Privacy notice for applicants

This privacy notice for applicants ("Privacy notice") applies to the B&R Group, i.e. B&R Industrial Automation GmbH and any company in which B&R Industrial Automation GmbH, directly or indirectly, holds a majority interest or owns or controls the majority of voting rights. B&R Industrial Automation GmbH is in turn part of the ABB Group (a 100% subsidiary of ABB Asea Brown Boveri Ltd.). The B&R company offering the job for which you are applying (hereinafter referred to as "B&R") is responsible for processing your personal data and monitors data processing in accordance with this privacy notice.

At B&R, compliance with your data protection rights has the highest priority. This privacy notice explains why and how we collect and process your personal data and what your rights are with regard to this data.

B&R Industrial Automation GmbH and all B&R subsidiaries are responsible for processing your personal data. In accordance with applicable data protection laws, the B&R subsidiary offering the job for which you are applying is responsible for processing your personal data (hereinafter referred to as "application"). Furthermore, other B&R subsidiaries may receive and process your data, either as the data controller or the data processor. Accordingly, this privacy notice applies equally to them.

In your case, B&R Industrial Automation GmbH, B&R Strasse 1, 5142 Eggelsberg, Austria or the respective company affiliated with B&R according to section 15 ff. of the Stock Corporation Act with which you are in an employment relationship will decide, as the "data controller" within the meaning of the General Data Protection Regulation ("GDPR") and the Austrian Data Protection Act or other applicable national data protection laws at the headquarters of the respective subsidiary, for what and how your personal data will be used in accordance with this privacy notice (hereinafter also referred to as "B&R", "we" or "us").

We collect and use personal data within the scope of or in connection with your application to B&R. In addition, we process personal data that we can obtain from publicly available sources, such as career portals, job-related social networks and career fairs or that is lawfully transmitted by other third parties, such as recruitment agencies, through which you applied for a job at B&R to the extent required for the purposes stated in this privacy notice. We process the following categories of your personal data to the extent required for the purposes of processing in accordance with this privacy notice:

• Personal details and identification data, e.g. name, gender, age, nationality, date and country of birth, marital status, private and business address, private and business telephone number, private and business email address or other contact details that you wish to provide in connection with your application.
• Personal details about skills and experience, such as qualifications and certificates, including current and past employment, education and training, CV, documents and records of education and work results, (in some cases) contact details of references, results from aptitude tests, interviews and feedback and any other personal data you provide in connection with your application.
• Depending on the position, we carry out internal or external assessments in which we collect additional data, such as assessment performance data, assessment scores as well as recordings and notes from telephone or video interviews.
• Job-related personal data of successful applicants, which are only required for concluding the employment contract and the recruitment process, such as photographs, signature, passport information, residence, nationality, work and residence permit, immigration status and visa data, employee number, employment status, applicable personal identification numbers (tax, national insurance, other insurances, driving license, etc.), insurance details, bank account details, data of relatives (name of spouse/partner, children, etc.), emergency contacts, training documents, clothing and shoe size, if required.
• Other personal data (which may include special categories of personal data), especially if such personal data is entered into our application systems by you or others. This includes personal data (e.g. inquiries, questions, complaints, emails, contracts, presentations, work products), photos, images and/or videos.

Any of your personal data that falls into the categories listed below is collected and processed exclusively during the recruitment process and in accordance with applicable national laws. We process such personal data only if required by local law or if it is required to ensure the legal requirements for equal opportunities and equal treatment of all candidates and employees. This means that such personal data will not be processed if processing is prohibited by applicable national law.

Special categories of personal data, for example:

• Membership in religious communities (if required for tax purposes, for example)
• Health and medical data including disability status, special working conditions (e.g. use of a standing desk), medical equipment needed at the workplace, work-related illnesses and injuries, data needed for assistance in travel emergencies (blood group, medical records, allergies)
• Racial or ethnic origin (e.g. when required for diversity purposes)
• Union membership (in some cases)
• If we conduct a background check on you as part of the recruitment process, we will only process this data in accordance with applicable law. Data on criminal convictions and offenses, such as information about previous convictions and sanction lists, are only processed to the extent that is required for a criminal background check according to money laundering laws or other legal obligations.

If you wish to obtain information about a specific data processing activity, this can be requested from www.abb.com/privacy.

We process your personal data primarily for our recruitment processes in connection with the job for which you are applying now and for which you might apply in the future. As part of the recruitment process, we need to process your personal data in order to decide whether you are the right candidate for the position, to possibly enter an employment relationship with you, to meet contractual and legal obligations in connection with recruitment or to fulfill our legal obligation to collect and process your personal data (mainly on the basis of employment law).

