3. Rights of data subjects/your rights under data protection law

You have the following rights under the applicable data protection law with regard to the personal data concerning you:

You can contact a supervisory authority at any time with a complaint, e.g. the competent supervisory authority in the federal state of your place of residence or the authority responsible for us as the controller. You can find a list of supervisory authorities (for the non-public sector) with addresses at: https://www.bfdi.bund.de/DE/Service/Anschriften/Laender/Laender-node.html.

Right to information: You can request information from us at any time about whether and which personal data we store about you. The provision of information is free of charge for you.

The right to information does not exist or only exists to a limited extent if and insofar as the information discloses information that requires confidentiality, e.g. information that is subject to professional secrecy.

Right to rectification: If your personal data stored by us is incorrect or incomplete, you have the right to request that we rectify this data at any time.

Right to erasure: You have the right to request that we erase your personal data if and to the extent that the data is no longer required for the purposes for which it was collected or, if the processing is based on your consent, you have withdrawn your consent. In this case, we must stop processing your personal data and remove it from our IT systems and databases.

There is no right to erasure if

• the data may not be erased due to a legal obligation or must be processed due to a legal obligation

• the data processing is necessary for the establishment, exercise or defence of legal claims

Right to restriction of processing: You have the right to request that we restrict the processing of your personal data.
Right to data portability: You have the right to receive the data you have provided to us in a structured, commonly used and machine-readable format and the right to have this data transmitted to another controller. This right only exists if

• you have provided us with the data on the basis of consent or on the basis of a contract concluded with you

the processing is carried out by automated means.

5. Right to lodge a complaint with a data protection supervisory authority

In accordance with Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates data protection law.

6. Provision of the data

Even if data is sometimes transmitted automatically when you visit our careers page, you are not legally or contractually obliged to provide data in connection with the use of our homepage.

In connection with the contact form and contacting us by e-mail, you are free to send us data via these channels, but we cannot process and answer any enquiries from you in this respect without the corresponding provision of data in the course of making contact.

7. Description of data processing and legal basis for processing
7.1 Processing of personal data when accessing the careers page
7.1.1 Type and scope of data processing

When you access our careers page, we collect the data that is technically necessary for us to display this careers page to you. This involves the following personal data, which is automatically transmitted to our server by your browser
•    IP address
•    Date and time of your enquiry/access to the careers page (the app)
•    Time zone difference to Greenwich Mean Time (GMT)
•    Content of the request (information about which specific page you accessed)
•    Access status/http status code
•    Amount of data transferred in each case
•    Career page from which the request originates
•    Browser (information about the browser you are using)
•    Operating system and its interface (operating system of the computer you are using to access the career site)
•    Language and version of the browser software

This careers page is hosted by a service provider; the data collected on our careers page is therefore stored on the service provider's servers. The server locations are in Germany and other EU countries. Data is transferred abroad, but only to countries in the European Union or the European Economic Area.

7.1.2 Legal basis

This personal data is processed on the basis of our overriding legitimate interest in accordance with Art. 6 para. 1 sentence 1 lit. f) GDPR. The careers page cannot be accessed and offered to users without the use of this data; there is a legitimate interest in making it technically possible to access and use the careers page. The data is also stored in order to technically secure the careers page. We have an interest in the security and availability of this careers page.

7.1.3 Storage period

The data information is stored for 14 days and then deleted.

7.2 Registration and creation of a user account
7.2.1 Type and scope of data processing

If you would like to apply to PwC Strategy& via the career portal, you can register in the first step and create a personal user account. You can then use your user account to complete our application forms and upload your application documents.
The following categories of personal data are processed:
•    Salutation
•    Academic Title
•    First name (mandatory)
•    Surname (mandatory)
•    User name (mandatory)
•    E-mail address (mandatory)

7.2.2 Legal basis

The processing of data in the context of registration and the creation of a user account by you is based on your consent in accordance with Art. 6 para. 1 sentence 1 lit. a) GDPR.  Registration and the creation of a user account are voluntary. By registering yourself or setting up a user account, you consent to the processing of the data collected in this context.
You can revoke your consent at any time with effect for the future.

