Last revised: November 16, 2018

The local Coca-Cola entity ("us" or "we") which seeks to fill a position for which you have applied and which would be the employing entity in case you were offered employment, will, as a rule, be the controller (within the meaning of EU Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data, and repealing Directive 95/46/EC, hereinafter referred to as the "GDPR"), responsible for the processing of your personal data described in this Recruitment Notice. Exceptions are set out in section VIII.

We are committed to protecting the privacy of anyone who applies for employment with us.

We set out below information regarding our collection, analysis, disclosure and other processing of your personal data during the recruitment process with us. If you are offered and accept employment with us, we will collect more information about you and make other uses of your information – this will be explained to you as part of the onboarding process and be addressed by a separate notice, the General Data Protection Notice to Employees if the case arises, and you will then also be provided with further data protection notices setting out additional information on individual processing activities, such as processing of your personal data in the context of performance management tools and performance management processes, if and as applicable.

Nothing in this Data Protection Notice (the "Notice") shall be construed as an offer of employment or other contract with any entity of the TCCC Group. It is for information purposes under the GDPR.

I. Which personal data do we collect and process for the purposes of the recruitment process?

The following categories of personal data are collected and processed in connection with your application:

1. personal data as required to identify and contact you during the recruitment process: name (given and family name), contact details (address (street, street no., postal code, city), e-mail address and phone number with country code), country (from drop-down menu);

2. eligibility to work in the country where the job is located (by confirming through a yes or no answer);

3. the role or roles for which you are applying or being considered and your relevant skills;

4. what is your highest level of education completed (options from drop-down menu);

5. chosen username and password for the online platform through which we run the recruitment process (Workday);

6. how you heard about us (options from drop-down menu);

7. whether you have any relatives and/or friends employed at The Coca-Cola Company (options yes/no; if yes, you are asked to provide the names of your friends or relatives);

8. whether you currently work for The Coca-Cola Company as a leased or contract employee or an employee of a subsidiary, Bottling partner or affiliate of the Company (options from drop-down menu);

9. whether you have you ever worked for The Coca-Cola Company or any of its subsidiaries or Bottling partners (options from drop-down menu; voluntary: if you have been previously employed, you are asked to list dates and locations).

The following information is collected on a voluntary basis in the online application process:

10. what type of employment you prefer (options from drop-down menu);

11. when your available start date is (selection from calendar);

12. work availability (click options, such as weekends, early shift, etc.);

13. what percentage you are willing to travel;

14. whether you are willing to relocate;

15. work experience: job title (free text), company (free text), location (free text), from date (date), to date (date, or I currently work here checkbox option), role description (free text); references from previous employers;

16. education: school or university (free text), degree (options), field of study (options), overall result (GPA) free text), from date (date, year), to date (date, year);

17. skills (free text);

18. websites (format http://);

19. proof of academic title (if you choose to upload it on the career site, which is fully optional);

20. other information about yourself that you provide in a CV if you choose to upload a CV;

21. whether you would like to be considered for alternative positions (options yes/no);

22. family name prefix.

To the extent you decide to disclose the following information in a potential job interview, we will also process the respective items of personal data for the purposes of the recruitment process:

23. skills and career aspirations and plans;

24. other information that you provide upon request around your expected employment benefit package, including (base) salary, short term incentive, long term incentive, options, car allowance, expense allowances, pension schemes, healthcare benefits and other employment benefits;

25. further information you may decide to disclose;

26. information as observed by interviewers in any such interview, such as communication style, tone, engagement, personality traits, leadership skills, management skills to the extent apparent from the interview and relevant to your recruitment.

In individual countries, you may be asked to provide

27. contact details of providers of references and the respective references where this is, pursuant to local law, legitimate and practiced. In this case, you will be provided with further information.

If you qualify for travel or other expense reimbursement, we may also ask you to provide 

28. your bank account details for the purpose of travel expense reimbursement.

