Privacy policy
according to Art 13 General Data Protection Regulation
1. Introduction |
| This privacy policy provides information about which personal data we process when you visit our website, contact us, send us mailings, use our services, in particular our applicant portal and our online presence. CLC Digital GmbH, Währinger Straße 94/15+16, 1180 Vienna (hereinafter“CLC” or“we/us“) is responsible for the website. Any processing of data takes place exclusively in accordance with the relevant legal regulations, in particular the General Data Protection Regulation (“GDPR“), the Data Protection Act (“DSG“) and the Telecommunications Act 2021 (“TKG“) in the respective applicable version. If you have any questions about the processing of personal data, please contact us at privacy@clc-consulting.com |
2. Contact details of the person responsible |
CLC Digital GmbH Währinger Strasse 94/15+16 1180 Vienna T: +43 664 91 44 906 E-mail: privacy@clc-consulting.com |
3. Personal data and general information |
| Personal data is any information relating to an identified or identifiable natural person, such as name, address, e-mail address, telephone number, date of birth, age or gender. |
| This privacy policy informs you about how we collect, process and store your personal data, in particular when you visit our website, contact us and operate our applicant portal. |
| We not only process data that we collect ourselves, but also data that you provide to us. This data is only processed and stored to the extent necessary for the fulfillment of contractual and/or legal obligations in accordance with Art. 6 para. 1 lit. b and c GDPR or if we have obtained your consent to the processing of personal data in accordance with Art. 6 para. 1 lit. a GDPR in advance. If the processing is necessary to protect our legitimate interests or those of a third party, such as our partners in particular, and if your interest in data protection and confidentiality does not outweigh this, we base the processing of personal data on Art. 6 para. 1 lit. f GDPR. Under certain circumstances, “sensitive” data, such as data relating to conduct relevant under criminal law in accordance with Art. 10 GDPR, may also be processed, in particular for the assertion, exercise or defense of legal claims within the framework of the contractual relationship. If this is the case, we base the processing on the legal basis of Art. 9 para. 2 lit. f GDPR, among others. We delete or anonymize personal data as soon as the purpose of the processing no longer applies, provided that we, as the controller, are not subject to any legal obligations to store the data beyond the period for which the purpose was fulfilled. Furthermore, we reserve the right to store personal data for as long as specific legal claims are asserted against us. |
4. Processing activities |
| We process personal data for the following purposes: |
4.1 Contact initiation and customer care |
| In the context of establishing contact, e.g. due to an inquiry, the processing of personal data is necessary. This also applies to the support of our customers. |
| Scope of data processing |
| For the purpose of establishing contact and our customer service, we process personal data exclusively to the extent necessary to process the request. This includes in particular the personal data that is sent to us by e-mail or via another communication channel or that is necessary to process the request, provided that information is already communicated to us here. The processing is therefore carried out in the context of the initiation or execution of a contractual relationship or our legitimate interest. Personal data is collected, generated and stored, but only to the extent necessary to fulfill our legal and contractual obligations or to process our legitimate interests. If we obtain data from other sources, this is stated below. |
| Purpose of data processing |
| We process personal data solely for the purpose of facilitating communication with us. Of course, we have taken all technical and organizational measures to ensure the security of the data. |
| Legal basis for data processing |
| In the case of inquiries in connection with our offer, etc., the processing of personal data for this purpose takes place in fulfilment of our (pre-)contractual obligations in accordance with Art. 6 para. 1 lit. b GDPR. If an inquiry is made by potential applicants or a general inquiry, we process the data on the basis of our legitimate interest in accordance with Art. 6 para. 1 lit. f GDPR. |
| Recipient of the data |
| In order to process your request quickly and efficiently, we use the following service providers. In accordance with Art. 28 GDPR, the service providers are contractually obliged to protect personal data at all times, to take appropriate technical and organizational measures with regard to data security and under no circumstances to process data for their own purposes or to pass it on to third parties: |
Hosting of the website / applicant portal Workforce Cloud Tech, Inc. United States of America (USA) |
| Furthermore, we reserve the right to forward the data collected for this purpose to the competent authorities and courts as well as our legal representation and insurance company and all other recipients specifically required in individual cases in the event of justified suspicion of abusive behavior. This is done on the basis of our legitimate interest in proper legal prosecution in accordance with Art. 6 para. 1 lit. f GDPR. |
| The transfer of data to the USA for the purpose of operating our applicant portal is based on Article 46(2)(c) GDPR. |
| Storage duration |
| In principle, personal data is stored until the inquiry has been processed, unless it is required for the further course of a business relationship. If we have reasonable suspicion of abusive behavior and forward the data to the responsible public authorities, this data will be stored on a separate data carrier and deleted after the prosecution has ended. If you have any questions about the specific retention period of your personal data, please contact us at privacy@clc-consulting.com. |
| Further processing of the data |
