Data protection declaration for applicants

1. Name and contact details of the joint data controllers

Assenagon GmbH
Prannerstraße 8
80333 München
Germany

Phone +49 89 519966-0
privacy@assenagon.com
www.assenagon.com

and

Assenagon Asset Management S.A.
Aerogolf Center, 1B Heienhaff
1736 Senningerberg
Luxembourg

Phone +352 27049-100
privacy@assenagon.com
www.assenagon.com

are the joint controllers within the meaning of the EU General Data Protection Regulation, other national data protection laws enacted by the EU Member States and other data protection rules.

2. Purposes and description of the data processing

Your data will be collected exclusively for the purpose of processing and reviewing your application and to carry out the appli­cation process. The data are stored in the time period after an application is declined in order to enable a defence against any groundless claims which may be raised. Your data may be stored for a longer time period in order to match your application with future vacancies.

3. Disclosure and recipients of the personal data

In the context of the application process, depending on the advertised position, it may be necessary to pass on your data with­in the Assenagon Group (Assenagon Asset Management S.A., including the branch establishment Munich and Assenagon GmbH). In this case, your data will be passed to the relevant internal department of the group company, which may use them for the purposes set out under no. 2.

The data will not leave the Assenagon Group and will be used exclusively in order to process and assess applications.

4. Storage period

Your data will be erased in general six months after we receive your application. Should your application be unsuccessful, your data will be stored for a time period of six months after you are sent the declining notification, and then erased without undue delay.

Your data will only be stored for a longer time period in order to match your application with future vacancies if you give us your consent. If you provide your consent, your data will be stored for five years, used for the purposes indicated under no. 2 and subsequently erased.

5. Legal basis for data processing

Depending on its respective purpose, the legal basis for the processing is:

In the context of the processing and reviewing of the application and the implementation of the application process, processing is required for measures taken in advance of a contract, legal basis is Article 6 para. 1 sent. 1 lit. b GDPR.

For processing carried out to defend against claims, legal basis are our legitimate interests pursuant to Article 6 para. 1 sent. 1 lit. f GDPR.

Where the processing serves the matching of the application with future vacancies, it is based on consent pursuant to Article 6 para. 1 sent. 1 lit. a GDPR.

6. Processing of personal data by joint controllers

Assenagon GmbH and Assenagon Asset Management S.A. have concluded a contract as joint controllers within the meaning of the Art. 26 GDPR, governing the mutual responsibilities for any processing operations carried out as joint controllers. Among other things, a joint responsibility exists for human resources management, which also includes the conduct of applica­tion procedures. In the contract, the joint controllers have undertaken to guarantee the security of data processing, to inform each other of serious disruptions in the processing of data and to provide each other with the necessary support in answering requests from data subjects seeking to enforce their rights set out in Art. 12 to 22 GDPR and Art. 34 GDPR. The contract further stipulates that if the consent of a data subject is required for the processing of personal data, this consent is obtained from the joint controller who collects or has collected the data.

7. Rights of the applicant

You as the applicant may withdraw your application at any time. You furthermore have the following rights under the General Data Protection Regulation:

You have the right to demand that the data controller grant you access to the data stored in relation to your person (Article 15 GDPR).

Where inaccurate personal data are processed, you have the right to request rectification (Article 16 GDPR).

Subject to certain legal requirements, you may demand that your personal data be erased or that their processing be restrict­ed, and you may lodge an objection against the processing (Article 17, 18 and 21 GDPR).

If you have consented to the data processing, and if the data processing is carried out by automated means, you have the right to data portability (Article 20 GDPR).

You are furthermore entitled to lodge a complaint with a supervisory authority.

8. Right to withdraw consent

If you have consented to the data processing by the data controller, you may withdraw your consent at any time with effect for the future. This does not affect the lawfulness of the data processing that took place based on the consent prior to such with­drawal.