We ask that you do not provide:

29. your gender (this information may, however, nevertheless become apparent from your name or otherwise (e.g. in an interview));

30. a photograph of yourself;

31. any sensitive personal data (see section III below for a description of what is considered sensitive personal data).

If CVs or similar correspondence containing personal data are sent to us on an unsolicited basis it is our policy to delete the respective records once the recruitment cycle for the/such a position has been completed, or your application has been rejected and the time limits for potential antidiscrimination or other employment-related claims under local law following such a rejection have lapsed or earlier, if shorter periods are required by our TCCC Record and Data Retention Policy, or, in case your application is successful, to retain personal data as long as is required in line with the TCCC Record and Data Retention Policy.

II. For which purposes do we process your personal data and on which legal bases?

We process your personal data to attain the following purposes and on the following legal bases:

Except in those cases where we indicate expressly that the provision of information is purely voluntary you should assume that we process it for the purposes of the recruitment process, and that failure to supply the personal data required may mean that we are unable to consider your application for recruitment.

Specifically, we require the data items listed in section I 1 for the purpose of contacting you during the recruitment process (legal basis: legitimate interest to recruit) and those in section I 2-4; 8; 9 for the purpose of making a decision on the establishment of an employment relationship (legal basis: legitimate interest to recruit and to adequately source our organization).

We require the data items listed in section I 5 for the purpose of efficiently carrying out our recruitment process through the Workday platform and those listed in section I 6 for the purpose of improving our recruitment process (legal basis: legitimate interest to efficiently manage our operation).

We require the data items listed in section I 7 for reasons of compliance with our internal policies on impartiality in the selection process (legal basis: our legitimate interests to protect our reputation and that of TCCC and the TCCC Group and to follow consistent Compliance standards and policies across the TCCC Group on the selection of candidates).

If you do not provide the personal data items listed in section I 1-9 above, we will not be able to consider your application for the job(s) you apply for or otherwise, apart from the case of non-provision of the information on the dates and locations of previous employment, which is voluntary. In cases where employment has not yet commenced, failure to provide information requested and not expressly referenced as voluntary may lead to the withdrawal of an offer of employment/engagement.

If you provide the information listed in section I 10- 22 (22: in case of academic title); 23; 25-27 this will help us better assess your qualifications for the role, and to assess which additional skills would have to be acquired on the job if you were chosen for the role, and we will process the respective information for the purposes of the recruitment process (legal basis: our legitimate interest to acquire suitable talent for positions and to effectively manage our recruitment process, and to make an informed decision on your recruitment). If you decide not to provide the personal data items listed in section I 10-22; 23; 25-27 (27: where locally applicable) we may not be fully aware of and take into account your skills for the purposes of the recruitment process, which may negatively impact on your chances of recruitment for a position. Non-disclosure of information pursuant to I 25 or 28 will not have any consequences on the recruitment process.

Information provided pursuant to section I 10-17; 23; 24; 25; 26 may furthermore be processed to assess the suitable type of employment contract and contract features, salary and benefits range and salary and benefits negotiations during the onboarding phase based on legitimate interests (legal basis: legitimate interest to efficiently manage our operation and to recruit and to adequately source our organization).

We require the information pursuant to section I 28 if you request reimbursement for expenses, such as travel expenses where a right to such reimbursement exists (legal basis: compliance with legal obligations).

We will not, as part of our decision-making on whether to offer you employment, consider your gender or photograph (I 29; 30). Where a photograph is provided on an unsolicited basis, we will not take this photograph into account for the purposes of your application and will retain it only in line with the TCCC Record and Data Retention Policy.

