Data privacy policy

WU Data Protection Statement for Job Applicants

In this Data Protection Statement, WU (Vienna University of Economics and Business) informs job applicants about the processing of personal data as part of recruitment, selection, and hiring procedures at WU. WU is the controller responsible for these data processing activities.

Purposes of data processing activities

When you apply for a position at WU – via the online job application tool, by email, or by mail – WU processes the personal data you provide for recruitment and hiring purposes, i.e. for filling either a specific, advertised vacancy that is referenced in the application or other open positions at WU in general. In addition, your data may also be processed for the evaluation of WU’s selection procedures and for statistical purposes.

In the event that the application is successful, WU will further process the data for purposes related to the employment relationship.

Types of data, required Information

The information that applicants are required to provide is indicated specifically in the online form, or is specified in the position announcement. In general, this includes information about the identity of the applicant, contact details, and the required application documents, e.g. the cover letter, résumé/CV, and relevant certificates. In addition, applicants can also provide optional information about themselves.

Legal basis of data processing activities

a. Consent (Art. 6 [1] item a of the GDPR, Art. 9 [2] item a of the GDPR)

If you submit your application via an online application tool, you will be asked to consent to the processing of your personal data. Without storing and processing your data electronically, it is not possible to process your application. This means that your consent to data processing is required when submitting your application. You have the right to withdraw your consent at any time, thereby also withdrawing your application. However, any processing of your data which occurred before consent was withdrawn remains legal and unaffected. If you withdraw your consent, your data will be deleted, unless WU is bound by a legal obligation to retain the data.

If you voluntarily provide any special categories of personal data within the meaning of Art. 9 (1) of the GDPR (sensitive data such as information about your health) as part of the application procedure, these data are processed based on your explicit declaration of consent pursuant to Art. 9 (2) item a of the GDPR.

b. Taking steps prior to entering into a contract (Art. 6 [1] item b of the GDPR)

If you submit your application by email or mail, processing of your data is required for WU to be able to process your application and carry out the selection procedure.

c. Compliance with a legal Obligation

In some cases, WU is legally obligated to process applicants’ personal data, especially in the context of selection proceedings for senior faculty positions, which are regulated by the Universities Act (Universitätsgesetz, UG; cf. §§ 98 ff. of the UG).

d. Overriding legitimate interests of WU (Art. 6 [1] item f of the GDPR)

The processing of applicants’ data is necessary for purposes of WU’s overriding legitimate interests, namely carrying out balanced and fair selection procedures to find the applicant who is best suited for the position, taking into account considerations of equal opportunities and diversity, avoiding discrimination, and evaluating the selection procedures on a regular basis.

Data recipients

As a rule, your application data are only forwarded to the WU organizational units that are directly involved in the specific recruitment procedures and, if necessary, to external reviewers used by WU, external Search Committee members (pursuant to § 98 of the Universities Act), or human resources consultants. W[SB1] U will not usually disclose any personal data to third parties (except processors acting on WU’s behalf), with the exception of public authorities, courts, and lawyers as part of ongoing legal proceedings (e.g. in cases of alleged discrimination) or cases where WU is obligated by law to disclose personal data.

WU’s online job application tool is provided by an external IT services provider, rexx systems GmbH, Süderstraße 75, 20097 Hamburg, Germany. Once you have entered and submitted your data, they are transmitted to the server of the IT services provider via an encrypted connection. The processor processes the data exclusively on behalf of WU and in accordance with WU’s instructions.

Storage period

Applicants’ personal data are stored for up to seven months after the end of the application procedure and the issuance of a notification should the application be rejected. In the event of any ongoing court proceedings or legal proceedings carried out by public authorities, the data are stored beyond this period, until the end of said proceedings.

If an employment contract is to be concluded with an applicant, his or her personal data will be further processed for purposes of human resource management.

After the end of the application procedure, applicants who have not been selected for the advertised position are asked for separate consent to allow WU to store their application documents and consider them for positions that may need to be filled in the future.

Any bills and receipts for potential refunds of travel expenses are stored in accordance with the applicable provisions under tax law.

Data subject rights

Pursuant to the applicable data protection legislation, in particular Articles 15 to 21 of the EU General Data Protection Regulation (GDPR), data subjects at all times have the following rights regarding their personal data:

  • The right to gain access to and information about their personal data used for processing
  • The right to rectification of inaccurate data and completion of incomplete data
  • The right to have personal data deleted. However, in certain cases specified by the law, this right may be limited by statutory data retention periods WU is subject to, archiving purposes in the public interest, or purposes of academic or scientific research.
  • The right to restriction of data processing
  • The right to receive the personal data in a structured, commonly used, and machine-readable format (right to data portability)
  • The right to object to the processing of personal data on grounds relating to the data subject’s particular situation. This only applies under the condition, however, that the data are processed for the performance of a task carried out in the public interest or in the exercise of official authority or based on a balanced consideration of interests. In the event of an objection, WU will stop processing the personal data in question, unless WU is able to demonstrate compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject or for the establishment, exercise, or defense of legal claims.
  • The right to object to the processing of personal data for purposes of direct marketing. In the event of an objection to direct marketing, WU will stop processing the data subject’s personal data for these purposes. 

For requests to exercise any of these rights, please refer to the “Contacts” section below.

Data subjects who feel that their rights have been violated or that WU has violated its obligations under data protection law can file a complaint with the appropriate supervisory authority. In Austria, the appropriate supervisory authority is the Austrian Data Protection Authority, Wickenburggasse 8, 1080 Vienna.


If you have any questions or requests regarding the application procedures, please contact the WU Personnel Office. For specific questions regarding data protection, you can contact or WU’s Data Protection Officer at Additional contact information is available on the WU website at  
Vienna, May 8, 2019