Information on data processing for applicants (UK)

Information on data processing for applicants (UK)

Dear applicants,

The following information on data processing for applicants sets out which personal data we process about you as an applicant.
We also wish to inform you about your general rights in connection with the processing of your personal data (hereinafter referred to as "data subject rights").

We would also like to draw your attention to the fact that the STRABAG Group has established guidelines for the handling of personal data in its Group Data Protection Policy, which defines the Group standard that must be observed in relation to data protection.
You can view the Group Data Protection Policy here .

I. Controller

The Controller responsible for data processing in accordance with Art. 4(7) UK GDPR is the respective Group company to which you are applying.
The contact details of the controller can be found in the relevant job advertisements.

If you have any questions about how we process your personal data or about data protection in general, please contact our data protection team at data-protection-uk@strabag.com.

II. Categories of personal data

1.
We process the personal data that you provide to us in your application.
This usually includes the following data:

• Basic identification data (e.g. surname, first name, date of birth, and title or salutation if applicable);
• Contact details (address, telephone number, email address, etc.);
• Nationality and, where applicable, data relating to health status (suitability for the specific work), if applicable;
• Data on language skills and whether a work permit exists for the country of application;
• A photograph for the application;
• Application documents such as CV, covering letter, certificates, references and any other information and data that you provide to us and share with us during interviews;
• Payment details (e.g. bank account details for the reimbursement of application-related expenses);
• Log data generated when using IT systems during the application process and when accessing your user account, if one is created;
• Any other data that you voluntarily provide in the application form.

If you wish to exercise any rights available to severely disabled persons in the application process, you may indicate your disability in your application.

During the application process, you may provide us with further data on the basis of your consent, for example, when you are asked whether you would like to participate in a behavioural profile analysis.

2.
The categories of your personal data that we process as part of pre-employment screening measures (PES for short) and their origin are described in more detail in section IX of this notice.

III. Purposes and legal bases of data processing

1.
We process your personal data in order to assess your suitability for the advertised position (or, where applicable, other open positions within the Group) and to conduct the application process as part of the decision on whether to enter into an employment relationship.
This processing is carried out on the basis of Art. 6(1)(b) UK GDPR.

Where your application contains special categories of personal data within the meaning of Art. 9(1) UK GDPR, such data will be processed on the basis of Art. 9(2)(a) and/or (b) UK GDPR.

2.
Where data collected during the application process is required after its conclusion for the purposes of bringing or defending legal claims, processing may be carried out on the basis of Art. 6 UK GDPR — in particular on the grounds of legitimate interests pursuant to Art. 6(1)(f) UK GDPR.
In such cases, the legitimate interest of the relevant Group company consists in the establishment, exercise or defence of legal claims.

3.
In certain cases, or where the position applied for involves the performance of particularly sensitive tasks or carries personnel and/or financial responsibility, more extensive collection and processing of your data may be necessary for the purposes of fraud prevention, protection of reputation and know-how, and compliance with international compliance requirements.
To safeguard data privacy, such additional data processing (pre-employment screening, hereinafter "PES") only takes place at the end of the application process.
If the position you are applying for is subject to PES, we will notify you separately in advance.

The legal basis for conducting PES is Art. 6(1)(f) UK GDPR.
The STRABAG Group's legitimate interest in conducting PES lies in the need for an objective assessment of qualifications in order to select the most suitable applicants, to prevent fraud, to protect its reputation and know-how, to reduce liability risks and to comply with international compliance requirements.

The processing of special categories of personal data pursuant to Art. 9(1) UK GDPR in the context of PES is limited to data that the data subject has manifestly made public (Art. 9(2)(e) UK GDPR).

Further details on PES can be found in Section IX of this notice.

4.
During the application process, you may choose to make your application data available for Group-wide searches, so that you may also be considered for other positions for which you have not applied.

If you choose this option, your stored application data will be processed for this purpose on the basis of your consent in accordance with Art. 6(1)(a) UK GDPR.

5.
Furthermore, if you permit us to record the source through which you accessed our applicant management system, we use this data for the purpose of optimising our recruitment processes and the efficient use of resources.
This data is recorded automatically in the background when you select the corresponding option in our application form.

If you select the option provided for this purpose, the associated processing is based on your consent in accordance with Art. 6(1)(a) UK GDPR.

6.
If you create a user account in the applicant management system (see Section V of this notice), the associated data will be processed in accordance with Art. 6(1)(f) UK GDPR.
Our legitimate interests lie in the clear identification of applicants when they log in and in the efficient design and optimisation of the application processes.

7.
If an employment relationship is established, the data you provide to us during the application process and the PES summary (see Section VIII.5 of this notice) will be transferred to your personnel file and processed for the purposes of performing the employment relationship.
The legal basis for this is Art. 6(1)(b) UK GDPR and Art. 88 UK GDPR.

8.
Where consent is given to the processing of certain personal data (not mentioned above) or to a specific type of processing, the relevant consent (Art. 6(1)(a) UK GDPR) forms the legal basis for that processing.

