Recruitment Privacy Notice - Austria

At Central European University (address: 224 West 57th street, New York, NY 10019, USA and Quellenstrasse 51, 1010 Vienna, Austria) and Central European University Private University (address: Quellenstrasse 51, 1010 Vienna, Austria) (hereinafter referred to as CEU) we place great emphasis on the protection of your personal information and compliance with the applicable data privacy requirements, including specifically the EU General Data Protection Regulation (GDPR)*.

This Privacy Notice relates to the collection, use, transfer, and retention of your personal data during the recruitment/selection process of CEU. 

*Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

1. Who are we and what do we do

Central European University (CEU) is a graduate institution of advanced research and teaching, dedicated to socially and morally responsible intellectual inquiry. The University is accredited by the Middle States Commission on Higher Education in the United States with a teaching site in Vienna. 

Central European University Private University (CEU PU) is established in Vienna under the Austrian Federal Act on Private Universities.

At CEU both faculty and staff positions are filled by an open search.  

As part of the recruitment/selection process, we collect personal data relating to job applicants. The majority of the information we collect is obtained directly from you. We may also collect personal information from other external third parties, such as a recruitment agency (it must provide the applicant with a privacy notice) or referees named in your application.

Central European University and Central European University Private University qualify as joint data controllers according to Article 26 of the GDPR (the “Joint Data Controllers”).

The recruitment process of the Joint Data Controllers is managed by the staff of Közép-európai Egyetem.  

2. Contact details of the Joint Data Controllers

Central European University
224 West 57th street
New York
NY 10019, USA 


Central European University Private University
Quellenstrasse 51
1100 Wien, Austria

Data Protection Officer:

3. What kind of personal data do we collect? What is the purpose and legal basis for processing your data?

Data category

Purpose of data processing

Category of personal data Special category of personal data Legal basis CEU Legal basis CEUPU
Contact details

Communicating with applicants

Name, contact details (e-mail, phone number, address)

No Legitimate interest Legitimate interest

Application package

Collecting applications

Sharing applications with the selection committee members

Reviewing, evaluating applications

Application package 

(CV, photo (if you submitted it as part of your CV), 

cover letter, name, place and date of birth

  • citizenship, current and previous employment details
  • academic/educational background
  • Gender 

languages spoken, other information requested or you wish to submit)

Additional information for academic positions: list of publication, sample publication, research and teaching plan, sample course syllabus, 

teaching evaluations

Legitimate interest Legitimate interest
Disability (if applicable)

Providing equal treatment and assistance

Disability  information

Yes Consent Consent
Short list

Creating a short list of candidates

Name, contact details

Legitimate interest Legitimate interest

Interviewing and identifying candidates

Application package, notes from face to face interviews

Legitimate interest Legitimate interest

On-site visit (faculty positions)

Conducting candidate visits, meetings, lecture and interviews

Information on your visit (invitation to an interview, administration of travel and accommodation, organizing meetings, lecture)

No Legitimate interest Legitimate interest

Reference letters (faculty positions)

Learning more about the candidate

Name, contact details, letter’s content

No Legitimate interest Legitimate interest

Contact details of referees (administrative positions)

Obtaining a reference

Name, contact details

No Legitimate interest Legitimate interest


Selecting a candidate for the position

Name, information collected during the selection process

No Legitimate interest Legitimate interest

Application package

Retaining and considering the application package for another open position availbale at CEU

Application package (see above)

Consent Consent

Please consult the advertisement about the personal information you need to submit. In case you send us more data than requested, it will also be processed according to the rules defined in this notice. 

Before you pass on a referee’s details to us, please make sure you get their consent to do so. 

 4. Who receives your information?

The Human Resources Office of Közép Európai Egyetem will share your application only with the person(s) responsible for the selection procedure in the Department/Unit and the selection committee members. Unless we have a legal obligation to do so, we will not disclose your data to a third party. 

Specific third parties acting as data processors based on a data processor agreement we work with include:  

  • Közép-európai Egyetem: Qualifies as data processor of Central European University and Central European University Private University. 
  • For the purposes set out in section 4, we may need to pass your information to our third-party service providers, e.g. external committee members, for the purposes of completing tasks and providing services on our behalf. However, with all external parties with whom data is shared, we share only those data needed to perform the specific service and require a data processing agreement to be signed before any data transfer. We require all third parties and data processors to respect the security of your personal data and to treat it in accordance with the law and CEU’s data privacy policies, as determined in the respective Data Processing Agreement.

Qualify as data processor of Közép-európai Egyetem:

  • Office 365: Based in the US, with CEU’s data stored within EU in data centers located in Amsterdam and Dublin. Software as a Service which provides CEU’s email and document management.

5. How long will your information be held?

We’ll delete the unsuccessful candidates’ data and shred the hard copies 8 months after the selection process has been closed. 

The short-listed candidates’ data will be stored for 8 months after the selection process is closed and will be deleted/shredded afterwards.

We’ll keep the personal data of a referee for as long as the candidate’s data for whom he/she was a referee is kept.

Where processing is based on your consent, after you withdraw your consent or object to data processing, we will process your personal data for a maximum of 25 (twenty-five) days for technical reasons. In the absence of withdrawal or objection and after data processing periods mentioned above, we shall delete your personal data from our system, unless data processing has a further legal basis.

If you accept an offer of employment by us, any relevant personal data collected during the recruitment/selection process will become part of your personal record in accordance with the Employee Privacy Notice. 

6. What are your rights?

You have a right:

  • to access your personal information – you can obtain a confirmation that we are processing your data and information how we process it. We suggest that you make a request in writing.  
  • to object to the processing of your personal information – this allows you to ask us to stop processing your data at any time. Where we rely on legitimate interest, you must give specific reasons why you are objecting the processing of your data. In this case this is not an absolute right, we can demonstrate compelling legitimate grounds for processing, which override your interests, rights and freedoms. Where we are processing personal data for scientific or historical research, or statistical purposes, you only have a right to object if our lawful basis for processing is legitimate interest. 
  • to rectify – you have a right to have your personal information corrected if it is inaccurate and to have incomplete personal information completed
  • to erase (also known as the right to be forgotten) – in certain circumstances you can ask for the data we hold about you to be erased from our records. Your personal data will be erased where the data are no longer needed for their original processing purpose, or you have withdrawn your consent and there is no other legal ground for processing, or you have objected and there are no overriding legitimate grounds for the processing, or erasure is required to fulfill a statutory obligation under the EU law or the right of the national law. 
  • to request data portability – you can ask to have the data we hold about you transferred to another organisation.
  • to restrict processing your personal information – where certain conditions apply, you have a right to restrict the processing of your personal information. 
  • to withdraw your consent at any time – without affecting the lawfulness of processing based on consent before its withdrawal.

If you wish to exercise any of these rights, please email or write to us at Central European University, Kohlmarkt 8-10, 1010 Vienna, Austria.

We will make every effort to fulfill your request to the extent allowed by law and will respond in writing within 25 days of receiving your request.

Should you wish to request help from the relevant national authority, the details are as follows:

Österreichische Datenschutzbehörde
Barichgasse 40-42,
1030 Vienna
Telephone: +43 1 52 152-0

In addition to the legal remedy, you have the right to apply to the court against the activities of the CEU. 

7. Security of your information

We are committed to holding your data securely and treating it with sensitivity. All data are held securely and in accordance with the relevant data privacy laws and our internal policies. We do not sell to or trade your data with any other organizations. For further details please see CEU’s Data Protection Policy.

8. Future changes

If our information policies or practices change at some time in the future, we will post the changes on our website.

Last updated on: March 14, 2023