7.2.3 Storage period

The data collected during registration and the creation of the user account will be stored for the duration of the registration and the existence of the user account.

You can delete your account yourself at any time, either by using the self-service or by sending us a request for deletion by email or post. In both cases, your account will be deleted as soon as possible. The deletion of your user account does not affect the lawfulness of the processing of personal data between registration/setup of the user account and deletion of the user account by you.

7.3 Submission and review of your application
7.3.1 Type and scope of data processing

We use your personal data to fill our vacancies with suitable candidates. For this purpose, we review your application documents.

If you would like to apply via our careers page, you can register on our careers page and enter your applicant details and upload your application documents via your personal user account.
You also have the option of using our chatbot. This will help you with your questions about our vacancies. By answering the questions posed by the chatbot, you will receive pre-filtered job adverts.

In cases where we work with a headhunting provider, they will send your application documents and we will review the application. The source of the data is the headhunting provider.

In particular, the following personal data is processed
•    Academic Title
•    First name (mandatory)
•    Surname (mandatory)
•    Email address (mandatory)

•    Nationality
•    Gender
•    Street/house number
•    Country (mandatory)
•    Postcode
•    Place of residence
•    Telephone number (mandatory)
•    Field of training or study
•    (desired) degree
•    Training centre or university
•    Desired starting date / cancellation period
•    Salary expectations
•    Preferred location
•    Origin of the application (mandatory)
•    German language skills (mandatory)
•    Curriculum vitae (mandatory)
•    Other documents, such as cover letter, school and university certificates, job references, certificate of semesters abroad and internships
•    Message to PwC Strategy&
•    Job-specific questions depending on the job advertisement

The provision of personal data via the careers page is voluntary for you. However, some of the information requested is marked as mandatory (also marked as mandatory in the list above). If these fields are not completed, you will not be able to submit your application to us and we will not be able to consider it for our selection process.

As part of the review of your application, we also use a tool that works with the help of artificial intelligence. The tool only serves as an additional assessment of the extent to which an applicant profile matches the requirements of a position. The criteria used are the title of the job advertisement, qualifications, location and professional experience. No demographic information is used.

The artificial intelligence used explicitly does not make any recruitment decisions and does not prepare any such decision templates. The decision on consideration for a vacancy is always made by a recruiter or hiring manager. There is no case of exclusively automated decision-making in accordance with Art. 22 GDPR.

7.3.2 Legal basis

The processing of this personal data is based on your consent in accordance with Art. 6 para. 1 sentence 1 lit. a) GDPR.

You can withdraw your consent at any time with effect for the future.

7.3.3 Storage period

We store your personal data for as long as it is necessary for the decision on your application. If an employment relationship between you and us does not materialise, we may continue to store data if this is necessary for the defence against possible legal claims. As a rule, your data will be deleted within 6 months of the end of the application process.

7.4 Check for further vacancies
7.4.1 Type and scope of data processing

We may consider your applicant profile for other vacancies for which you have not yet applied or which may also be suitable. The AI in our applicant management tool also supports us in this and helps us to identify suitable positions for your profile based on the requirements profiles of the various advertised positions. Based on this, our recruiting team can decide to suggest further positions to you, provided you have agreed that we may send you these suggestions.

For this purpose, we generally process the same data that you have sent us as part of your application.

7.4.2 Legal basis

The processing of data in the context of checking your suitability for further vacancies is based on your consent in accordance with Art. 6 para. 1 sentence 1 lit. a) GDPR.

You can revoke your consent at any time with effect for the future.

7.4.3 Storage period

We store your data until it is no longer required or you have withdrawn your consent. If there are statutory retention obligations, the data will be stored for the duration of the statutory retention obligations. As a rule, your data will be deleted within 6 months of the end of the application process.

7.5 Actively approaching applicants on professional social media platforms
7.5.1 Type and scope of data processing

We use professional social networks to recruit personnel by identifying suitable talent for PwC Strategy&. If necessary, a subsequent approach is made via the network's internal chat function.

In doing so, we use the personal data published on the respective professional social media platform.

