Privacy Notice

Privacy Notice
At F. Hoffmann-La Roche Ltd and the legal entities of the Roche Group (hereafter “Roche”, “we”, us”), we take data privacy seriously and treat all your personal data in accordance with Roche General Privacy Policy and applicable privacy and data protection laws, including as applicable the Swiss new Federal Act on Data Protection (“nFADP”), the European Union General Data Protection Regulation (EU) 2016/679 (“GDPR”), the Personal Information Protection Law of the People's Republic of China (“PIPL”) and other applicable local laws that regulate the storage, processing, access and transfer of personal data.

This Privacy Notice (“Privacy Notice”) intends to explain how Roche collects and processes your personal data in the context of job application and recruiting related activities. The scope of this Notice is limited to the collection and processing of your personal data in the context of any job application and recruiting. For general information about data processing at Roche please visit the Roche Privacy Notice.
This Privacy Notice applies to you as a potential candidate (hereafter “you”,“candidate”,“data subject”) interested in a job at Roche.

Identity and contact details of the data controller
F. Hoffmann-La Roche Ltd and the respective recruiting legal entity of the Roche Group  process your personal data for application and recruitment purposes. F. Hoffmann-La Roche Ltd and respective recruiting legal entity hereby jointly determine the purposes and means of the data processing subsequently listed below and as such act as joint controllers in accordance with Art. 26 GDPR.

Contact details
Data subjects may contact F. Hoffmann-La Roche Ltd directly with any data subject requests as party in charge responsible for compliance with any data subject rights. 
You can therefore reach us at F. Hoffmann-La Roche Ltd, Grenzacherstrasse 124, CH-4070 Basel, Switzerland, email: global.privacy@roche.com.

However, data subjects may also assert their rights in relation to the processing of personal data under joint controllership towards the recruiting legal entity jointly responsible. A list of Roche’s affiliates is available in our business section of www.roche.com. 
F. Hoffmann-La Roche Ltd will, if this becomes relevant, align with the relevant recruiting legal entities on how to handle requests by data subjects in order to be able to answer the requests effectively.

In the event that your personal data is covered by the GDPR: 
The EU representative of F. Hoffmann-La Roche Ltd is Roche Privacy GmbH, Emil-Barell-Str. 1, D-79639 Grenzach-Wyhlen, email: eu.representative.privacy@roche.com.

In the event that your data is covered by the UK GDPR: 
The UK representative is Roche Products Limited, 6 Falcon Way, Shire Park, Welwyn Garden City, Hertfordshire AL7 1TW, United Kingdom, email: dpo.dpowelwyn@roche.com.

For United States (“US”) residents, the US Supplemental Privacy Notice provides the appropriate channels for contacting Roche with questions, requests, and inquiries in the scope of US state privacy laws.

In the event that your personal data is covered by the China Personal Information Protection Law (“PIPL”): Shanghai Roche Pharmaceuticals Co., Ltd., No. 1100 Longdong Avenue, Pudong District, Shanghai, email: cn.privacy@roche.com.

How and why we process your personal data
Roche processes your personal data for application and recruitment purposes (see below). Roche is therefore using a web-based application tracking system (Workday) and a candidate relationship management system (Phenom).

1. Job application and recruitment
In case you are interested in a position at Roche and apply to a dedicated job advertisement Roche processes your personal data for the application and recruitment process.
Categories of personal data processed include:
  • Name (mandatory)
  • Address (mandatory US & Canada only)
  • Contact details (email address and phone number are mandatory)
  • Nationality (mandatory Switzerland only)
  • Additional nationalities (optional, Switzerland only)
  • Gender (optional, US & Switzerland only)
  • Hispanic or Latino (optional, US only)
  • Race/ethnicity (optional, US only)
  • Veteran status (optional, US only)
  • Work experience (optional)
  • Education (optional)
  • Skills (optional)
  • Languages (optional)
  • CV/resume (mandatory)
  • Additional documents (other supporting documents are optional unless specifically requested within the job advertisement) 
  • Recorded video assessment files (if applicable) 
  • (mandatory unless an accommodation is requested)
  • Answers to application questions (if applicable)
  • (e.g. some questions may be mandatory and others optional depending on the questionnaire)
  • Notes (e.g. interview notes) (optional)
  • Scheduled interview details (optional)
  • Any other information you voluntarily share with us (e.g. including a photo within the CV) will be processed to the extent necessary to achieve the dedicated purpose outlined below

Purposes for processing:
We will process and store your personal data mentioned above in our systems during the application and recruitment process for the job advertised including background checks for the final selected candidate (if applicable as per country and stated in the job advertisement) and to communicate with you during the recruitment process. The data processing is necessary for assessment of fit against the job requirements. For the final selected candidate the processing is necessary in order to implement pre-contractual measures and for decision making on the establishment of an employment relationship.
Your data will also be used for recruitment related reporting and analytics.