We furthermore process your personal data as provided by you during the recruitment process for the following legitimate interests (art. 6 para 1 (f) GDPR):

1. monitoring our recruitment processes, including for statistical and survey purposes in order for us to e.g. gain insight in the effectiveness of the recruitment process, the duration of the process, number of applicants etc. (legal basis: legitimate interest to efficiently manage our operation and the recruitment process);

2. managing and improving the recruiting process of internal and external candidates, including reviewing and posting job requisitions; scheduling of interviews etc. (legal basis: legitimate interest to efficiently manage our operation and continuously improving the recruitment process); 

3. accounting, tax and finance and operational management for the purposes of and beyond statutory obligations for material business and financial interests of us or those of the TCCC Group, including us, e.g. personnel cost and strategic succession planning (legal basis: legitimate interest to efficiently manage our business, costs and the recruitment process, apply consistent, standard accounting, tax and financial process management);

4. safeguarding interests of the TCCC Group, including us, in- or outside of court, such as in case of potential claims of applicants (legal basis: legitimate interest to assert and defend our legal interests and those of the TCCC Group in- and outside of courts);

5. ensuring the functioning, efficiency and integrity of the TCCC Group's, including our, IT systems (legal basis: legitimate interest to efficiently manage our operation and to protect the functioning and integrity of our IT systems); and

6. ensuring the security of the premises and protecting our property and that of the TCCC Group (which may concern you when you come in for an interview, for example, such as open CCTV surveillance of entrance areas; logging of access to secured doors with visitor access badge) (legal basis: legitimate interest to ensure the safety of our employees and premises, protect our property).

As a general rule, the Company does not rely on your consent to justify its processing of your personal data. If we do need your consent in any particular case we will ask you for it – you are not obliged to consent and, if you do consent, you can withdraw it at any time.

III. Which sensitive personal data do we collect and process and on which legal bases?

We will not ask you for any special categories of personal data within the meaning of Art. 9 para 1 GDPR (so-called sensitive personal data) during the recruitment process. Sensitive personal data is data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health or data concerning your sexual orientation.

If, however, you have made any such sensitive personal data manifestly public to us (e.g. by including in your CV or cover letter that you have a (severe) disability – which we ask you not to do), the respective sensitive personal data will be retained and erased in accordance with our TCCC Record and Data Retention Policy. 

IV. Where do we collect your personal data from?

We mainly collect personal data directly from you during recruitment (e.g., in the form that you are asked to complete on Workday during the recruitment process, or in interviews, or, through assessment tests (for certain positions you may be asked to participate in role-playing exercises based on fictional use cases to review your skills and qualifications for the role you apply for).

Other information is generated automatically when you use or otherwise interact with our IT systems (for example, when you log into the Workday environment to submit your application).

Further information may be provided to us by third parties (for example, recruitment agencies, referees or educational institutions you have pointed out to us for this purpose (subject to local law)).

V. How long do we store your personal data?

The personal data processed for the purposes described in the Recruitment Notice will be retained in accordance with the TCCC Record and Data Retention Policy.

Therefore, we will generally retain your personal and, if applicable (see section III above), sensitive personal data throughout the recruitment cycle. Some information will be retained after the recruitment cycle ends, either because local tax or other laws require us to do so, because you are employed or otherwise engaged by us or, to defend in an employment/recruitment-related dispute.

VI. Who has access to your personal data, including from outside the European Economic Area?

1. The prospective employer

At the prospective employer, your personal data will be processed by the prospective employer's HR function for the purposes described in sections II and III, and, where required for the purposes listed in section II, also by your prospective line manager, indirect managers, the prospective employer's legal department (e.g. to the extent required in an employment/recruitment-related dispute). 

2. TCCC Group

Your personal data may, for the purposes outlined below, also be processed by other TCCC Group entities on behalf of your prospective employer as follows to allow the prospective employer for the legitimate interest of effectively carrying out the recruitment process, or to take steps at the request of the data subject prior to entering into a contract):

(a) If you the position you are applying for is located at Coca-Cola Midi S.A.S., Zone d'activities, Avenue de Berlin, 83870 Signe, France, please go straight to section 2 (d).

