Privacy policy for employees and applicants Aquila AG

1. General

This Privacy Policy provides information about how Aquila AG ("Aquila") obtains and processes personal data of employees and applicants.

“Personal data" means all information relating to an identified or identifiable natural person. “Processing" means any handling of personal data, irrespective of the means and procedures applied, in particular the collection, storage, retention, use, revision, disclosure, archiving, deletion or destruction of personal data.

2. Controller and contact

Aquila AG, Bahnhofstrasse 43, 8001 Zurich, is responsible for the data processing described here. For data protection concerns, please use the following contact address

Aquila AG
PO Box,
8022 Zurich or telephone +41 58 680 60 00.

3. Collection and processing of personal data

Aquila primarily obtains and processes personal data provided to Aquila by the data subject, e.g. when applying for a job with the application documents or during the job interview or in the context of the employment relationship. If personal data of other persons (e.g. family members, current or former employer, references) is provided in this context, the data subject must ensure that these persons are aware of this Privacy Policy. Their personal data shall only be disclosed to Aquila if the data subject is authorised to do so and if such personal data is accurate. Aquila may, to the extent permitted, obtain personal data from publicly accessible sources (e.g. the internet, social media or public registers), from public authorities (e.g. debt collection office, commercial register) or from other third parties (e.g. persons designated by the data subject such as references, former employers).

4. Categories of personal data

Aquila processes different categories of personal data. The most important categories are the following:

Master and inventory data (e.g. name, address, gender, nationality, date of birth, marital status, children, religious affiliation)
Information on education and career (e.g. degrees, references, information on employers, fields of activity, functions)
References (details of persons who may be contacted in the application process)
Information on criminal and/or debt collection proceedings (e.g. extract from the criminal or debt collection register)
Technical data (e.g. IP addresses, internal and external identifiers, access records)
Financial data (e.g. creditworthiness data, information on accounts and deposits for wage payments or compliance with market conduct rules)
Other information (e.g. from performance appraisals, internal training and further education)

5. Purposes of the processing

Aquila always processes personal data for a specific purpose. When processing personal data of applicants and employees, Aquila processes personal data, where permitted and appropriate, for the following purposes:

Recruitment, conclusion and fulfilment of employment contracts (e.g. application process, conclusion of employment contract and existing employment relationship as well as termination)
Personnel administration (e.g. keeping personnel files, wage payments, payroll accounting, handling of insurance matters)
Staff development (e.g. performance appraisal and evaluation, training management, career development)
Communication (e.g. contact during application process, personal and business communication and information)
Security and access (e.g. access control, employee monitoring for ensuring IT and other infrastructure)
Fulfilment of legal or regulatory obligations to provide information or to report to authorities, fulfilment of official orders (e.g. notification obligations and authorisation obligations under supervisory law, labour law or immigration law).
Prevention and investigation of criminal offences or other misconduct (e.g. through internal investigations).
Safeguarding the interests and securing the claims of Aquila, e.g. in the event of claims against Aquila or claims of Aquila against third parties.
Preparation and execution of corporate transactions (e.g. acquisition or sale of companies or parts of companies or other transactions under company law).

6. Data security

Aquila is committed to protecting personal data and privacy in accordance with applicable laws. To this end, Aquila takes appropriate technical and organisational security measures (e.g. access restrictions, firewalls, personalised passwords as well as encryption and authentication technologies, training of employees, etc.).

7. Disclosure to third parties and data transfer abroad

Aquila discloses personal data to the following third parties (recipients) in the following cases:

For outsourcing in accordance with section 8 and for the purpose of applicant and personnel administration to other service providers (e.g. insurance brokers).
Reference providers (e.g. former employers).
Due to legal obligations, legal justification or official orders, e.g. to courts, supervisory authorities, tax authorities or other third parties.
To the extent necessary to protect Aquila's legitimate interests, e.g. in the event of legal action threatened or initiated against Aquila, in the event of public statements, to secure Aquila's claims against applicants or employees, in the event of collection of Aquila's claims, etc.
Parties to a potential or actual corporate transaction.
With the consent of the data subject to other third parties.

Recipients of personal data are usually located in Switzerland. Certain third parties who support Aquila in the data processing referred to in section 5 are located outside Switzerland. The data subject must expect that personal data may also be disclosed to third parties outside Switzerland (e.g. Europe or the USA).

Where a recipient is located in a country without an adequate level of data protection, Aquila shall contractually oblige the recipient to comply with the applicable level of data protection (e.g. with standard contractual clauses), unless the recipient is already subject to a legally recognised set of rules to ensure data protection or Aquila can rely on an exemption provision.

8. Outsourcing of business areas or services (outsourcing)

Aquila outsources certain business areas and services in whole or in part to third parties (such as payroll and payroll accounting, recruitment, IT systems, etc.).

The service providers who process personal data on behalf of Aquila for this purpose (so- called processors) are carefully selected. Whenever possible, Aquila uses processors domiciled in Switzerland. The processors may be entitled to have certain services (e.g. electronic data processing) provided by third parties.

Processors may only process personal data received in the same way as Aquila itself and are contractually obliged to ensure the confidentiality and security of the data.

Outsourcing by Aquila shall, where applicable, be carried out in accordance with the Out- sourcing Circular of the Swiss Financial Market Supervisory Authority (FINMA), in its currently valid version.

9. Automated decisions in individual cases including profiling

Aquila reserves the right to process personal data automatically in the future, in particular in order to identify significant personal characteristics of applicants or employees. This serves to identify risks and development opportunities for applicants and employees.

Should this lead to automated individual decisions, Aquila will ensure that a contact person is available if a data subject wishes to comment on an automated individual decision and such a possibility to comment is provided for by law.

10. Duration of storage

The duration of the storage of personal data depends on the purpose of the respective data processing and/or legal storage and documentation obligations. As soon as the personal data is no longer required for the above-mentioned purposes, it is deleted or made anonymous as far as possible.

If an application does not lead to employment with Aquila AG, the personal data will be deleted (subject to the consent of the data subject to retain the data for future positions). If the application leads to employment with Aquila AG, the application documents will be transferred to the personnel file and will continue to be stored in this respect.

11. Rights of the data subjects

Anyone can request information from Aquila as to whether personal data about him/her are being processed. There is the right to object or to restrict processing and, where applicable, to data portability. Incorrect data can be corrected. Furthermore, the deletion of personal data can be requested, unless legal or regulatory provisions (e.g. legal retention obligations of business-relevant data) or technical hurdles prevent this. In addition, where applicable, there is a right of appeal to a competent authority. Where Aquila processes personal data on the basis of consent, this consent may be revoked at any time. It should be noted that Aquila reserves the right to invoke the restrictions provided for by law, for example if it is obliged to retain or process certain data, has an overriding interest in doing so (insofar as it is entitled to rely on this) or requires it for the assertion of claims.

In order to assist Aquila in responding to your request, please provide us with a corresponding, comprehensive message. We will review and respond to the concerns within a reasonable time.

12. Changes

Aquila may amend this Privacy Policy at any time without prior notice. The current version published on Aquila's intranet or given to the applicant as part of the application process shall apply.