advisors: We may need to transfer your Personal Data to government agencies and regulators (e.g., tax authorities, courts, and government authorities) to comply with legal obligations, and to external professional advisors as necessary to pursue legitimate interests (e.g., protecting MicroVision Group’s legal interests) as permitted by law. The legal basis for such transfer is Legal Obligation Justification.
When required by local law to process Sensitive Employee Data, this information will only be transferred outside of your country if permitted by applicable law.
In connection with the data transfers described above, Personal Data may in some cases be transferred onwards to recipients (i) in a country benefitting from an adequacy decision, (ii) bound by standard contractual clauses or other binding instrument ensuring the same level of data protection as standard contractual clauses, (iii) where such onward transfer is necessary for the establishment, exercise or defense of legal claims in the context of specific administrative, regulatory or judicial proceedings, (iv) where it is necessary to protect the vital interest of the data subject or another natural person, (v) you have provided consent to such onward transfer, or (vi) the recipient otherwise ensures appropriate safeguards.
Cross-Border Data Transfers
We transfer Personal Data to MicroVision Group companies, including MicroVision, Inc. in the United States, only if necessary for the purposes listed above. To the extent your Personal Data is transferred to countries that do not provide for an adequate level of data protection from an EU legal perspective, we will base the respective transfer on appropriate safeguards, such as standard contractual clauses, where this is required under applicable law. You can ask for a copy of such appropriate safeguards by contacting privacy@microvision.com. The countries that are recognized to provide for an adequate level of data protection from an EU law perspective are countries in the European Economic Area, Andorra, Argentina, Canada, Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Republic of Korea, Switzerland, the United Kingdom and Uruguay.
V. Retention periods for and deletion of your Personal Data
Your Personal Data is stored by MicroVision and/or our service providers to the extent necessary for the performance of our obligations and strictly for the time necessary to achieve the purposes for which the information was collected, in accordance with applicable data protection laws. Please note that the employment relationship is a continuing obligation that typically exists for an indefinite period. When MicroVision no longer needs to use your Personal Data to comply with contractual or statutory obligations, we will remove it from our systems and records and/or take steps to properly anonymize it so that you can no longer be identified from it, unless we need to keep your information, including Personal Data, to comply with legal or regulatory obligations to which MicroVision is subject, such as statutory retention periods that can result from the Commercial Code or the Tax Code, which usually prescribe retention periods between 6 to 10 years, or if we need the information to preserve evidence within the statutes of limitation, which is usually 3 years but can be up to 30 years.
VI. Your statutory rights
Under the conditions set out under applicable law, you may have the following limited rights:
Right of access: The right to obtain from us confirmation as to whether your Personal Data is being processed, and, where that is the case, to request access to the Personal Data. The access information includes – inter alia – the purposes of the processing, the categories of Personal Data concerned, and the recipients or categories of recipients to whom the Personal Data have been or will be disclosed.
The right to obtain a copy of the Personal Data undergoing processing. Subject to applicable law, we may charge a reasonable fee for copies, based on administrative costs.
The right of access is not an absolute right and the interests of other individuals may restrict your right of access.
Right to rectification: The right to obtain from us the rectification of inaccurate Personal Data concerning you. Depending on the purposes of the processing, the right to have incomplete Personal Data completed, including by means of providing a supplementary statement.
Right to erasure (to be forgotten): The right to ask us to erase your Personal Data. However, such right to erasure may be limited.
Right to restriction of processing: The right to request restriction of processing of your Personal Data, in which case, and if the requirements are met, it would be marked and processed by us only for certain purposes.
Right to data portability: Under certain circumstances, the right to receive your Personal Data which you have provided to us in a structured, commonly used and machine-readable format and the right to transmit the Personal Data to another entity without hindrance from us.
Right to object: The right to object, on grounds relating to your particular situation, at any time to the processing of your Personal Data by us, where we rely on either our legitimate interests (or those of a third party) or where processing is necessary for the performance of a task carried out in the public interest, as the legal basis, and we can be required to no longer process your Personal Data. If you have a right to object and you exercise this right, your Personal Data will no longer be processed for such purposes by us. Exercising this right will not incur any cost. Such a right to object may not exist, in particular, if the processing of your Personal Data is necessary to take steps prior to entering into a contract or to perform a contract already concluded.
Please note that these rights might also be limited under the FDPA. As your employer, we are your point of contact for exercising these rights. You also have the right to lodge a complaint with the supervisory authority.
Please refer any of your questions to your local People Operations representative or contact our data protection officer at privacy@microvision.com.
Kindly note that any requests sent through privacy@microvision.com will be distributed to certain members of the MicroVison’s legal team based on their need to know, and subsequently forwarded to the DPO.