(b) If the position you are applying for is located at European Refreshments, Southgate, Drogheda, County Meath, Ireland, A92YK7W and work at Athy International Concentrates Ballina Beverages or the Flavour Manufacturing Wexford, the following sections 2 (a) and 2 (c) do not apply to you. Please go straight to section 2 (d).

If the position you are applying for is located at European Refreshments in Dublin operating under the business name Coca-Cola Ireland or European Refreshments in Drogheda, sections 2 (c) and (d) will apply to you in relation to the processing of your personal data on behalf of the prospective employer by Coca-Cola Poland Service Sp. Z.o.o., Al. Armii Ludowej 26, 00-609 Warsaw, and Coca-Cola Far East Limited (Philippines), 24th floor, Net Lima Bldg, 26th street corner 5th Avenue, Bonifacio Global City, 1634 Taguig, Philippines (not located in the E.E.A.; please see section VII below in relation to the international transfer for processing by Coca-Cola Far East Limited (Philippines)).

(c) If you are applying for a position at any other prospective employer located in the E.U. or referred to this section under section 2 (b), the following applies:

The prospective employer will have typical HR functions, including aspects of the recruitment process, performed on its behalf by European Refreshments, an Irish company, with its office located at Southgate, Drogheda, County Meath, Ireland, A92YK7W, Ireland which may further occur through its subprocessors Coca-Cola Poland Service Sp. z.o.o., Al. Armii Ludowej 26, 00-609 Warsaw, Poland, and Coca-Cola Far East Limited (Philippines), 24th floor, Net Lima Bldg, 26th street corner 5th Avenue, Bonifacio Global City, 1634 Taguig, Philippines (not located in the E.E.A.; please see section VII below in relation to the international transfer for processing by Coca-Cola Far East Limited (Philippines), as subprocessors of European Refreshments; in case of employees of European Refreshment, processor, respectively) who processes your personal data as required for the purposes of:

  • Assistance to line managers with recruitment and onboarding (legal basis for processing: legitimate interest to efficiently manage the recruitment process (in relation to the transfer to Coca-Cola Far East Limited, please see section VII below));
  • Production of documentation for the prospective employment relationship, such as employment contracts (legal basis for processing: taking steps at the request of the data subject prior to entering into a contract (in relation to the transfer to Coca-Cola Far East Limited, please see section VII below)).

(d) The following other entities of the TCCC Group located in the European Economic Area may access your personal data as required to process personal data on behalf of the prospective employer for the legitimate interest of the prospective employer to make the decision on the establishment of an employment relationship or efficiently manage the recruitment process or to comply with legal obligations, such as pursuant to employment and social security law:

  • HR function located at Beverage Services Limited, 1A Wimpole Street, London, W1G 0EA in the UK for the purposes of employee relations case management (legal basis for processing: our legitimate interest of efficiently managing the recruitment process);
  • HR function located at TCCC in the U.S. for the purposes of statistical analysis (surveys) validating current HR processes and tools in support of decision making aimed at enhancing the workplace (legal basis for processing: our legitimate interest of efficiently managing and continuously improving the employment process);
  • HR function located at Coca-Cola Poland Service Sp. z.o.o., Al. Armii Ludowej 26, 00-609 Warsaw, Poland for the purposes of travel booking, expense processing, travel cost reimbursements, and travel data consolidation and reporting (legal basis for processing: compliance with a legal obligation if reimbursement mandatory pursuant to local law, or tax/social security provisions apply requiring the respective processing; otherwise, legitimate interest to efficiently manage the recruitment process).

