Privacy Notice for Job Applicants pursuant to Arts. 13 and 14 of Regulation EU 2016/679 (“GDPR”)
Shopfully Austria GmbH (“Shopfully Austria” or “Company”), with registered office in Weyrgasse 9/11, 1030 Wien, Austria, protects the privacy of all job applicants who apply for, or may be chosen by our Company for, specific positions through the Careers section of the website https://shopfully.com/; with regards to generic applications instead, please refer to section 2.g of our general Privacy Policy.
This document (“Privacy Notice”) has been written in order to allow you to understand how your Personal Data, as defined below, will be processed in the context of the recruiting process.
This Privacy Notice provides you with information so that you are able to provide your explicit and informed consent to the processing described below, where you wish to do so.
In general, any information or personal information you provide to our Company will be treated in accordance with the internationally recognised principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, data accuracy, data integrity and confidentiality.
1 Data controller and Data Protection Officer
Shopfully Austria, as identified at the beginning of this Privacy Notice, is the data controller (“Data Controller”) regarding personal data processing carried out in the context of the recruiting process, following job applications for specific positions.
To get in touch with our Data Protection Officer, please contact: dpo-offerista@shopfully.com.
2 Personal Data processed
Through your application or your job interview, you may provide the Data Controller with professional and work information (e.g. university studies, knowledge of foreign languages, professional qualifications, preferred workplace and career progress, useful social networks profiles, etc.) your photo and your cover letter (“Application”).
a. Data provided by you or collected from public sources
Through your application, the Data Controller collects personal data that you provide (i) directly through your application for specific job positions found on the Career section of the website: https://shopfully.com/careers/; or (ii) indirectly from third parties who are freely available or professional sites (e.g. LinkedIn) referable to you, if publicly accessible, to have further useful information to assess your suitability to the job position for which you apply. Your Personal Data processed may consist of an identifier such as the name, identification number, on line-identifier, or one or more features of your physical, physiological, psychological, economic, cultural or social identity which may permit your identification (hereinafter only “Personal Data”).
Through your resume (“Resume”) the Data Controller may collect the Personal Data of third parties (e.g. reference of individuals who recommend you). In this respect you are an autonomous data controller, and you assume all related legal obligations and responsibilities. In such case, you agree to fully indemnify Shopfully Austria against any complaints, claims or demands for compensation for damages which may be brought against Shopfully Austria because of the processing of this Personal Data brought by the third parties whose information have been unlawfully processed. In any case, you must acknowledge – thus assuming all related responsibilities – that this processing is based on an appropriate legal basis pursuant to Articles 6 and 9 of the GDPR on which you can rely to lawfully give Shopfully Austria this information.
b. Special Categories of Personal Data
Through your Resume you may disclose special categories of personal data (“Special Personal Data”), which is personal data that would potentially reveal your racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership; data concerning health, sex life or sexual orientation as defined under Article 9(1) of the GDPR.
The Data Controller will not process such personal data unless: a) it is not necessary for the work relationship with you; b) in accordance with what it is provided by the applicable law and Data Protection Authority’s provisions; c) subject to your consent, without which it will not be possible to process such personal data.
Therefore, the Data Controller invites you to not communicate such information unless it is necessary for the establishment of the work relationship, also considering the particular tasks and/or the specificities of the professional profile for which you send your Application.
In the event that you spontaneously provide such personal data in your Resume, we inform you that you must give your explicit consent at the bottom of it, pursuant to art. 9(2)(a) of the GDPR and more precisely, by inserting the following sentence:
“After having read the Privacy Notice for Job Applicants pursuant to Arts. 13 and 14 of Regulation EU 2016/679, I give my consent to the processing of my Personal Data as defined therein, for the purpose of Recruitment”.
Any untrue statements made in the Application and/or during any phase of a job offer could lead to the interruption of the selection process or, if discovered during the course of the employment relationship, to the termination of the same.
3 Purpose, legal basis ,and mandatory/discretionary nature of the processing
Your Personal Data will be processed on the basis of the GDPR and, where relevant, on the basis of the authorisation issued by the competent supervisory authority which is currently in force, for the following purposes:
a) to examine candidates’ Applications with a view of a possible first contact and interview with them (“Recruitment”). If you submit your Personal Data through the platform service “Truffls” operated by Funke Works GmbH (“Funke”), Funke and Shopfully Austria shall act as joint controllers pursuant to Article 26 GDPR. Pursuant to Article 26(2) GDPR, we inform you that Funke is responsible for collecting and forwarding to us your Personal Data, while Shopfully Austria processes your Personal Data as part of its recruitment and selection procedures. For more details on Funke’s data processing practices, please refer to Funke’s privacy policy https://truffls.de/en/privacy/
b) to comply with legal requirements that require the Data Controller to collect and/or further process certain types of Personal Data (“Compliance”);
c) to prevent or detect any abuse or fraudulent activities and thereby enable the Data Controller to defend itself in court (“Abuse/Fraud”);
d) to share candidate Applications with other companies that are part of the group of undertakings to which the Data Controller belongs (the “Group”) so that they can evaluate them and contact you if they consider your application to be valid (“Intra-Group Sharing”); in this regard, please refer to section 2.g of our general Privacy Policy.