Without processing certain personal data, B&R will not be able to process your application, establish and maintain an employment relationship with you or take contractual or legal actions at your request. When it comes to processing your personal data in connection with your application, B&R will not be able to process your application upon your request without certain personal data and you will not be able to exercise your associated rights if you do not provide the data requested. Your application may also be rejected if the personal data you provided during the recruitment process is incomplete and/or incorrect.

In particular, we process the personal data listed above for the following purposes:

• Talent management and acquisition, including recruitment, assessment of suitability and work ability, background checks and verification of qualifications, procurement and provision of references
• Work procedures and processes related to starting and ending a work relationship, including internal transfers or terminations
• Fulfillment of obligations and exercise of specific rights in the field of employment and social security law or a collective agreement
• Internal health and safety programs, including occupational health and safety and accident records or reports and process quality management
• Personnel management, including organization and personnel administration, work time management, improvement and maintenance of effective personnel administration, internal personnel analysis, reporting and planning
• Management of IT resources, including infrastructure management, such as data protection, data systems support and application management service activities, end user support, testing, maintenance, security (response to security incidents, risks, vulnerabilities, data breaches), master data and areas of activity including user account management, software licensing, security and performance testing and business continuity

In addition, we process personal data when an employment contract is concluded or in case of claims resulting from the recruitment process:

• Payroll, compensation and performance management, including the provision of social services and the maintenance of salary, compensation, allowances, benefits, insurances, pensions and appraisals
• Management of development and further education measures including certifications, employee training and conducting surveys and studies on employee satisfaction
• Sick leave or other leave of absence and holiday administration
• Travel and expense management and organization of business trips, including monitoring of travelers for assistance in case of safety or medical emergencies, provision of training courses related to travel safety, health and safety and, on a voluntary basis, assistance with security support in emergencies
• Internal and external communication of the B&R organization and representation of B&R, including entries in the commercial register and assignment of powers of attorney
• Managing B&R assets, including images and videos that represent employees and other people and can be downloaded via B&R's intranet, B&R's website, etc.
• Reorganization, purchase or sale of activities, business units and companies.
• Annual reports, statistics and analyses
• Monitoring and verifying compliance with ABB and B&R corporate guidelines, contractual obligations and legal requirements through employee activities in the workplace, including disciplinary measures
• Management, risk and compliance, including compliance with laws, rules of law enforcement agencies, courts and regulatory authorities (e.g. the process of verifying customer identities ("KYC"), measures to prevent money laundering ("AML"), compliance with customs duties and international trade rules, rules for conflicts of interest and security obligations) as well as prevention and detection
• Investigation and prevention of crimes and fraud or other prohibited actions, or for the protection, establishment, exercise or defense of legal rights and claims
• Video surveillance or CCTV for the purposes of public and personal security, building security and crime prevention and detection
• Access control systems with electronic entry and/or exit control for authorized persons in restricted areas and local attendance list for emergencies
• Intrusion detection systems including third-party monitoring of coercion, property, internal security, supporting surveillance monitors for site monitoring/automated systems

We only collect the personal data required for the above purposes. The use of your personal data that you provide in connection with your application is limited to the extent necessary to process your application and will only be disclosed to employees and third parties directly involved in the recruitment process for the respective position. Whenever you are asked to provide your personal data, we will indicate which personal data is mandatory or voluntary for the application and on what legal basis it will be processed.

For certain assessments or decision-making processes, we may use automated methods to create a profile of you based on your personal data that we have received as described in this privacy notice. In this case, we will inform you about the processing procedure of your personal data and inform you about the logic involved and the possible consequences of such automated decision-making and processing procedures. In general, the logic for automated decision-making is based on the minimum requirements of the job description and the conformity of your suitability, qualification and experience with these requirements. A possible consequence of this automated decision-making process is that your application may be rejected if your profile does not meet these requirements. If we use automated methods, you can claim your right to intervention by a person from B&R to present your own point of view and the right to challenge the decision by sending a request to www.abb.com/privacy. You also have the right to object to the generation of profiles by submitting an appropriate objection to www.abb.com/privacy or withdrawing any consent you may have given to such processing.

We may also collect your personal data anonymously so that you cannot be identified directly or indirectly by this data, and subsequently use this data for further processing purposes, including statistical purposes, improving our services and reviewing our IT systems.

