Privacy notice for applicants (recruiting) 

Hexagon AB, its subsidiaries and controlled joint ventures (“Hexagon”, “we” or “us”) respect your privacy. This privacy notice explains how we collect, store, use, disclose, retain and transfer (hereinafter “process”) your personal data and informs you about your rights. It specifically describes the personal data we process about you as an applicant during the recruitment process. This privacy notice is structured to make it easier for you to find the information most relevant to you.

We may change this privacy notice by posting the revised version on this website and indicating its effective date.

We may provide links to other websites and applications that we believe may be of interest to you. Unless stated otherwise in this privacy notice, we do not control and are not responsible for the processing on third-party websites. We encourage you to read the privacy notices of any website you visit.

How do we obtain your personal data?

We obtain personal data:

• Directly from you, when you apply via our Recruiting Portal (including where you choose to import your profile from LinkedIn) and/or communicate with us during the recruitment process.
• From third parties, where applicable (e.g. recruiting agencies, referrals, referees and providers of background checks, where permitted and relevant).
• From technical sources, when you access and use our Recruiting Portal (e.g. session information and usage data, where applicable and in line with the Cookie Policy).

Categories of personal data we process

Depending on the position and applicable law, we may process:

• Identity data
• Contact data
• Profile data, including your CV, professional expertise, skills, qualifications, awards and language proficiency
• Technical data
• Employment details, background information and any other information in your application that you choose to share with us

Purposes of processing

We process your personal data to:

1. Administer and manage your application – receive and review your application, communicate with you, schedule interviews and manage the recruitment workflow.
2. Evaluate suitability and make hiring decisions – assess your qualifications and match them against role requirements, including by conducting interviews and assessments.
3. Conduct recruitment-related checks – where permitted and relevant, conduct pre-employment screening, verification or checks.
4. Manage recruitment operations and providers – coordinate with service providers supporting recruitment (e.g. agencies, assessment providers, IT providers).
5. Comply with legal obligations and protect legal interests – meet retention and reporting obligations, respond to lawful requests and establish, exercise or defend legal claims.
6. Talent pool / future opportunities – if you opt in and consent, we retain your profile to consider you for future roles and contact you about suitable opportunities.

Legal basis for processing

We rely on the following legal bases for each purpose:

Special categories of personal data

We do not ask you to provide special categories of personal data (e.g. data concerning health, racial or ethnic origin, religious beliefs or trade union membership) unless this is necessary. Where we process such data – for example, to provide reasonable adjustments during the recruitment process or where local law requires or permits the collection of diversity information – we do so only where necessary to carry out obligations under employment law, to establish, exercise or defend legal claims or on the basis of your explicit consent. Providing diversity information is always voluntary.

Consent

Where we rely on your consent, providing it is voluntary and has no effect on your application. You may withdraw your consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before your withdrawal.

Use of AI tooling

Hexagon may use Artificial Intelligence (‘AI’) tools for processing personal information.

We subject all AI tools used to our internal due diligence process before engaging them, we do not allow AI suppliers to use your information for their own purposes and where our suppliers incorporate AI into their products, we ensure appropriate contractual safeguards are in place.

Other jurisdictions

Where the Swiss Federal Act on Data Protection (FADP) or other local laws apply, we process your personal data in accordance with their requirements.

Automated decision-making and profiling

We do not make decisions about you based solely on automated processing, including profiling, and we do not use artificial intelligence features in our Recruiting Portal to evaluate, score, rank or select applicants. All decisions in the recruitment process are made by people.

Recipients of personal data
 

Recipients within Hexagon

Your personal data is accessed by authorised persons at the Hexagon entity to which you apply, such as HR and recruiting staff, hiring managers and interviewers, strictly on a need-to-know basis. Where necessary for the recruitment process – for example, for roles with regional or global responsibilities, for interviews involving colleagues from other entities, or where HR services are provided centrally – authorised persons at other Hexagon entities may also access your data.

Recipients outside Hexagon

Where necessary to process your application, we share your personal data with the following categories of recipients:

• IT and hosting providers – in particular SAP, which provides and hosts our Recruiting Portal (SAP SuccessFactors) in Switzerland, and other IT service providers that support us.
• Recruiting agencies – where you applied through an agency or an agency supports us in filling the position.
• Professional networking platforms – e.g. LinkedIn, where you apply or communicate with us via the platform. LinkedIn processes such data as an independent controller in accordance with its own privacy policy.
• Background check providers – where pre-employment checks are permitted and relevant for the position.
• References – persons you have named as referees, to the extent necessary to obtain a reference.
• Public authorities, courts and law enforcement – where we are legally obliged to disclose data, or where disclosure is necessary to establish, exercise or defend legal claims of Hexagon.