9.
Anonymised application data is used for statistical purposes.

IV. Collection of data

As a general rule, data is collected directly from you during the application process with the STRABAG Group.
Data is collected by completing the data fields in the application form and uploading the documents you wish to submit.

It is also possible to transfer your data via a social network (such as LinkedIn, Indeed or Xing).

Another option available to you for transferring your data is pre-filling the application form.
This involves transferring the data from the document you have linked (e.g. your CV) into our application form, whereby you retain the option of adjusting, amending or supplementing the pre-filled data before submitting your application.

V. Creating a User Account

After submitting your application, you have the option of creating a user account in our applicant management system to allow you to track and manage your applications.

To create a user account, you will need your email address and password.
After registering for the first time, you will need to verify the email address you provided for identification purposes.

VI. Recipients and categories of recipients of the data

Once your application has been received, your applicant data will be reviewed by recruiters, some of whom act as processors (Art. 28 UK GDPR) for the individual Group companies.
Suitable applications will then be forwarded internally to the managers responsible for the relevant vacant position.
Within the STRABAG Group, access to your data is restricted to those persons who require it for the proper conduct of the application process.

The relevant works council and/or the relevant representative body for disabled employees may also use your data to exercise their rights of participation in the recruitment process.

Other possible recipients of personal data include, for example:

• Other Group companies, where you have consented to the release of your application data for Group-wide searches;
• The STRABAG Group's compliance department, in connection with the conduct of PES;
• Processors, e.g. in relation to the applicant management system, any behavioural profile analysis, the implementation of PES, and the administration of data provided during the application process and transferred to your personnel file, should an employment relationship be established;
• Other recipients on the basis of your consent.

VII. Transfer of data to a third country or to an international organisation

Data will only be transferred to countries outside the UK, EU or the EEA (so-called third countries) where this is necessary for the performance of a contract, is required by law (e.g. tax reporting obligations), you have given your consent, or where it is carried out under an appropriate data processing agreement.
Where service providers in third countries are engaged, they are required to comply with documented instructions and to implement appropriate measures (including agreeing to the UK Addendum to the EU standard contractual clauses) to ensure an adequate level of data protection in accordance with Chapter V of the UK GDPR.

Where the position you are applying for involves employment with a Group company outside the European Union and the European Economic Area, your personal data will be transferred to the relevant Group company based outside the European Union and the European Economic Area.
In such cases, we take appropriate measures to ensure that your personal data is afforded the same level of protection as it receives within the European Union.

VIII. Duration of data retention

1.
We will retain your data until you withdraw your application.
If the application process concludes without your being appointed, we will generally retain your data for a further six (6) months.
However, the aforementioned retention period may vary depending on the specific regulations of the country in which you are applying.
If you have any questions about this, please do not hesitate to contact us at data-protection-uk@strabag.com.

In any event, data will only be retained for as long as is necessary to protect our legitimate interests, e.g. in the context of legal proceedings.

Following the expiry of the applicable retention periods, the application data will be anonymised.
Once anonymised, the data can no longer be attributed to a specific individual and will be used exclusively for statistical purposes.

2.
If you consent to the release of your application data for Group-wide searches, the Group-wide visibility of your data will only be removed from our applicant management system upon expiry of the country-specific retention period applicable to each individual application you have submitted, at which point your application data will be anonymised.
Shortly before the expiry of the relevant retention period, you will be contacted by our applicant management system and reminded that the Group-wide visibility of your application data is due to expire.
You will also be given the option of extending this period once by a further six (6) months.

3.
If you create a user account in our applicant management system, it will be deleted upon expiry of the country-specific retention period — or, if you have granted an extension, upon expiry of the extended retention period — measured from the date of your last application.
In this case, you will no longer be able to log in.
The data from your last application still held in your user account will be anonymised in accordance with the principles described in this notice.

4.
If you are appointed, we will transfer your application data to your personnel file.

5.
Where your application is subject to PES, the data collected about you in the context of the PES will be deleted in accordance with data protection requirements six months after completion of the PES summary.
The PES summary itself will not be deleted but will be transferred to your personnel file if an employment relationship is established.

6.
You may withdraw any consents you have given us at any time with future effect by sending an email to data-protection-uk@strabag.com.

IX. Pre-employment screening (PES)

1.
Pre-employment screening (PES) is generally only conducted in respect of applicants who are applying for positions that involve the performance of particularly sensitive tasks or personnel and/or financial responsibilities.
In certain cases, some of the checks and measures provided for under PES and described in detail below may also be necessary for other applicants.

Where the position you are applying for is subject to PES, or where your application is a special case in which more extensive collection and processing of your personal data appears necessary, we will notify you separately about the form and scope of PES before it is carried out.

