Celonis Privacy Notice for Application and Hiring Process

1. About this Privacy Notice

This Celonis Privacy Notice (“Privacy Notice”) , on behalf of Celonis SE and all subsidiaries (“Celonis”), explains how and what type of data related to you as a natural person (“Personal Data”) is collected, why it is collected and to whom it is shared or disclosed. It also contains information about your rights related to your Personal Data. This Privacy Notice applies when you apply for a position at Celonis, including any related hiring process.

The following Celonis entities adhere to the Data Privacy Framework (DPF): Celonis Inc. and Celonis Labs LLC; the sections of this Notice related to the DPF apply to these two entities only.

On our website, we also collect cookies information; for details please see our Cookies notice.

2. About us

When we refer to “Celonis” (“we”, “us”) in this Privacy Notice, we mean Celonis SE (Theresienstraße 6, 80333 Munich, Germany) and/or the Celonis subsidiary that is responsible for the processing of your Personal Data (e.g. Celonis Inc).

Any request related to data privacy may be addressed to privacy@celonis.com.

3. What types of Personal Data do we collect?

We collect and process the following types of Personal Data:

Application and hiring process data

Your full name, contact information (e.g. email, phone number), curriculum vitae information (e.g. including information on your education, degrees, previous and current employment) and other data such as cover letter, salary expectation, authorization to work in the country you are applying.

If applicable, the need of sponsorship for employment visa status, background check results (as allowed by local law), criminal certificate, results from a job related assessment (e.g. cognitive abilities), as well as other professional and/or academic information.

Diversity data

Special categories of personal data, such as race / ethnicity, sexual orientation, gender, if permitted by local law. Your decision to provide such data is completely voluntary and your preference not to provide such information will not negatively affect in any way the application process.

Reference data

References submitted from contacts you provide us through our reference tool. Reference contacts receive an email asking them to answer a questionnaire about their experience when working with you. Occasionally, you may also be asked to provide contact information for references outside of the tool.

4. How do we collect your Personal Data?

You provide Personal Data directly to us when applying for an open position and through the hiring process. We may receive additional information from the reference contacts you provide us. We also may obtain Personal Data from third party sources, such as business and employment oriented websites and social media platforms. In case of referrals, we receive your contact details from the Celonis employee referring you for a job opportunity.

5. Why do we process your Personal Data?

We process your Personal Data for the following purposes (if applicable):

Application and hiring process

To manage your application, to assess your suitability for the position you are applying to and - if the application is successful - for the hiring process in order to enter into an employment contract or arrangement with you.

Talent pool

To retain and process your data to evaluate possibilities about another open role you may want to apply for in line with local requirements.

Process analytics

To improve our application process and enhance applicants’ experience with us, we may perform analytics and reporting activities.

Compliance

To comply with any legal and regulatory obligations.

Marketing

To send emails to inform you about us, our activities and events.

Diversity Efforts

To increase diversity of our workforce through our hirings.

6. On which legal basis do we process your Personal Data?

We process your Personal Data only where one of the following applies:

• We need to process your Personal Data to enter into an employment contract or arrangement with you,
• We have a legitimate interest to process your Personal Data (which is not overridden by your rights),
• You have given consent to process your Personal Data,
• We need to process your Personal Data to comply with a legal or regulatory obligation.

7. Who will have access to your Personal Data?

Depending on the purpose and the necessity, we may disclose your Personal Data to the following categories of recipients:

• To any subsidiaries of Celonis SE (i.e. internal transfer within our organization),
• To third parties who act as data processors under our instruction as specified in the related concluded contracts. These third parties are leveraged by Celonis for the purpose of managing the application processes including the collection, storage, evaluation and deletion of applicants’ personal data.,
• To government, law enforcement and regulatory bodies to meet applicable legal or regulatory obligations.

A list of applicable recipients can be provided upon request.

If you are a EU, UK or Swiss resident, your Personal Data may be transferred outside of the European Economic Area (EEA), UK or Switzerland. We are liable for onward transfers to third parties and we take the necessary steps to ensure that the transfer of your Personal Data outside of the EEA, UK or Switzerland receives an adequate level of protection.

Celonis Inc. and Celonis Labs LLC comply with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Celonis Inc. and Celonis Labs LLC have certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. Celonis has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) Program, and to view our certification, please visit https://www.dataprivacyframework.gov/

We do not disclose any Personal Data we collect to another business or a third party for monetary or other valuable consideration.

8. How long do we store your Personal Data?

When permitted and in compliance with applicable laws and regulations, your Personal Data will be deleted as soon as it is no longer required to achieve the purpose for which it has been collected. If regulations (e.g., employment law) require longer storage of your Personal Data, or if we need your Personal Data to assert legal claims or defend against legal claims, we will store your Personal Data until the expiration of the corresponding storage period or until the settlement of the claims.

9. How do we protect your Personal Data?

To protect your Personal Data against accidental or unlawful destruction, loss, use, or alteration and against unauthorized disclosure or access, we use adequate physical, technical and organizational security measures.

10. What are your rights regarding your Personal Data?

As permitted and in compliance with applicable laws and regulations, we provide you with the following rights:

• Request access, update, correction or deletion of your Personal Data,
• Withdraw your consent at any time for future processing (i.e. our marketing emails permit you to opt-out of receiving further communications by selecting the “unsubscribe” link),
• Request to restrict the processing or object to the processing of your Personal Data,
• Have your Personal Data transmitted to other recipients, if technically feasible,
• File a complaint with us and/or with a relevant data protection authority,
• Not to be discriminated for exercising your rights,
• As we may be subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC) you have the possibility, under certain circumstances, to invoke binding arbitration.

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Celonis Inc. and Celonis Labs LLC commit to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner’s Office (ICO) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF.

Additional rights may be applicable to you based on local laws and regulations.

You may exercise your rights by contacting us at privacy@celonis.com.

11. Updates

We regularly review this Privacy Notice.
This Privacy Notice was last updated on January 20, 2025.