Service providers acting as processors process your personal data only on our instructions and on the basis of data processing agreements in accordance with Art. 28 GDPR. We do not sell your personal data.

International transfers

Our Recruiting Portal is hosted in Switzerland for all Hexagon entities. Switzerland is recognised by the European Commission and the UK as providing an adequate level of data protection.Hexagon is a global group, your personal data may be accessed by Hexagon entities or service providers located in other countries where this is necessary for the recruitment process (see “Recipients of personal data”). Where such a country does not provide an adequate level of data protection, we protect your personal data with appropriate safeguards. If you have any questions regarding international transfers or personal data, please contact: [email protected].

Accuracy of information

Information you submit must be true, accurate, complete and not misleading. False or misleading statements or omissions during the application process may result in the rejection of your application and, if you become an employee, may lead to termination, subject to applicable law and due process.

Third-party data (e.g. referees)

If you provide personal data of other individuals (e.g. referees), please inform them that you will disclose their personal data to Hexagon and provide them with a copy of this notice before doing so.

How long we keep your personal data

We retain applicant data only as long as necessary for recruitment purposes and in line with applicable law. Retention periods may differ by country and case.

Hexagon operates in many countries, and data retention laws differ from one jurisdiction to another. The retention period for your data therefore depends on where you applied, on the laws that apply to the Hexagon entity processing your application, and on the outcome of your application.

Exceptions

Longer retention may apply where required by law or where necessary to establish, exercise or defend legal claims. In such cases, deletion may be restricted and processing limited to what is necessary.

Contact (privacy / data protection)

Our Privacy Team, led by the Group Privacy Officer, will support you with any data privacy-related queries, concerns, comments or complaints. You can contact the Privacy Team at [email protected].

Your rights

Depending on applicable law (GDPR, UK GDPR, Swiss FADP and local laws), you may have the right to:

• Access your personal data and obtain a copy
• Rectify inaccurate or incomplete data
• Request deletion/erasure (subject to legal retention obligations)
• Restrict processing
• Object, on grounds relating to your particular situation, to processing based on legitimate interests
• Data portability (where applicable)
• Withdraw your consent at any time, where processing is based on consent, without affecting the lawfulness of processing before the withdrawal
• Not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you (as stated above, we do not make such decisions)
• Obtain information about, or a copy of, the safeguards used for international transfers of your personal data

To exercise your rights, contact [email protected]. Exercising your rights will not have any negative effect on your application.

You also have the right to lodge a complaint with a competent data protection authority, in particular in the country where you live, work or where the alleged infringement took place.

Security

Hexagon implements appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, use or alteration and against unauthorised disclosure or access. Access is limited to individuals who need the data for the purposes described above.

Cookies

Information about cookies and similar technologies used on our Recruiting Portal is available in our Cookie Policy, which you can access via the link in the footer of this page.

Identity of the controller

Hexagon AB, Swedish Company Registration Number 556190-4771, Lilla Bantorget 15, P.O. Box 3692, SE-103 59 Stockholm, Sweden, and its subsidiaries and controlled joint ventures are joint controllers. As such, we jointly determine the purposes, scope and means of processing your personal data in the context of recruitment. In particular, we jointly decide which personal data to collect and for which purposes, and which databases, platforms, applications and tools to use for the processing. All Hexagon companies have contractually agreed to implement appropriate technical and organisational measures to protect your personal data and to provide each other with the necessary assistance in fulfilling your requests and handling data breaches. This includes ensuring that reporting and notification obligations are fulfilled.

Although you can assert your rights against each Hexagon company, Hexagon AB has been assigned the responsibility to inform you about the joint processing of your personal data and to act as the central point of contact for your requests. Any Hexagon company you contact directly will coordinate with the other Hexagon companies to respond to your inquiry and to guarantee your rights as a data subject.

You can contact us at [email protected].

For California residents only

This section provides information to California residents pursuant to the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (CCPA). Personal data also includes any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular “consumer” or “household” as defined therein. We do not and will not sell or share (for cross-context behavioural advertising) your personal data with third parties.

Subject to the CCPA, you have the right to:

• Know what personal information we collect, use and disclose about you, and access it
• Request deletion of your personal information
• Request correction of inaccurate personal information
• Limit the use and disclosure of sensitive personal information, where we use it for purposes beyond those permitted by the CCPA
• Not be discriminated or retaliated against for exercising your rights

To exercise your rights, contact [email protected]. You may designate an authorised agent to submit a request on your behalf. We will verify your identity before responding to your request.