The legal basis that we use to process your Personal Data, according to the purposes indicated in paragraph 3, are the following:
Processing for the purpose of Recruitment is necessary to take your Application into consideration and in order to start the selection process with a view to offer you, when applicable, a job. Therefore, the relevant processing activities are based on the need to enter into an employment contract with you or to perform related pre-contractual measures, as enshrined by Article 6(1)(b) GDPR. It is not mandatory for you to provide Shopfully Austria with your Personal Data for this purpose; however, if you do not, Shopfully Austria will not be able to take your Application into consideration. If you want to provide Special Personal Data (e.g. personal data related to your health condition, religion, etc.) Shopfully Austria will need your specific consent, as indicated in point 2.b of this Privacy Notice.
Processing for the purpose of Compliance is necessary to comply with legal obligations. When you provide your Personal Data, the Data Controller must process it in accordance with the applicable law, which may include retaining and disclosing your Personal Data to official authorities for compliance with tax, customs or other legal obligations.
The processing for the purpose Abuse/Fraud is necessary to prevent or detect any abuse or fraudulent activities and thereby enable the Data Controller to defend itself in court.
The processing for the purpose of Intra-Group Sharing is based on Data Controller’s legitimate interest to perform administrative and accounting activities in the interest of the Group, according to Article 6(1)(f) GDPR the Recital 48 of the GDPR.
4 Recipients of Personal Data
Your Personal Data may be shared with:
- persons, companies or professional firms providing Shopfully Austria with advice and consultancy regarding accounting, legal, tax, recruiting and hosting providers or e-mail platform providers. They typically act as data processors on behalf of the Data Controller;
- persons authorised by the Data Controller to process Personal Data needed to carry out activities on behalf of the Data Controller, who have undertaken an obligation of confidentiality or who are subject to an appropriate legal obligation of confidentiality (e.g., employees of the Data Controller);
- entities which are part of the Company Group, for Intra-Group Sharing purposes;
- public entities, bodies or authorities to whom your Personal Data may be disclosed, in accordance with binding orders of those entities, and for Compliance, Abuse/Fraud purposes.
5 Transfer of Personal Data
Your Personal Data may be transferred to Recipients located in several different countries outside the European Economic Area. Shopfully Austria implements appropriate safeguards to ensure the lawfulness and security of these Personal Data transfers, such as by relying on adequacy decisions from the European Commission, standard data protection clauses adopted by the European Commission, or other safeguards or conditions considered adequate to the transfer at hand. You can obtain more information by sending a written request to our DPO at the following address: dpo-offerista@shopfully.com.
6 Retention of Personal Data
The Data Controller shall retain Personal Data processed for the purposes of Recruitment for the time strictly necessary to achieve the above purpose and, in any case, for a period not exceeding 12 (twelve) months from receipt of the Application or the last update. The Data Controller reserves the right to contact applicants before the expiration of this period to request them to extend the retention period of their Personal Data or to request an update of the Application. If no answer is received, Personal Data collected will be deleted. If the Application does not meet the requirements for the job position sought, or it is not of interest, it may be deleted immediately. If it contains Special Personal Data but is not accompanied by appropriate consent to processing, it will be immediately deleted.
The Data Controller shall retain Personal Data processed for Compliance purposes for the time provided for by specific legal obligations or by applicable legislation.
The Data Controller shall retain Personal Data processed for the purpose of preventing Abuses/Fraud for the time strictly necessary for such purpose, and therefore until it is required to retain it in order to protect itself in court and communicate it to the competent authorities.
The Data Controller shall retain the Personal Data processed for the purpose of Intra-Group Sharing for a period not exceeding 12 (twelve) months from receipt of the Application or the last update.
7 Your rights
Under Articles 15 and following of the GDPR, you are entitled to request from the Company, at any time, access to your Personal Data, correction or erasure of your Personal Data, as well as to object to its processing. You are also entitled to request the restriction of the processing of your Personal Data in the cases set out in Article 18 of the GDPR, as well as to obtain the Personal Data you have provided to the Company in a structured, commonly used and machine-readable format, in the cases set forth by Article 20 of the GDPR, as well as to oppose the processing of your Personal Data for the purpose of Intra-Group Sharing and to revoke your consent to the processing of your Special Personal Data provided for the purpose of Recruitment.
Requests must be sent in writing to the Data Controller at the following address: dpo-offerista@shopfully.com.
In any case, you are always entitled to lodge a complaint with the competent supervisory authority, under Art. 77 of the GDPR, if you believe that the Data Controller’s processing of your Personal Data is in violation of the applicable law.
8 Date
This Privacy Notice, as last updated, is in force from 03 July 2025.