| The data may be processed further in the context of contract processing, our marketing activities and in connection with our applicant portal and the recruiting process. |
| Automated decision making |
| The data processed as part of this processing activity is not processed for automated decision-making, nor do we carry out so-called “profiling”. |
4.2 Visiting our website / applicant portal |
| Personal data is processed when you visit our website and our applicant portal. |
| Scope of data processing |
| When you access our website or applicant portal, we automatically collect and store information in so-called server log files, which your browser automatically transmits to us. These are |
| Browser type, browser version, operating system used, referrer URL, host name of the accessing computer, date and time of the server request, your IP address. |
| Purpose of data processing |
| We process this data for the purposes of logging system usage, the authorization process and evaluating server log files for problem analysis. If no data is provided, it may be the case that access is not possible. |
| Legal basis for data processing |
| The processing of the aforementioned data is in our legitimate interest as the operator of the website or applicant portal for the purpose of providing it, for data security and for problem analysis. In principle, the individual data records are not merged, but we reserve the right to check the data if we become aware of specific indications of unlawful use, in particular malicious attacks. |
| An objection can be sent to privacy@clc-consulting.com at any time, stating the reasons. |
| Recipients of the data |
| We use the following service providers to operate our website, including the hosting of our applicant portal, and to ensure the security of our IT systems. In accordance with Art. 28 GDPR, the service providers are contractually obliged to protect personal data at all times, to take appropriate technical and organizational measures with regard to data security and under no circumstances to process data for their own purposes or to pass it on to third parties: |
Hosting of the website / applicant portal Workforce Cloud Tech, Inc. United States of America (USA). |
| Furthermore, we reserve the right to forward the data collected for this purpose to the competent authorities and courts as well as our legal representation and insurance company and all other recipients specifically required in individual cases in the event of justified suspicion of abusive behavior. This is done on the basis of our legitimate interest in proper legal prosecution in accordance with Art. 6 para. 1 lit. f GDPR. |
| As part of the operation of our website or applicant portal, personal data is transferred to the USA. The data transfer to the USA is based on Art 45 Z 2 lit c GDPR. |
| Storage duration |
| The data collected here is rotated daily and automatically stored for a period of 31 days after a retention period of one day. If we have reasonable suspicion of abusive behavior and forward the data to the responsible public authorities, this data is stored on a separate data carrier and deleted after the prosecution has ended. |
| Further processing of the data |
| The data processed for this purpose will – in the event of justified suspicion – be further processed as part of our IT security. |
| Automated decision making |
| The data processed during visits to our website and applicant portal are not processed for automated decision-making, nor do we carry out so-called “profiling”. |
4.3 Marketing for own purposes |
| Personal data is processed as part of our marketing activities. |
| Scope of data processing |
| We process the following data when contacting candidates whose contact details and information we hold on record: |
| Surname, first name, form of address, title, gender, contact details, language of correspondence, other identifiers, preferred means of communication if applicable, blocking codes, information on date and time of contact, free text field for comments. |
| Purpose of data processing |
| The purpose of IT-based data processing is to be able to organize our marketing activities, i.e. the application for new open positions and the subsequent contact with suitable candidates whose application we have on file, smoothly and efficiently. The aim is therefore to inform potential candidates about new positions. |
| Legal basis for data processing |
If there are currently no suitable vacancies, we will keep your application on file for a period of two years on the basis of your express consent in accordance with Art. 6 (1) (a) GDPR. We process the aforementioned personal data in the case of electronic direct marketing (e.g. sending by email) on the basis of your express consent in accordance with Art. 6 para. 1 lit. a GDPR in conjunction with § 174 TKG. The legal basis for postal direct marketing is our legitimate interests pursuant to Art. 6 para. 1 lit. f GDPR. You can revoke your consent at any time with effect for the future, e.g. by sending an email to privacy@clc-consulting.com or via the unsubscribe link in every email. You can object to the processing of your data for direct mail marketing at any time, stating your reasons. Once you have withdrawn your consent or objected, we will stop processing your data for this purpose. Please contact us for this purpose at privacy@clc-consulting.com. |
| Recipient of the data |
| We use the following service providers as part of our marketing activities, in particular when contacting them to advertise new open positions. In accordance with Art. 28 GDPR, the service providers are contractually obliged to protect personal data at all times, to take appropriate technical and organizational measures with regard to data security and under no circumstances to process data for their own purposes or to pass it on to third parties: |
To keep the contact details and information of candidates on file: Workforce Cloud Tech, Inc. United States of America (USA) |
| Furthermore, we reserve the right to forward the data collected for this purpose to the competent authorities and courts as well as our legal representation and insurance company and all other recipients specifically required in individual cases in the event of justified suspicion of abusive behavior. This is done on the basis of our legitimate interest in proper legal prosecution in accordance with Art. 6 para. 1 lit. f GDPR. |