We process your personal data for the purposes described above (in Question 3) in accordance with the provisions of the GDPR and the Austrian Data Protection Act, especially in accordance with the following applicable legal bases:

• We process your personal data primarily for the purpose of establishing, maintaining or terminating an employment relationship with you as well as enforcing rights and fulfilling obligations arising from your employment contract on the legal basis of Art. 6 (1) b) of the GDPR.
• If we process your personal data (including special categories of personal data) for the purpose of exercising rights or fulfilling legal obligations under employment, social security and social protection law, the legal basis for this data processing is Art. 6 (1) c) and 9 (2) b), f) and h) of the GDPR.
• If we process your personal data (including special categories of personal data) for the purpose of health care, occupational medicine or the assessment of your work ability and if your data is processed by health care professionals or other persons subject to professional secrecy, the legal basis is Art. 9 (2) h) of the GDPR.
• In cases where we process your personal data on the basis of other legal provisions and obligations, for example, with regard to allowances and tax, reporting or notification obligations, cooperation obligations with authorities or legal retention periods to fulfill other contractual and legal obligations as an employer and company, the legal basis for this processing is Art. 6 (1) c) of the GDPR.
• Where required, we process your personal data within the scope of our employment relationship with you in order to safeguard our legitimate interests or those of third parties. This is done in the context of balancing interests in accordance with Art. 6 (1) f) of the GDPR, according to which processing is permissible if it is necessary to safeguard legitimate interests and if the interests or basic rights and freedoms of the data subject, which require the protection of personal data, do not prevail. Such legitimate interests may include the following processing purposes:
• Monitoring (e.g. by IT systems), checking and ensuring compliance with legal and regulatory standards and ABB's and B&R's internal specifications and guidelines
• Prevention of fraud and criminal activity, including verification of such activity, misuse of B&R's assets, products and services and where strictly necessary and appropriate to ensure network and data security
• Establishment, exercise and defense of legal claims by and against B&R in connection with your work tasks and obligations at B&R
• Transfer of personal data within the B&R Group for internal administrative purposes, wherever necessary, for example, to provide decentralized services

To obtain a copy of our assessment of our legitimate interest in processing your personal data, including documented balancing of interests, please send a request to www.abb.com/privacy.

In exceptional cases and insofar as we process your personal data (including special categories of personal data) for purposes that are not covered by the aforementioned legal bases, we require your consent in accordance with Art. 6 (1) a) and 9 (2) a) of the GDPR as the legal basis for processing your personal data, for example if we want to store and process your personal data for other or future jobs and applications, surveys in connection with the application process or job newsletters on future jobs. If we send you this information via email, we may require further consent under applicable law in accordance with Art. 107 (2) of the Austrian Telecommunication Act. Your consent is always given on a voluntary basis, i.e. you are not obliged to provide your personal data and need not fear any disadvantages if you refuse to give your consent. You can also withdraw your consent at any time with future effect in accordance with Art. 7 (3) of the GDPR without giving reasons. If we ask for your consent to the purpose-related use of your personal data, we will inform you of your right to object and about the possibility to exercise your right to object.

We will only process personal data related to criminal convictions or offenses in accordance with (national) applicable law.

We will only share your personal data with employees and third parties directly involved in the recruitment process, in particular in the country in which you have applied for the job or in countries directly involved in the respective recruitment process. As part of a global corporation, we have business relationships with companies in the B&R Group and external service providers, both within and outside the European Economic Area (EEA), which we may also use to process your personal data. We will generally only share your personal data with other B&R companies or third parties if this is necessary for the purposes listed in the table below.

In this regard, your personal data may also be made available to companies of the B&R Group in countries within and outside of the EEA for the aforementioned processing purposes. In addition, when processing your personal data for the aforementioned purposes, we may use external service providers as data processors (e.g. computer centers, software companies and marketing automation providers). They are generally used with binding instructions within the framework of an existing contractual relationship and receive your personal data only to the extent and for the period of time required to provide the service.

If we share your personal data with a B&R company or third party and it is transferred or becomes accessible outside the European Union ("EU") and the European Economic Area ("EEA") or outside the country of your employer, we will protect your personal data with appropriate safeguards. Examples of such safeguards include decisions on adequacy of protection by the European Commission or Standard Contractual Clauses. We have taken additional measures to protect your personal data when it is transferred outside the EU, EEA or country of the employer. If you would like an overview of the safeguards applied, please send a request to www.abb.com/privacy.

We generally process and store your personal data only as long as is necessary for the processing purposes stated in this notice, until you withdraw your consent granted under Art. 6 (1) a) of the GDPR or until you object to the use of your personal data if a legitimate interest is the legal basis for processing (Art. 6 (1) f) of the GDPR).

However, legal provisions require B&R to store certain personal data for minimum retention periods. This concerns, for example, employment contracts, information about remuneration and reimbursement of costs, for which minimum retention periods apply on the basis of company and tax law regulations. In addition, national anti-discrimination laws such as the Austrian Federal Equal Treatment Act, which gives you specific rights in connection with the recruitment process, require that we store your personal data for the period during which you can make claims on the basis of anti-discrimination laws.