Legal basis for processing:
  • Legal basis for EU countries and UK: Preparation of an employment contract, Art. 6 (1) (b) GDPR / UK GDPR
  • Legal basis for rest of world countries: Consent

Data retention:
Please find the applicable data retention period for the location of your application in Annex A.

2. Talent Community
In case you are interested in any future job advertisements by Roche, you may want to join our talent community (“Talent Community”). 
Roche processes your personal data in the Talent Community to be able to send you relevant job advertisements and to notify you about events related to working at Roche and other communications as part of marketing campaigns (see further information under 5. “Marketing Campaigns”).
Categories of personal data processed include:
  • First name (mandatory)
  • Last name (mandatory)
  • Email address (mandatory)
  • Phone number (optional)
  • Category (area of interest) (mandatory)
  • City (optional)
  • State (optional)
  • Location (mandatory)
  • Willing to relocate (optional)
  • Preferred location(s) (optional)

Purposes for processing:
We will process and store your personal data in our system in order to contact you about job advertisements that might match your preferences based on your joining of the Talent Community.  In addition, if you opted in to receive marketing email messages from us, we will use your personal data to send you marketing emails.
Your data will also be used for talent community related reporting and analytics.

Legal basis for processing:
  • Legal basis for EU countries and UK: Consent, Art. 6 (1) (a) GDPR / UK GDPR
  • Legal basis for rest of world countries: Consent

Data retention:
We will retain your data for 3 years after the last interaction with you unless you have requested for your data to be deleted. Upon receipt of your data deletion request your data will be deleted within 30 days.  Please refer to Annex A for any country-specific exceptions to the 3 year retention period.

3. Job alerts
You may want to be informed about upcoming job advertisements matching your preferences (“Job Alert”). Roche processes your personal data from the Job Alert to be able to send you relevant job advertisements.
Categories of personal data processed include:
  • Your search criteria (e.g. location, job category) (mandatory)
  • Email address (mandatory)

Purposes for processing:
We will process and store your personal data in our system in order to contact you about jobs that might match your interests.

Legal basis for processing:
  • Legal basis for EU countries and UK: Consent, Art. 6 (1) (a) GDPR / UK GDPR
  • Legal basis for rest of world countries: Consent 

Data retention:
We retain your personal data until you unsubscribe from your Job Alert(s).  
If you request for your data to be deleted, all Job Alerts will be canceled with your deletion request within 30 days.

4. Events
In case you would like to register for any upcoming events with Roche, Roche processes your personal data from an event registration form to be able to include you to the event planning and to send you reminders or follow up communication about the event (“Event(s)”) that you registered for.
Categories of personal data processed include:
  • Email address (mandatory)
  • First name (mandatory)
  • Last name (mandatory)

Depending on the Event Roche may request additional information relevant to that Event (e.g. for a university event we may ask what degree you are studying). Below are some examples of additional information that may be requested, optionally or mandatory, depending on the Event itself:

  • Current job title
  • Current company
  • CV/resume
  • Country
  • Highest education
  • Degree/certificate
  • Major/field of study
  • University
  • Native language
  • Skills
  • LinkedIn profile link

Purposes for processing:
We will process and store your personal data in our system in order to register your attendance for an Event and to contact you to send reminders or communication related to the Event you registered for. Your data will also be used for event related reporting and analytics.