| Personal data is transferred to the USA in the context of data retention. The data transfer to the USA is based on Art 45 Z 2 lit c GDPR. |
| Storage duration |
| We store your personal data for record-keeping purposes for up to two years, unless you have previously revoked your voluntary consent to record-keeping. In addition, we store your data for postal marketing purposes until you object or withdraw your consent for electronic direct marketing. |
| Further processing of the data |
| The data processed for this purpose will not be processed for any other purpose. |
| Automated decision making |
| The data processed when you visit our website is not used for automated decision-making, nor do we carry out so-called “profiling”. |
| Corporate Communications |
| We process your data under joint responsibility with the respective platform operator in accordance with Art. 26 GDPR. These are |
– LinkedIn, operated by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (“LinkedIn”); – Xing, operated by New Work SE, Am Strandkai 1, 20457 Hamburg, Germany (“Xing”). |
| We expressly point out that we only have access to the data that you as a user have made available to these platforms. We have no influence on any evaluations, transfers to third parties or other processing of your data for other purposes, despite our joint responsibility. If you have any questions about the processing of your data that go beyond the purposes stated here and/or to assert your rights, please contact the respective platform operator. |
| Further information on the processing of your data and the content of the joint controllership agreement can be found at: |
– LinkedIn: https://www.linkedin.com/legal/privacy-policy |
| Scope of data processing |
| We operate company pages for corporate communication on various social media platforms. As part of our corporate communications, the personal data you provide on the social media platforms is therefore processed when you interact with us via these channels. These are usually |
| Surname, first name, title, gender, telephone and fax number and other information required for addressing purposes resulting from modern communication technologies, online identity of the respective social media platform (user name, photo, avatar, logo), published and non-published contributions to the social media presence (e.g. comments, enquiries, ratings [e.g. “likes”], photos, videos, etc.), public and non-public reactions to our contributions (replies, comments, correspondence, etc.), logging of enquiries and correspondence comments, requests, ratings [e.g. “like”], photos, videos, etc.), public and non-public reactions to our posts (replies, comments, etc.), logging of requests and correspondence via social media channels, content and time of creation of the log, other response behavior to activities (positive reaction to posts); |
| Purpose of the data processing |
| The purpose of data processing is to enable quick and easy correspondence through our online presence, to give you the opportunity to make comments and to inform you about our services. For example, you can contact us via direct messages, the Like function or the comment function. As part of this correspondence, we will only see the data that you have stored on your profile. We would like to point out that your comments and likes will be stored indefinitely unless you request their deletion and can be viewed by other users. |
| Legal basis for data processing |
| We process your personal data within the scope of our legitimate interests in accordance with Art. 6 para. 1 lit. f GDPR in order to enable quick and easy correspondence and our (pre-)contractual obligations in accordance with Art. 6 para. 1 lit. b GDPR. |
| If you do not want us to process your data, please do not interact with our posts. |
| Recipient of the data |
| We do not transmit your data to any other recipients. The extent to which your data is transmitted by the social media platforms within the scope of joint responsibility depends, among other things, on your privacy settings. We would also like to point out that when you use social media platforms, even if you are not logged in, data may be processed by the operator of the corresponding platform and may be transmitted to third parties. We have no influence on this. Further information is available at |
– https://www.linkedin.com/legal/privacy-policy – https://privacy.xing.com/de/datenschutzerklaerung |
| Storage duration |
| Your direct messages to us are stored within the technical capabilities of the tool used until the purpose of the processing no longer applies. We have no influence on the storage period of your other interactions, such as likes in particular. If you therefore wish this data to be deleted, we ask you to remove this interaction via your account. |
| Further processing of the data |
| The data processed for this purpose will not be processed by us for any other purpose. |
| Automated decision making |
| The data processed when you visit our website is not used for automated decision-making, nor do we carry out so-called “profiling”. |
4.4 Company profile |
| In order to increase our online presence and thus facilitate communication and interaction with visitors to our website and our social media presence, we operate a company profile on the social media platform LinkedIn, operated by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland and XING, operated by New Work SE, Dammtorstraße 30, 20354 Hamburg, Germany. |
| Data is processed jointly by us and LinkedIn Ireland Unlimited Company in accordance with Art. 26 GDPR for the purpose of improving marketing and statistical analysis by LinkedIn Corporation, regardless of whether you are a registered user of the platform or not. |
| Please note that, despite joint responsibility, we have no influence on the way in which the data is collected, made available and processed, that we only receive an evaluation in anonymized form and therefore cannot pass it on to third parties. |