At the same time, the applicable data protection laws require that we store and process your personal data in a form that identifies you for no longer than is necessary for the purpose for which the personal data was collected and that we carry out regular checks in this regard.

Although there may be limited exceptions due to national legal provisions (e.g. tax or commercial law), your personal data will generally be processed for the following retention periods:

• If your application has been rejected, the recruitment process ends with the rejection notification and your personal data will be stored and processed for another 6 months, for example in Austria, unless you have given us your consent to consider you for future jobs and to store and process your personal data for these purposes.
• If your application has been successful, the recruitment process ends with the conclusion of your employment contract and we will continue to process your personal data for the duration of this contract and/or the retention periods specified in the privacy notice applicable to you and your employment contract.
• If you have given us your consent to consider you for further job offers and to store and process your personal data for these purposes, we will store and process your personal data for a maximum retention period of 24 months.

After the applicable retention period has expired, we will delete your personal data or make it anonymous, unless there are special circumstances that require us to retain your personal data, such as legal or regulatory requirements or legal disputes in connection with your employment. Through settings in IT systems and guidelines, we ensure that your personal data is deleted as soon as it is no longer needed.

For further information about the retention periods applicable to your personal data, please send a request to www.abb.com/privacy.

If you have questions about data protection, complaints about how we are handling your personal data or wish to exercise the rights of data subjects listed below, you can contact us at www.abb.com/privacy. Under certain circumstances, we may have to restrict these rights of data subjects in order to safeguard the public interest (e.g. the prevention or detection of criminal offenses) or our business interests (e.g. maintaining legal privilege). Should you not be satisfied with our response or believe we are processing your personal data unlawfully, you may also contact the Data Protection Authority in your country of residence or work or in which you believe the data breach may have taken place in accordance with your right to lodge a complaint per Art. 77 of the GDPR. In addition to your right to lodge a complaint, you also have the following rights:

• Right to information: In accordance with Art. 15 of the GDPR, you have the right to receive information from us regarding your personal data that we process at any time upon request (in text form). This right is limited by the exceptions of Art. 4 (6) of the Austrian Data Protection Act, according to which the right of information is not applicable in particular if the provision of this information would endanger a business or trade secret of the data controller or of a third party.
• Right to rectification: In accordance with Art. 16 of the GDPR, you have the right to request that we rectify your personal data without delay if it is incorrect. This right is subject to the restrictions set out in Art. 4 (2) of the Austrian Data Protection Act, according to which, in the event that the correction of personal data processed with the aid of automation cannot be carried out immediately because it is only possible at certain times for economic or technical reasons, the processing of the personal data in question must be restricted with the effect of Art. 18 (2) of the GDPR until this point in time.
• Right to erasure: You have the right to request us to delete your personal data under the conditions set out in Art. 17 of the GDPR. These conditions are particularly met if a) the respective processing purpose has been achieved or otherwise ceases to apply, b) we have processed your data unlawfully, c) you have withdrawn your consent without the data processing being able to be continued on another legal basis, d) you successfully object to the data processing or e) in cases where there is an obligation to delete the data on the basis of EU law or the law of an EU member state to which we are subject. This right is subject to the restrictions set out in Art. 4 (2) of the Austrian Data Protection Act, according to which, in the event that the deletion of personal data processed with the aid of automation cannot be carried out immediately because it is only possible at certain times for economic or technical reasons, the processing of the personal data in question must be restricted with the effect of Art. 18 (2) of the GDPR until this point in time.
• Right to restrict processing: In accordance with Art. 18 of the GDPR, you can request that we only process your personal data to a limited extent. This right exists in particular under the conditions that a) the accuracy of the personal data is disputed, b) you request limited processing instead of deletion under the conditions of a justified request for deletion, c) the data is no longer necessary for the purposes we pursue, but you need the data to assert, exercise or defend legal claims, or d) the success of an objection is still disputed.
• Right to data portability: In accordance with Art. 20 of the GDPR, you have the right to receive your personal data that you provided us in a structured, common, machine-readable format, as well as the right to have us transfer this data to another data controller.
• Right to object: In accordance with Art. 21 of the GDPR, you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data, either in the public interest or to safeguard our legitimate interests. Thereafter, we will stop processing your personal data unless we can prove compelling reasons for processing your personal data that are worthy of protection, which outweigh your interests, rights and freedoms or unless such processing serves to assert, exercise or defend legal claims. If you object to the processing of your personal data for marketing purposes, we will stop processing your data in any case.

This Privacy Notice may be updated from time to time as a result of required developments. In case of such updates, we will undertake necessary actions to inform you about them depending on the importance of changes done. If and where required by applicable laws we will also ask for your consent to any material Privacy Notice changes describing our up-to-date practices. Please check the "date of publication" to see when this Privacy Notice was updated.

Date of publication: February 15, 2021