3. Other third parties processing your personal data on behalf of the prospective employer

Outside the TCCC Group, the following categories of recipients will have access to all or parts of your personal data, limited to and subject to the purpose of the processing activities they are engaged for the prospective employer for the legitimate interests listed below:

1. Recruitment agencies working with us in relation to your recruitment (legal basis for processing:  legitimate interest to recruit and to efficiently manage the recruitment process; legal basis for international transfer: see section VII below);

2. Workday, Inc., a provider of cloud-based software solutions for financial and personnel management, a Delaware Corporation with offices located at 6230 Stoneridge Mall, Pleasanton, CA, 94588, U.S.A., using for this purpose its servers located in the U.S.A., as well as its subsidiaries and various sub-contractors (e.g. computer centers) located in- and outside of the European Economic Area (legal basis for processing: legitimate interest to efficiently manage the recruitment process; legal basis for international transfer: see section VII below);

3. Providers of leased employees, such as Randstad NV, Rue de Princes, 8-10, 1000 Brussels, Belgium, which support the recruitment process and have access to your personal data for the purposes of the recruitment process as set out in this Notice (legal basis for processing: our legitimate interest to efficiently run the recruitment process);

4. Other service providers, such as Salesforce, Inc., 415 Mission Street, 3rd Floor, San Francisco, CA  94105, USA which process personal applicant data on TCCC's behalf to support the recruitment process, such as in Salesforces' case, by providing a cloud-based application to control workflow (creation of ticket/case to notify payroll of new hire details for payroll setup)), (legal basis for processing:  legitimate interest to efficiently manage the recruitment process; international transfer: see section VII below);

As the U.S.A. and other non-E.E.A. countries do not ensure an adequate level of data protection, our data transfers are based on the implementation of standard data protection clauses adopted by the EU Commission under article 46 paragraph 2 of the GDPR (click here to access the EU Commission's decision on standard contractual clauses for transfers to processors).

To obtain any relevant information regarding any transfers of your Personal Data to the U.S. (including the relevant transfer mechanisms), please contact privacy@coca-cola.com.

VII. International Data Transfers to Processors outside of the European Economic Area

Where we transfer your personal data to other members of the TCCC Group or other third parties as processors as described under section VI above, we do so in accordance with applicable law, including (i) to Canada (for Workday) which is deemed to ensure an adequate level of protection under article 45 of the GDPR and (ii) on the basis of standard data protection clauses adopted by the EU Commission under article 46 paragraph 2 of the GDPR (click here to access the EU Commission's decision on standard contractual clauses for transfers to processors established in third countries), in case of transfers of personal data to countries that do not ensure an adequate level of data protection. This will include transfers to TCCC in the United States of America, members of the TCCC Group that are located outside of the E.E.A., such as Coca-Cola Far East Limited (Philippines), 24th floor, Net Lima Bldg, 26th street corner 5th Avenue, Bonifacio Global City, 1634 Taguig, Philippines who processes your personal data as required for the purposes of recruitment set out in section II and section VI 2 (c) and Workday (United States of America).

If you would like to obtain any relevant information regarding any transfers of your personal data to countries that do not ensure an adequate level of data protection, please contact privacy@coca-cola.com.

VIII. International Data Transfers to Controllers outside of the European Economic Area for their own purposes

Where we transfer your personal data to other members of the TCCC Group or other third parties for their own purposes, we do so in accordance with applicable law, including on the basis of standard data protection clauses adopted by the EU Commission under article 46 paragraph 2 of the GDPR (click here to access the EU Commission's decision on standard contractual clauses for transfers to controllers), in case of transfers of personal data to countries that do not ensure an adequate level of data protection.