| We receive the following information after statistical evaluation by LinkedIn: |
Followers: Information on location and country of access, career level, industry, company size, field of activity; People reached: People for whom our post was placed; Interacting persons: People who have marked our posts with “like”, commented, shared or made other interactions on our site. Information about followers: total number of followers, number of new followers; Information about visits: Information on how often each post was clicked on, information on which end device the followers use to access the profile, percentage comparison with accesses from the previous day. Information about posts: Online behavior of followers: average reach and interaction broken down by paid and organic reach. |
| As with LinkedIn, data is processed jointly by us and New Work SE in accordance with Art. 26 GDPR for the purpose of improving marketing and statistical evaluations of this by New Work SE, regardless of whether you are a registered user of the platform or not. |
| Please note that, despite our joint responsibility, we have no influence on the way in which the data is collected, made available and processed, we only receive an evaluation in anonymized form and therefore cannot pass it on to third parties. |
We receive the following information after statistical evaluation by XING: Followers: Information on location and country of access, career level, industry, company size, field of activity; People reached: People for whom our post has been placed in the last 28 days; Interacting persons: People who have marked our posts with “Like”, commented, shared or made other interactions on our site in the last 28 days; Total number of followers, number of new followers in the last 28 days; Information on how often each post was clicked on, information on which device the followers use to access the profile, percentage comparison with accesses from the previous day; Online behavior of followers: average reach and interaction broken down by paid and organic reach. |
4.5 Recruiting process and applicant management |
| We advertise vacant positions on behalf of our customers via our applicant portal, for which you can apply. Personal applicant data is processed as part of this recruitment process. |
| Scope of data processing |
| As part of the recruitment process, we process all personal data that you provide to us as part of your application. In addition, depending on the progress of the process, further data is generated that may be transmitted to our customer. This usually involves the following personal data: |
| Surname, first name, title, gender, language of correspondence and any correspondence, log-in data (username, password), log-in data, e-mail address, address and other contact details, citizenship, date of birth, language skills, photograph, if provided, education data, professional experience, CV, if applicable, information on personal and professional characteristics and skills, professional goals, salary expectations, desired employment including reference, desired start date, special professional requirements, application status, personal references, communication channel, other notes on the course and progress of the recruiting process. |
| We expressly request that you do not send us any information about your religious affiliation and/or military service when submitting your application. |
| Purpose of data processing |
| We advertise vacancies on behalf of the respective client who wishes to fill the corresponding position and carry out parts of the application process for them within the framework of joint responsibility in accordance with Art. 26 GDPR. The services to be provided by us include, for example, reviewing the application documents, conducting interviews and selecting the applicants that we propose to the respective client as suitable. For the applicants selected by us as suitable, we send the application documents, supplemented by a statement if necessary, to the respective client. We will inform you in advance to which company your application is to be sent so that you can object to this if necessary. The company will use the data for the further implementation of the application process. If we are unable to place you in a position, we will keep your application documents on file on the basis of your express consent so that we can contact you in the event of suitable positions. |
| Legal basis for data processing |
| This data is processed within the scope of our (pre-)contractual obligations pursuant to Art. 6 para. 1 lit. b GDPR and your and our legitimate interest in the rapid and efficient handling of the recruiting process pursuant to Art. 6 para. 1 lit. f GDPR. |
| If you have provided information on the communication channel, i.e. the channel through which you became aware of the vacancy, we process this information on the basis of our legitimate interest in optimizing our recruiting process in accordance with Art 6 para 1 lit f GDPR. |
| Failure to provide the required data may mean that we are unable to process your application. |
| Furthermore, we will keep your personal data on file for a period of two years on the basis of your express consent in accordance with Art. 6 (1) (a) GDPR and will contact you if there are vacancies corresponding to your profile. |
| Recipient of the data |
| We use the following service providers to operate our website, including the hosting of our applicant portal, and to ensure the security of our IT systems. In accordance with Art. 28 GDPR, the service providers are contractually obliged to protect personal data at all times, to take appropriate technical and organizational measures with regard to data security and under no circumstances to process data for their own purposes or to pass it on to third parties: |
– Hosting of the website / applicant portal Workforce Cloud Tech, Inc. United States of America (USA) |
| Furthermore, we transfer your personal data to our customer within the scope of our joint responsibility in accordance with Art. 26 GDPR, unless you withdraw your application after disclosing the identity of our customer. We would like to point out that there is no entitlement to the forwarding of personal data on the part of the applicant. |
