Recruitment Privacy Notice

Last updated: April 2026

1. Introduction and Data Controller

be one solutions AG, Bahnhofstrasse 11, 6300 Zug, Switzerland (“be one solutions”, “we”, “us”, or “our”) is the data controller for personal data processed as described in this notice.

This Recruitment Privacy Notice explains what personal data we collect about you when you apply for a role with us, how we use it, with whom we share it, how long we keep it, what rights you have, and how to exercise those rights. It applies globally, and we have included jurisdiction-specific supplements at the end where local law requires additional information.

Contact: For privacy matters, please contact us at HR@beonesolutions.com.

2. Personal Data We Collect

Depending on the role you apply for and the jurisdiction, we may collect the following categories of personal data:

Category	Examples
Identity & Contact	Name, address, email, phone number, date of birth (where legally required)
Application Data	CV / résumé, cover letter, qualifications, education, work history, skills, languages
Assessment Data	Interview notes, test results, competency assessments, reference feedback
Verification Data	Right-to-work documents, government-issued ID (only where legally required or permitted)
Background Check Data	Criminal record checks, credit checks, identity checks, educational checks, adverse financial history checks, adverse media checks, civil checks, directorship/business interest checks, employment checks, global sanctions checks, reference checks, and social media checks (only where role-appropriate and legally permitted)
Publicly Available Data	Professional profiles (e.g. LinkedIn) that you have made public
Communications	Correspondence with us during the recruitment process

ℹ  We only collect special-category (sensitive) data — such as health information or criminal records — where specifically required by applicable law or role requirements, and always with appropriate safeguards.

3. Legal Basis for Processing

We rely on one or more of the following legal bases depending on the purpose and jurisdiction:

• Contract / pre-contract: Pre-contractual steps – processing necessary to take steps at your request before entering an agreement.
• Legitimate interests: We have a legitimate interest in evaluating candidates, managing our recruitment process, and maintaining our talent pool, provided our interests are not overridden by your rights.
• Consent: Where required by law, we will ask for your consent before processing (e.g. retaining your data for future vacancies, or conducting certain background checks). You may withdraw consent at any time without affecting prior processing.
• Legal obligation: Processing necessary to comply with applicable laws, tax, immigration, or other legal obligations.
  
  

ℹ  Where we rely on legitimate interests, you may object to the processing. See Section 8 (Your Rights) for details.

4. How We Use Your Personal Data

We use your personal data for the following purposes:

• Evaluating your application and assessing your suitability for the role.
• Communicating with you about your application, interviews, and assessments.
• Conducting pre-engagement checks (background, right-to-work, references) where permitted by applicable law.
• Complying with legal and regulatory obligations.
• Maintaining records for audit, compliance, and dispute resolution purposes.
• If you start with us: transitioning your data into your personal record and onboarding you.
• With your consent: retaining your details in our talent pool for future suitable vacancies.
  
  

We will not use your data for automated decision-making that produces legal or similarly significant effects without human review, unless required or permitted by applicable law with appropriate safeguards.

5. Sharing Your Personal Data

We do not sell your personal data. We may share it with:

• Internal teams involved in the recruitment process (HR, hiring managers, relevant department heads).
• Group companies within the be one solutions group, where necessary for the recruitment process.
• Third-party service providers acting as data processors, including applicant tracking systems (ATS), assessment platforms, and background-check providers, under binding data processing agreements that restrict their use of your data.
• Professional advisers (lawyers, auditors) bound by duties of confidentiality.
• Regulatory bodies, law enforcement, or courts where required by applicable law.
• A prospective purchaser or successor entity in connection with a corporate transaction (merger, acquisition, or similar), subject to equivalent confidentiality obligations.

6. International Data Transfers

be one solutions operates globally. Your personal data may be transferred to and processed in countries other than your country of residence, including countries that may have different data protection standards.

Whenever we transfer personal data internationally, we implement appropriate safeguards, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission or equivalent mechanisms (e.g. the UK International Data Transfer Agreement / Addendum, Swiss SCCs).
• Adequacy decisions where the destination country has been recognised as providing adequate protection.
• Binding corporate rules or other legally recognised transfer mechanisms where applicable.
  
  

You may request a copy of the safeguards applicable to your transfer by contacting HR@beonesolutions.com.

7. Data Retention

We retain your personal data for as long as necessary for the purposes described in this notice or as required by applicable law.

Scenario	Retention Period
Unsuccessful applicant (no talent pool consent)	Generally 24 months from decision, subject to local law requirements (see jurisdiction supplements)
Unsuccessful applicant (talent pool consent given)	Up to 2 years from consent, or until you withdraw consent
Successful applicant	Data transferred to your personnel file; governed by our Privacy Notice and applicable laws
Background check results	As required by applicable law; typically not retained beyond the recruitment process unless legally required

We regularly review and delete personal data that is no longer required. We apply enhanced protection and shorter retention periods to special-category data.

8. Your Rights

Depending on your country of residence, you may have some or all of the following rights:

Right	What it means
Access	Request a copy of the personal data we hold about you.
Rectification	Ask us to correct inaccurate or incomplete data.
Erasure	Ask us to delete your data (subject to legal retention obligations).
Restriction	Ask us to restrict processing in certain circumstances.
Objection	Object to processing based on legitimate interests or direct marketing.
Data portability	Receive your data in a structured, machine-readable format (where processing is based on consent or contract).
Withdraw consent	Withdraw consent at any time where processing is based on consent, without affecting prior processing.
Non-discrimination	We will not discriminate against you for exercising any privacy rights (applicable in certain US states and other jurisdictions).