This will namely include transfers to

  • IT functions at TCCC in the U.S. for the purpose of monitoring and improving our recruitment processes (legal basis for processing: legitimate interest to efficiently manage and continuously improve the recruitment process; legal basis for transfer: see beginning of this section VIII);
  • Legal, IT and Compliance functions located at TCCC in U.S. and for the purposes of ensuring strategic security and information risk management and Compliance functions (legal basis for processing: legitimate interest to protect the integrity of our IT systems and other property, as well as conduct consistent, effective information risk management across the TCCC Group; legal basis for transfer: see beginning of this section VIII)
  • the Global Shared Services at Coca-Cola Far East Limited, Philippines, for the purpose of recruitment operations, including assistance to line managers with recruitment and onboarding (legal basis for processing: legitimate interest to efficiently manage the recruitment process; legal basis for transfer: see beginning of this section VIII) and production of documentation for the prospective employment relationship, such as employment contracts (legal basis: taking steps at the request of the data subject prior to entering into a contract; legal basis for transfer: see beginning of this section VIII);
  • third parties to whom the prospective employer is required to disclose information by law or regulatory requirement (including litigation counterparties) (legal basis for processing: compliance with legal obligations of the prospective employer; legal basis for transfer: see beginning of this section VIII);
  • competent regulatory and prosecuting authorities, including courts in case of litigation involving the prospective employer or TCCC Group (legal basis for processing: legitimate interest to assert and defend the rights and interests of the Employer, of TCCC and the TCCC Group; legal basis for transfer: see beginning of this section VIII);
  • If you refer us to potential referees, we may, subject to local law, disclose the fact that you are applying to work with us to them when we ask them for references (legal basis: subject to local law, this may be consent (in which case we will approach you separately) or the legitimate interest to make an informed recruitment decision).

If you would like to obtain any further information regarding any transfers of your personal data to countries that do not ensure an adequate level of data protection, please contact privacy@coca-cola.com.

IX. Rights and Questions

1. What are your rights?

Subject to the relevant legislative provisions, you have the following rights: 

1. the right to obtain confirmation as to whether or not your personal data are being processed and, where this is the case, access to the personal data and information (Article 15 GDPR)

2. the right to rectification of your personal data (Article 16 GDPR)

3. the right to obtain the erasure of your personal data in accordance with Article 17 GDPR ("right to be forgotten")

4. the right to obtain restriction of processing (Article 18 GDPR)

5. the right to data portability in accordance with Article 20 GDPR

6. the right to object to the processing of your personal data necessary for the purposes of legitimate interests or of a task carried out in the public interest or in the exercise of official authority vested in the controller (Article 21 GDPR).

2. How can you exercise those rights?

To exercise these rights, please contact talentacquisition-emea@coca-cola.com for further contact information.

3. Whom can you contact about this Notice?

To see copies of any of the agreements referred to in sections VI, VII or VIII or address other questions about our processing of your personal data or related policies, please contact privacy@coca-cola.com.

4. How can you contact the Data Protection Officer?

You can contact the Data Protection Officer (DPO) at the following address:

Sandra Mori
COCA-COLA ITALIA SRL
VIALE EDISON 110 -BUILDING B-
20099 SESTO SAN GIOVANNI (MILAN), ITALY
DPO-Europe@coca-cola.com

5. Can you make complaints with the data privacy authority?

Yes, you also have the right, at any time, to lodge a complaint with the relevant supervisory authority (in particular in the Member State of your habitual residence, place of work or place of the alleged infringement), if you are of the opinion that any of your personal data is processed in a manner constituting an infringement of the GDPR.

The relevant contact info of supervisory authorities in Europe can be found here: https://edpb.europa.eu/about-edpb/board/members_en

X. Terminology

1. The references to data "relating to you" or "about you" or "your personal data" include references to data about third parties such as your spouse and children (if any) which you provide to us on their behalf (e.g., in your CV (where we encourage you not to provide any such information) or interview if you decide to disclose any such information, which is voluntary and without bearing on whether we consider your application).

2. "TCCC" means The Coca-Cola Company, a Delaware Corporation with offices at One Coca-Cola Plaza, Atlanta, Georgia 30313, U.S.A.

3. The "TCCC Group" means the prospective employer and its associated legal entities, as well as legal entities associated with TCCC. The TCCC Group entities and their respective location can be obtained by sending an e-mail to privacy@coca-cola.com.

XI. Updates to this Recruitment Notice

You can find out when the Recruitment Notice was last amended by checking "Last revised" at the top of this document.

 

***