| In addition, we reserve the right to forward the data collected for this purpose to the competent authorities and courts as well as our legal representation and insurance company and all other recipients specifically required in individual cases in the event of justified suspicion of abusive behavior. This is done on the basis of our legitimate interest in proper legal prosecution in accordance with Art. 6 para. 1 lit. f GDPR. |
| As part of the operation of our website or applicant portal, personal data is transferred to the USA. The data transfer to the USA is based on Art 45 Z 2 lit c GDPR. |
| Storage duration |
| We are obliged to retain the data processed as part of the recruitment process in accordance with Section 15 (1) GlBG and Section 26 (1) GlBG and Section 7k (1) in conjunction with (2) no. 1 BEinstG for a period of seven months after the end of the process, provided that the recruitment process does not result in employment by our client. If you are taken on as an employee, we will store your data, which we must retain due to tax law relevance, for 7 years after the end of the financial year in which the data was processed in accordance with Section 212 UGB. In addition, the data will be stored for as long as specific claims are asserted against us. If we have reasonable suspicion of abusive behavior and forward the data to the responsible public authorities, this data will be stored on a separate data carrier and deleted after the legal proceedings have ended. |
| If you have given us your consent to keep your data on record, we will store your data for 2 years from the date of your consent or until the date on which you withdraw your consent. You can withdraw your consent at any time without giving reasons. After successful revocation, we will stop processing your data for this purpose. If you have any questions about this, please contact us at privacy@clc- consulting.com. |
| Further processing of the data |
| The data processed for this purpose is further processed for the purpose of invoicing, customer support and – in the event of justified suspicion – as part of our IT security. Furthermore, the data may be processed for the purposes of advertising our products and services as part of our marketing activities. |
| Automated decision making |
| The data processed as part of the recruitment process is not processed for automated decision-making, nor do we carry out so-called “profiling”. |
5. Rights of data subjects |
| As a data subject of our data processing, you have the following rights: |
| Right to information |
| You have the right to request information at any time and informally about which of your personal data is processed by us as the controller – together with further information such as the purposes of processing and recipients, information about the origin of the data and information about automated decision-making including the logic involved. Furthermore, you have the right to request information as to whether the personal data concerning you is transferred to a third country or to an international organization, including the right to be informed of the appropriate safeguards pursuant to Art. 46 GDPR. |
| Right to rectification and right to restriction of processing |
| You can request the correction or completion of incorrect or incomplete data. You also have the right to request that the processing of data be restricted so that it may only be processed with your consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest, for example if the accuracy of the data is disputed. |
| Right to data portability |
| You may request that a copy of the data provided to us be sent to you – or, if technically feasible, to an identifiable third party – in a structured, commonly used and machine-readable format. |
| Right to erasure |
| You can request the deletion of your data under certain circumstances, for example if it is not processed in accordance with data protection regulations. |
| Right to object |
| You have the right to object, on grounds relating to your particular situation, at any time to processing of your personal data. In this case, we will no longer process the personal data concerning you unless we can demonstrate compelling legitimate grounds for the processing which override your interests, or the processing serves the establishment, exercise or defense of legal claims. |
| Right to withdraw your declaration of consent |
| If you have consented to the processing of your data, you have the right to revoke your declaration of consent at any time and without giving reasons, e.g. by sending an email to privacy@clc-consulting.com. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. We will delete your data unless statutory provisions require us to retain it. |
| Right to complain |
| If you believe that the processing of your data violates your right to confidentiality or that your data protection rights have been violated in any other way, you can lodge a complaint with the competent supervisory authority. In Austria, the competent authority is |
Austrian Data Protection Authority Barichgasse 40-42 1030 Vienna. |
This does not affect the possibility of bringing an action before the regional court in accordance with Section 29 (2) DSG and any other legal remedies, such as in particular the assertion of claims for damages in the event of unlawful processing. Before making a formal complaint or if you have any questions/concerns about the processing of your personal data, you are welcome to contact us at privacy@clc-consulting.com. |
6. Adaptation of the privacy policy |
| We reserve the right to amend this privacy policy at any time in compliance with the applicable data protection regulations. Users are requested to inform themselves regularly about the content of the privacy policy. |
| Status: June 2025 |
Personal selection
Wherever possible, we try to give you control over the external services and cookies used by us and/or our partners.
You can set and review your cookie preferences and view technical details here:
[borlabs-cookie type="“btn-cookie-preference“" title="" Cookie settings" und Details anzeigen"]