2.
Depending on the scope required in each individual case, PES includes the collection and processing of the following data:

• a. Verification of the highest educational qualification — carried out in individual cases by contacting the educational institution directly and/or requesting information from it where there is reason to suspect that the information provided is inaccurate and/or the institution is unknown;
• b. Verification of information regarding previous employment — carried out by contacting previous employers (human resources departments) directly — excluding the current employer — to verify details of the period of employment and job title;
• c. Verification of financial integrity and entries in publicly accessible and legally authorised databases (such as the central debtors' register or CRIF Bürgel) — carried out exclusively in cases where, given the nature of the position sought, integrity and trustworthiness in financial matters are of particular importance;
• d. Media research — carried out exclusively within the scope of the employer's right to make enquiries and relating exclusively to professional networks such as LinkedIn and Xing; no information relating to the private or personal sphere of individuals is collected;
• e. Self-employment — verification of the applicant's business activities by means of an enquiry to the relevant trade office;
• f. Verification of company holdings/affiliations — this involves checking the applicant's former and/or current direct company holdings or management positions; the commercial register and other official databases in the relevant country are consulted for this purpose;
• g. Basic Disclosure / Certificate of Good Conduct — within the UK, this is obtained via the Disclosure and Barring Service (DBS), with the applicant submitting the certificate to us; within the EU, this is obtained by the applicant submitting a personal application to the relevant authority and providing us with the certificate;
• h. Criminal records check — within the UK, this is carried out via a DBS check under the Police Act 1997 and the Rehabilitation of Offenders Act 1974; outside the UK and EU, carried out where necessary by searching criminal records, whereby the existence of a criminal record and the information contained therein may vary from country to country and between jurisdictions within a country;
• i. Compliance check — carried out by the Business Compliance Unit of the STRABAG Group, where necessary, by checking against relevant lists such as anti-corruption lists, watch lists, sanctions lists, terrorist lists and embargo lists;
• j. Political connections check — carried out by checking against PEP lists (lists of politically exposed persons) in relation to persons who have held prominent public positions within the last 12 months;
• k. Reputation check — carried out by searching publicly accessible sources, such as national and regional press, trade journals, databases, forums and social media, to determine whether published statements, media reports and/or media presence could adversely affect the reputation or standing of the STRABAG Group.

3.
PES is generally only carried out for selected positions that involve particularly sensitive tasks or personnel and/or financial responsibility.
The following positions are currently subject to the following PES checks/measures:

• a. Company/central division managers/Group staff division managers, directors, division managers, project managers at the same management level (persons with responsibility for complex construction projects), and experts at the same management level (persons with specialist knowledge who are primarily entrusted with specialist tasks) — all checks/measures listed under Section IX.2 of this notice, whereby the check/measure under Section IX.2(c) does not apply to experts;
• b. Group leaders, team leaders, managers at the same management level (persons with responsibility for complex construction projects), and experts at the same management level (persons with specialist knowledge who are primarily entrusted with specialist tasks) — checks/measures under letters (a) to (d) of Section IX.2 of this notice, whereby the check/measure under Section IX.2(c) does not apply to experts;
• c. Procurement employees — checks/measures under letters (a) to (d) of Section IX.2 of this notice;
• d. IT and software development employees — checks/measures under letters (a), (b) and (d) of Section IX.2 of this notice.

4.
You may refuse or object to data processing within the scope of PES at any time with future effect.
In such a case, however, we may not be able to consider you for the position for which you have applied.

X. Data Subject Rights

To exercise your rights, or if you wish to raise a complaint in connection with the processing of your personal data, please do not hesitate to contact our data protection team.
The contact details can be found in Section I of this notice.

Under the UK GDPR and/or the GDPR, you have the following rights:

1. Where your personal data is being processed, you have the right of access to the data held about you (Art. 15 UK GDPR).

2. Where inaccurate personal data is being processed, you have the right to rectification (Art. 16 UK GDPR).

3. Where the legal requirements are met, you may request the erasure of your data or restriction of processing (Arts. 17 and 18 UK GDPR).

4. Where you have consented to data processing or where processing is based on a contract and is carried out by automated means, you may have the right to data portability (Art. 20 UK GDPR).

5.
Where you have given your consent to the processing of your personal data, you have the right to withdraw that consent at any time with future effect.
The lawfulness of any processing carried out prior to withdrawal remains unaffected (Art. 7(3) UK GDPR).
You may send your withdrawal to karriere@strabag.com.

6.
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Art. 6(1)(f) UK GDPR.
Where you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or unless the processing is necessary for the establishment, exercise or defense of legal claims (Art. 21(1) UK GDPR).
Where we process your personal data on the legal basis of "legitimate interests" for the purpose of direct marketing, you have the right to object to such processing at any time.

7. You also have the right to lodge a complaint with the competent supervisory authority if you believe that the processing of your personal data infringes applicable law.
You may contact the competent data protection authority for the country or region in which your habitual residence, your place of work, or the place of the alleged infringement is located.

Further details of, or additions to, the purposes of data processing may be found in the relevant contract documents, forms, declarations of consent and other information provided to you.

We reserve the right to update our technical measures and data protection processes, and accordingly this notice on data processing for applicants, at any time.
Any such changes take effect upon their publication and when they can be viewed in our applicant management system.

Date: 1.3.2026