7.5.2 Legal basis

We process personal data with regard to the identification of suitable talents on the basis of our legitimate interest pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR. We have an interest in filling our vacancies.

The processing of data in the context of actively approaching applicants on professional social media platforms is based on your consent in accordance with Art. 6 Para. 1 S. 1 lit. a) GDPR.

7.5.3 Storage period

If your data is stored in this context, we will store it for as long as storage is required or you have withdrawn your consent. If there are statutory retention obligations, the data will be stored for the duration of the statutory retention obligation.

7.6 Further development of artificial intelligence (AI)
7.6.1 Type and scope of data processing

Artificial intelligence supports us in the application process. We use data from the application process to further develop artificial intelligence in order to find and assess the right talent for vacancies. We use what is known as a "human-in-the-loop" technique. This is a technique in which "people are taken into the learning loop" in order to optimise candidate suggestions and assessments to our needs.

The data categories processed to further develop the AI are your skills, your location and your previous work experience. No other demographic information is processed.

7.6.2 Legal basis

The processing of data in the context of the further development of artificial intelligence is based on our legitimate interest pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR. We have a legitimate interest in ensuring that artificial intelligence adapts to actual requirements.

7.6.3 Storage period

We store your personal data for as long as it is necessary for the decision on your application. If an employment relationship between you and us does not materialise, we may continue to store data if this is necessary for the defence against possible legal claims. As a rule, your data will be deleted within 6 months of the end of the application process.

7.7 Review of expense reports
7.7.1 Type and scope of data processing

The necessary interview costs include travelling expenses, which we will gladly reimburse. The interview costs must also be reimbursed if you have not been asked to attend the interview directly, but by a recruitment consultant commissioned by us. It does not matter whether an employment contract is concluded or not. In order to reimburse you for the costs, we require the following data for accounting purposes:
•    Name
•    Home address (street, house number, postcode, city, country)
•    Bank details
•    Email address

7.7.2 Legal basis

The processing of data in the context of checking expense reports is carried out for the purpose of initiating a contract in accordance with Art. 6 para. 1 sentence 1 lit. b) GDPR.

7.7.3 Storage period

We store the above-mentioned personal data for up to 10 years from the end of the application process.

7.8 Contact by e-mail with the so-called "job alert"
7.8.1 Type and scope of data processing

By creating a job alert, you agree to receive emails with job offers from PwC Strategy&. Your e-mail address and your job preferences will be stored for this purpose.

7.8.2 Legal basis

The legal basis for this data processing is your consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR. You have the right to revoke your consent to PwC Strategy& in whole or in part at any time without giving reasons with effect for the future.

To withdraw your consent, you can revoke your consent via the Self Service in your user account. This is done in the same way in which you gave us your consent. The revocation does not affect the lawfulness of the processing of your personal data between consent and revocation.

7.8.3 Storage period

We store your data until it is no longer required or you have withdrawn your consent. Insofar as statutory retention obligations exist, the data will be stored for the duration of the statutory retention obligation.

7.9 Job marketing
7.9.1 Type and scope of data processing

We offer you the opportunity to receive emails with job offers from PwC Strategy&, invitations to events, feedback surveys on the application process and other career-related topics. You also have the opportunity to join one of our Talent Communities as part of our Talent Relationship Programmes. Your name and email address will be processed for this purpose.

7.9.2 Legal basis

The legal basis for this data processing is your consent in accordance with Art. 6 para. 1 sentence 1 lit. a) GDPR. You have the right to revoke the declarations of consent you have given to PwC in whole or in part at any time without giving reasons with effect for the future.

To revoke your consent, you can revoke your consent via the Self Service in your user account. This is done in the same way in which you gave us your consent. The revocation does not affect the lawfulness of the processing of your personal data between consent and revocation.