Legal basis for processing:
  • Legal basis for EU countries and UK: Consent, Art. 6 (1) (a) GDPR / UK GDPR
  • Legal basis for rest of world countries: Consent

Data retention:
We retain your personal data for up to one month after the Event has taken place

5. Marketing Campaigns
In case you would like to be proactively contacted by Roche regarding e.g. potential job opportunities and newsletters about Roche (“Marketing Campaigns”) you can opt in either during the Job Application, Talent Community or Event registration process.
Categories of personal data processed include:
  • Email address (mandatory)

Purposes for processing:
We will process and store your personal data in our system in order to send you marketing campaigns

Legal basis for processing:
  • Legal basis for EU countries and UK: Consent, Art. 6 (1) (a) GDPR / UK GDPR
  • Legal basis for rest of world countries: Consent

Data retention:
You can unsubscribe from the Marketing Campaigns at any time via the unsubscribe link in the email. The retention of your personal data corresponds to either your Job Application, Talent Community and/or Event registration as stated above.
Your data will also be used for marketing campaign related reporting and analytics.

6. Cookies
For cookies please refer to our cookie notice.

Recipients of personal data
Your application and candidate profiles can be accessed by and transferred to other  Roche affiliates around the world. Our Roche affiliates will use your personal data for the same purposes as listed in the section above. A list of Roche’s affiliates is available in the our business section of www.roche.com. 

We may also share your personal data with other third parties, such as service providers and experts for technical maintenance of our platforms, support and consultancy services.
We, in particular, share your personal data with our internet-based recruiting system provider Workday Inc.,16 6230 Stoneridge Mall, Road Pleasanton, CA 94588, United States, and our internet-based career site and candidate relationship management system provider Phenom People Inc., 300 Brookside Avenue, Building 18, Suite 200, Ambler, PA 19002, United States.
In case a background check is part of the overall recruiting process, your personal data may be shared with a respective third party service provider subject to a separate privacy notice provided to you in the third party service provider tool.

Additional information in case your personal data is covered by EU GDPR, UK GDPR or Swiss nFADP:
It is possible that in the exchange of data within Roche, with business partners and with service providers, your personal data may be transferred to countries that do not provide the same level of protection as your own. In this case contracts containing the EU Standard Contractual Clauses according to the EU Commission decision of 04 June 2021 (EU 2021/914), and the UK and Swiss supervisory authorities’ decisions constitute appropriate and suitable safeguards to ensure compliance with EU GDPR, UK GDPR and the Swiss nFADP.

For all other countries Roche is ensuring compliance with the local applicable rules and regulations on the cross-border transfer of personal data. Roche is applying legal, technical and organizational measures to ensure the members of the Roche Group and all partners we collaborate with ensure the same consistent, high level of data protection globally. We are continuously monitoring legal developments in this area and adjust our processes if and as required.

Information about your rights
In accordance with EU GDPR and UK GDPR please note that you have the right to request from Roche access to and rectification of your personal data as well as the right to data portability, if applicable, or erasure or restriction of processing of your personal data. Erasure or restriction of processing is only possible if and to the extent the processing of personal data is based on consent or legitimate interest. 

In accordance with the Swiss nFADP please note that you have the right to request from Roche access to your personal data, a copy of your personal data, to rectify your personal data or to have Roche register a note dispute. Additionally, you have the right to erasure or anonymisation of your personal data if it is no longer needed for the purpose for which you provided it, and the right to restrict the processing of your personal data to specific purposes if erasure is not possible. 

In accordance with the Chinese PIPL you have the right to know what personal data Roche collects about you, the right to request from Roche access to and rectification of your personal data as well as the right to data portability, if applicable, or erasure or restriction of processing of your personal data. 

If any data processing is based on your consent, kindly note that you have the right to withdraw your consent at any time, however, without affecting the lawfulness of processing based on consent before its withdrawal. 
If you would like to contact us to exercise your right to withdraw consent, please see our contact details in the section “Identity and contact details of the data controller”.
We will delete your personal data when you have withdrawn your consent unless other legal grounds apply. If the latter is the case, we will delete your personal data once the other legal grounds cease to apply.

If you have applied for a job and would like to request for your data to be deleted, please log in to your candidate account and visit your account settings and request for your personal data to be deleted.

If you have joined our Talent Community or set up Job Alerts but have not applied for a job you can request for your personal data to be deleted via the Personal Information page at the bottom of our career site.
In the event you have the impression that our data processing is non-compliant with applicable privacy laws you are entitled to lodge a complaint with the responsible supervisory authority.

Amendment to our Privacy Notice
We may update our Privacy Notice from time to time. Updates of our Privacy Notice will be published via link on our Roche career site. Any amendments become effective upon publication on our Roche career site. We therefore recommend regularly visiting this Privacy Notice to keep yourself informed and up to date.