We take data protection very seriously here at INNIO. That is why we make sure that our staff are informed in a clear and transparent way about the processing of their personal data in the context of the INNIO Mobility Tool (IMT). The processing of personal data is subject to the provisions of the EU General Data Protection Regulation (GDPR). You will see detailed information below concerning the processing of your personal data.
Personal data is any information relating to an identified or identifiable natural person. This includes for example information such as your name, age, address, telephone number, date of birth, e-mail address, IP address or user behavior. Information that we cannot use to establish any reference to you (or if we could do so only with inordinate work) e.g. by making information anonymous, does not constitute personal data. Processing (data processing) as defined by the GDPR is any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means (e.g. collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction). The processing of personal data must always have a legal basis or your consent.
The provision, function, and use of the INNIO Mobility Tool (IMT) requires your personal data to be processed because it is only in this way that you can be identified in the system to assure immigration, tax, and social security compliance as well as safety at work. Therefore, without processing the required personal data we would not be able to provide with the correct assessment with regards to your STBT.
As a matter of principle, we collect and use your personal data only insofar as this is necessary for the provision, function, and use of the INNIO Mobility Tool (IMT). We require the following personal data to register you in the INNIO Mobility Tool (IMT):
Furthermore, information relating to you may be collected and used in the context of compliance with Immigration, tax, and social security as well as safety at work. You may be requested to provide information with regards to your salary, ethnicity, religious beliefs, family members, health status, immigration status, among another personal information.
In addition, there is an automated data exchange between the data management application Workday, and the INNIO Mobility Tool (IMT), in which the following personal data is transferred from Workday to the INNIO Mobility Tool (IMT) in miscellaneous fields of the user profile: full name, date of birth, place of birth (state), citizenship(s), gender, and city of residence (state and province). Certain records will be transferred into several fields of the user’s profile.
The processing of your personal data for provision and in the context of use of the INNIO MobilityTool (IMT) is based on the declaration of consent provided by you voluntarily in accordance with Art. 6 (1) let. A. The processing of personal data of special categories is based on Article 9 Par 2 let. A of the GDPR. The legal basis for a possible data transfer to third countries, for which there is neither an adequacy decision according to Art. 45 Para. 3 nor suitable guarantees according to Art. 46 GDPR, is Art. 49 Para. 1 let A of GDPR. Please see below the template for consent that we require in order to carry out the processing of your personal data described in the paragraph I.
I hereby confirm my participation in the INNIO Mobility Tool (IMT), and I consent to the associated processing of my personal and special data (as required personal data of special categories, such as religious affiliation or health status) described in detail in the Data Protection Information Sheet that has been provided to me for this purpose. I am aware and agree that my personal data can be transmitted to recipients outside the European Economic Area, which cannot guarantee a level of data protection comparable to the GDPR. In this case,the transmission takes place in accordance with Article 49 (1) (a) GDPR. I have read and noted the Information Sheet. Furthermore, I may revoke my consent at any time with effect for the future and thereby terminate participation in the INNIO Mobility Tool (IMT). Revocation is possible by an informal e-mail to the relevant Human Resources department.
As soon as you terminate participation in the INNIO Mobility Tool (IMT) by revocation or amend your data, the relevant personal data will be erased from the INNIO Mobility Tool (IMT). Further storage may take place in an individual case if this is prescribed by law.
We work with our contract processors: Tracker Software Technologies (Ireland) Ltd (“GlobalTracker”), Global Tax Network Great Lakes, LLC d/b/a GTN Great Lakes (“GTN”) and Fragomen Global LLP (“Fragomen”) for the provision and function of the INNIO Mobility Tool(IMT). As the contract data processors, GlobalTracker, GTN and Fragomen are required to comply with instructions from INNIO and they may not process your personal data in any way other than in accordance with these instructions, and they may only do so in the context of the immigration, tax, legal and social security compliance.
GlobalTracker has a server location in Ireland, Germany, and the UK. The company can guarantee a suitable level of data protection under the GDPR.
The transmission to recipients outside the EEA takes place based on a so-called adequacy decision by the EU Commission in accordance with Art. 45 GDPR or on the basis of the standard contractual clauses of the European Union (EU Standard Contractual Clauses) in accordance with Art. 46 GDPR, in order to ensure an appropriate level of data protection in the processing of your personal data.
Notwithstanding the above-mentioned, when your personal data is transferred to a recipient in a country outside the EEA based on the EU Standard Contractual Clauses, the processing may not be adequately protected due to the specific national laws applicable to the recipient in that country. This applies, in particular, to the transmission of your personal data to recipients in the USA. In case of transmission to the USA, it may in fact be the case that no suitable guarantees for an appropriate level of data protection can be given (e.g. through the EU Standard Contractual Clauses). This is because the US authorities are entitled, under the applicable US law, to access and use personal data of the data subjects concerned, whose data is transferred from the EU to the US and who are not US citizens, without having any specific reason for them to do, and without being able to object to an unlawful access. The requirements for the protection of personal data during processing in the USA are, therefore, not regulated in such a way that they are equivalent to those of the EU law. This particularly applies to the principle of proportionality, as US-law based surveillance programs in the US are not limited to the strictly necessary.
As the data subject you have certain rights under the GDPR. In connection with the processing of your personal data in the context of the INNIO Mobility Tool (IMT) you are a data subject within the definition by the GDPR as an employee of INNIO.
Consequently, you may assert the following rights:
In accordance with Art. 15 GDPR you may demand information about your personal data that is processed by us. In particular, you may request information about the purposes of processing, the categories of personal data, categories of recipients to whom data is or has been disclosed, the planned period of storage, the existence of a right to correction, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the origin of your data insofar as it is not collected by us, a transfer to third countries or to an international organization as well as the existence of automatic decision-making including profiling and, if applicable, conclusive detailed information.
In accordance with Art. 16 GDPR you may demand immediate correction of incorrect personal data or completion of your personal data stored by us.
In accordance with Art. 17 GDPR you may demand erasure of personal data stored by us insofar as processing is not required to exercise the right to freedom of expression and information, fulfillment of a legal obligation, for reasons of public interest or assertion, exercise, or defense of legal claims.
In accordance with Art. 18 GDPR you may demand restriction of the processing of your personal data insofar as you dispute the correctness of the data, the processing is unlawful, we no longer require the data, and you refuse to allow it to be erased because you require it for assertion, exercise or defense of legal claims.
In accordance with Art. 20 GDPR you may demand to receive your personal data that you have provided to us in a structured, commonly used, and machine-readable format or have it transferred to another controller.
In accordance with Art. 7 (3) GDPR you may revoke the consent you previously granted to us at any time. This means that we can no longer continue in the future with the data processing that was based on this consent.
In accordance with Art. 77 GDPR you have the right to lodge a complaint with a regulatory authority. However, before you do this you are welcome to first contact your HR Manager internally with the complaint or the data protection officer named at the end of the document. If you nevertheless wish to contact the authority, you can normally invoke the regulatory authority that has jurisdiction for your usual place of residence, your place of work or our corporate headquarters.
If you have any further questions concerning the processing of your personal data, please contact Péter Holló or your HR Manager.