7.9.3 Storage period

We store your data until it is no longer required or you have withdrawn your consent. Insofar as statutory retention obligations exist, the data will be stored for the duration of the statutory retention obligation.​​​​

8. Cookies

We and certain third parties use cookies on our careers site to make your visit to our careers site more attractive and to enable the use of certain functions. These are small text files that are stored on your end device. Some of the cookies we use are deleted after the end of the browser session, i.e. after you close your browser (so-called session cookies). Other cookies remain on your end device and enable us or our partner companies to recognise your browser on your next visit (persistent cookies).
The following cookie categories are used:

8.1 Cookies that are technically necessary for the operation of our website:

These cookies are technically necessary for the operation and functionality of the careers site. They make the careers site technically accessible, secure and usable and provide essential and basic functionalities, such as navigation on the careers site, the correct display of the careers site in the Internet browser or consent management.

8.2 Analytics/analysis cookies:

The analytics cookies allow us to collect data in an aggregated form about our careers site visitors and your experience on our website. We use this data to eliminate errors and improve the experience for all visitors.

8.3 Marketing cookies:

These cookies enable us to draw your attention to relevant PwC Strategy& advertising campaigns and to show you personalised PwC Strategy& content based on your interests, including on third party careers sites. In addition, we can use targeting to limit the frequency with which an advert appears and reduce the number of times it is displayed to you.

You can find more information about the cookies used on this website in our Cookie Policy.

9. Recipient of the data

In order to fulfil the processing purposes listed below, data is also transferred to third parties. This may also include the transfer of personal data to other European and non-European countries and the storage of data outside the EU or the European Economic Area (EEA).

9.1 Recipients bound by instructions

We pass on your data to service providers bound by instructions both within the PwC network and to other third parties, such as IT service providers, who support us in our activities, e.g. in the administration and maintenance of the career pages and the associated systems and/or for other internal or administrative purposes.

PwC Strategy& is a member of the global PwC network, which consists of the individual legally autonomous and independent PwC companies. As part of our activities, we use other German or foreign PwC network companies as network-internal IT service providers bound by instructions, which provide services for the operation, maintenance and care of the IT systems and applications used by the PwC network companies. In particular, this is PwC IT Services Ltd. based in the United Kingdom (UK).

If we pass on data to service providers bound by instructions, we do not require a separate legal basis for this.

Further information on the cloud service providers used by PwC Strategy& can be found at the following link: www.pwc.de/externe-dienstleister.

9.2 Independent recipients

In addition, in individual cases we pass on your data both within the PwC network and to other third parties who use your data on their own responsibility. For example, in individual cases, we also transfer personal data to other companies in the PwC network in order to support and optimise our business processes (including coordinated marketing activities).

In addition, we also pass on your data to other third parties in individual cases, such as authorities, courts or other bodies, if we are obliged by law or by official or court order of an EU member state to disclose personal data to these bodies. These bodies also use the data on their own responsibility.

Insofar as you have explicitly consented, Art. 6 para. 1 lit. a) GDPR is the legal basis for the data transfer. Insofar as there is a legal obligation to disclose the data, Art. 6 para. 1 lit. c) GDPR is the legal basis for the data transfer.

If, on the other hand, the disclosure is necessary for the fulfilment of a contractual or pre-contractual measure with you as a natural person, Art. 6 para. 1 lit. b) GDPR is the legal basis for the data transfer. Otherwise, the transfer is based on our legitimate interests and the legal basis is Art. 6 para. 1 lit. f) GDPR; we and the other companies in the PwC network have an interest in organising our work processes efficiently and sharing business processes within the PwC network for this purpose.

9.3 Data transfer to recipients in third countries outside the EU/EEA

If one of the above-mentioned data transfers is made to a recipient outside the EEA (in so-called "third countries"), an appropriate level of data protection for the foreign transfer is guaranteed by suitable security measures.

For data transfers within the PwC network, the PwC network companies have, among other things, concluded an internal data protection agreement which provides for compliance with the EU standard contractual clauses of the EU Commission within the meaning of Art. 46 para. 2 lit. c) GDPR for the transfer of personal data from EU/EEA countries to PwC network companies outside the EU/EEA.

If you have any questions about such data protection contracts based on the EU standard contractual clauses or would like more information on further security mechanisms and security measures for data transfers to third countries, you are welcome to contact our data protection officer, e.g. at DE_Datenschutz@pwc.com.