To exercise any of these rights, please contact us at HR@beonesolutions.com. We will respond within the timeframe required by applicable law (generally within 30 days, with a possible extension of up to 2 additional months for complex requests). We may need to verify your identity before acting on your request.

9. Complaints and Supervisory Authorities

If you have concerns about our processing of your personal data, please contact us first at HR@beonesolutions.com. We will do our best to resolve your concern.

You also have the right to lodge a complaint with your local data protection supervisory authority. Some key authorities include:

• Switzerland: Federal Data Protection and Information Commissioner (FDPIC) – www.edoeb.admin.ch
• European Union: Your national data protection authority (e.g. CNIL in France, BfDI in Germany, AEPD in Spain).
• United Kingdom: Information Commissioner’s Office (ICO) – www.ico.org.uk
• Other jurisdictions: Please refer to the relevant supplement below or contact us for assistance.

10. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage. These measures include access controls, encryption in transit and at rest, regular security assessments, and staff training.

No transmission of data over the internet is completely secure. If you suspect any misuse, loss, or unauthorised access to your personal data, please notify us immediately at HR@beonesolutions.com.

11. Automated Decision-Making and Profiling

We do not make solely automated decisions that produce legal or similarly significant effects about you in the recruitment process. Where automated screening tools (e.g. ATS keyword matching) are used, a human reviewer will assess the outcome before any material decision is made.

12. Online Applications and Cookies

If you apply through our online recruitment portal, technical data (such as IP address and browser type) may be collected automatically. Our online recruitment platform is subject to its own privacy and cookie policy, which will be presented to you when you access it.

13. Changes to this Notice

We may update this notice from time to time to reflect changes in our practices or legal requirements. The current version will always be available on our website and through our recruitment portal. Where changes are material, we will take steps to inform you directly.

14. Jurisdiction-Specific Supplements

The following supplements apply in addition to the general notice above. In case of conflict, the supplement for your jurisdiction prevails.

European Economic Area (GDPR)

The data controller for EEA applicants is be one solutions AG, which processes data under the Swiss Federal Act on Data Protection (nFADP) and, where applicable, the EU General Data Protection Regulation (GDPR). The legal bases described in Section 3 correspond to Article 6 GDPR (and Article 9 GDPR for special-category data). You have the right to lodge a complaint with your national supervisory authority.

United Kingdom (UK GDPR / DPA 2018)

For UK applicants, processing is governed by the UK GDPR and the Data Protection Act 2018. Your supervisory authority is the Information Commissioner’s Office (ICO). International transfers from the UK are covered by UK International Data Transfer Agreements (IDTAs) or equivalent mechanisms.

Switzerland (nFADP)

Processing of personal data relating to Swiss applicants is governed by the Swiss Federal Act on Data Protection (nFADP, effective 1 September 2023). The competent supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC).

United States

The following additional disclosures apply to US applicants:

• We do not sell or share your personal information for cross-context behavioural advertising.
• California residents have rights under the California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA): the right to know, delete, correct, and opt-out of sale/sharing. Submit requests to HR@beonesolutions.com or call our toll-free number (to be provided upon request).
• We will not discriminate against you for exercising CCPA/CPRA rights.
• Applicants in other US states with comprehensive privacy laws (e.g. Virginia, Colorado, Connecticut, Texas) have equivalent rights under those laws. Contact us to exercise them.
• Background checks conducted in the US comply with the Fair Credit Reporting Act (FCRA) and applicable state law. You will receive a separate FCRA disclosure and authorisation form before any consumer report is obtained.
• We do not ask for, nor will we use, an applicant’s social media passwords.

Asia-Pacific (Selected Jurisdictions)

Australia: Processing complies with the Privacy Act 1988 (Cth) and Australian Privacy Principles (APPs). You may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

Japan: Processing complies with the Act on Protection of Personal Information (APPI). We provide required third-party provision notices where applicable.

South Korea: Processing complies with the Personal Information Protection Act (PIPA). The Personal Information Protection Commission (PIPC) is the competent supervisory authority.

Singapore: Processing complies with the Personal Data Protection Act 2012 (PDPA). The Personal Data Protection Commission (PDPC) is the competent authority.

China: Processing complies with the Personal Information Protection Law (PIPL). Cross-border data transfers are conducted in accordance with applicable PIPL requirements, including required security assessments and standard contracts where applicable.

Philippines: Processing complies with the Data Privacy Act of 2012 (DPA). The National Privacy Commission (NPC) is the competent authority.

Latin America (Selected Jurisdictions)

Brazil: Processing complies with the Lei Geral de Proteção de Dados (LGPD). The Autoridade Nacional de Proteção de Dados (ANPD) is the competent supervisory authority.

Mexico: Processing complies with the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP). You have ARCO rights (access, rectification, cancellation, and opposition).

Vietnam

Processing complies with the Law on Cybersecurity 2018 and Decree 13/2023/ND-CP on Personal Data Protection. We obtain consent prior to processing personal data where required.

Questions about this notice?  Contact us at HR@beonesolutions.com