Information about data processing

V2 (022024)

VMS Gesundheitseinrichtungen Österreich uses the onlyfy one service (by XING) to process job applications. This Privacy Policy will inform you about the processing of your data by the onlyfy one service and by VMS Gesundheitseinrichtungen Österreich.

Shared responsibility

With regard to interaction within the company account of VMS Gesundheitseinrichtungen Österreich, VMS Gesundheitseinrichtungen Österreich and New Work SE have shared responsibility pursuant to Article 26 GDPR, as they jointly determine the purposes and means of processing pursuant to Article 4 (7) GDPR. The current version of the agreement on shared responsibility pursuant to Article 26 GDPR, which New Work SE concludes with companies that use onlyfy one, can be viewed here to gain information on the key aspects of the agreement.

Data processing by New Work SE

onlyfy one is part of the extensive XING service operated by New Work SE, which pursues the aim of improving and simplifying users’ working lives with a variety of applications (onlyfy one, as well as the XING social and jobs network, kununu, etc.), and creates a more fulfilling working world of work for individuals while boosting the performance of companies. As part of the extensive XING service, onlyfy one is an online platform on which or through which talent and companies meet.

With regard to data processing for which New Work SE is solely responsible or is responsible within the scope of the shared responsibility with VMS Gesundheitseinrichtungen Österreich, detailed information is available in the XING Privacy Policy at You will also find contact details for New Work SE, as well as for the New Work SE data protection officer there.

Job applications with onlyfy one

When submitting an application, you enter into a user relationship with New Work SE for the purpose of processing applications. In addition, you will receive support and New Work SE can present you with other opportunities in support of your career. A public profile will not be automatically created for you on the XING social and jobs network. The legal basis for New Work SE processing your data is, in particular, Article 6 (1)(b) GDPR (processing necessary for the performance of a contract).

Pausing your online application

You can pause the creation of your online application at any time and continue at a later point. Cookies are used for this purpose. The data you provide to create the user account, as well as any uploaded documents, are recorded in the company account of VMS Gesundheitseinrichtungen Österreich in onlyfy one. The data remains recorded even if an application is paused and/or not completed. In this case, your application is flagged as incomplete and the data remains visible to VMS Gesundheitseinrichtungen Österreich only.

Visibility of your data

The data you have provided as part of the online application can be read, edited, or updated in your candidate profile at any time.

Notes on the special functions of onlyfy one

Calendar function

If the calendar function is used, your data is processed during and for the purpose of setting appointments within the application process. The legal basis is Article 6 (1)(f) GDPR. The calendar function is provided by an IT service provider (Cronofy Ltd., United Kingdom). The United Kingdom is classified as a secure third country based on the adequacy decision of the European Commission. Further information on data protection at Cronofy is available here: and

WhatsApp application

If you use the apply using WhatsApp function, your consent, which can be withdrawn at any time, forms the legal basis for communication (Article 6 (1)(a) GDPR). When applying via WhatsApp, all required applicant information is requested during a WhatsApp chat. The data is then sent directly to onlyfy one through a service provider, and is processed further there as part of and for the purpose of the normal application process.

The apply via WhatsApp function is provided by an IT service provider (PitchYou) that can gain access to your data for this purpose. More information is available here: Candidate data from apply via WhatsApp are transferred to onlyfy one via an interface. Immediately after this transfer, candidate data are deleted from the apply via WhatsApp infrastructure in PitchYou. Further processing then takes place exclusively in onlyfy one.

Please note that you use your personal WhatsApp account for applications, and therefore we cannot rule out that messages will be transferred, to the USA in particular. WhatsApp data protection information, such as its processing or exercising of data protection rights with regard to WhatsApp is available here:

Subject to your consent, your application will be sent from WhatsApp via the PitchYou infrastructure to onlyfy one. You have the right to withdraw your consent to this at any time. Either way, your application data will be deleted from the PitchYou infrastructure once transferred to onlyfy one, meaning that PitchYou will not process your data any further.

Applicability of the Swiss Federal Data Protection Act (FADP)

The FADP applies to circumstances which have an impact on Switzerland, even if said circumstances are initiated outside of Switzerland. Correspondingly, this privacy policy applies to information in line with the EU GDPR and the FADP. Here, EU GDPR terminology is used in favour of FADP terminology. However, FADP terminology is used if the FADP applies and the terminology differs from EU GDPR terminology in a given language. The About this site section on XING contains the name and address of our representative in Switzerland.

VAMED Data Privacy Policy

1. Preamble

This document is for information purposes only. The legally binding version is always the German version of this document. The company New Work SE, Am Strandkai 1, Hamburg, Germany (hereinafter referred to as “Prescreen”) operates the e-recruiting system “Onlyfy Prescreen” on the * domain (hereinafter referred to as “”), where companies can advertise job vacancies as well as receive and manage applications. Within the framework of these activities, Prescreen processes personal data on behalf of and for the purposes of the company that you wish to contact with regard to your application. In terms of data protection legislation, this company is designated as a controller within the meaning of Art. 4 (7) of the General Data Protection Regulation (GDPR) (hereinafter referred to as “we”, “our”). Prescreen acts in this relationship as a processor within the meaning of Art. 4 (8) GDPR. The protection and confidentiality of your data are of particular importance to Prescreen. Of course, your data is processed exclusively in accordance with relevant data protection provisions, in particular the Austrian Data Protection Act (DSG), the Austrian Telecommunications Act (TKG), the German Federal Data Protection Act (BDSG), and the German Telemedia Act (TMG). This Data Privacy Policy also complies with all statutory requirements under the European General Data Protection Regulation (GDPR). Under no circumstances will the Data Protection Officer or Prescreen transmit your personal data to third parties for advertising, marketing or other purposes without authorisation. If you have any questions about this Data Privacy Policy, please feel free to contact the VAMED Group by email at

 2. What is personal data?

Personal data is any information that makes it possible to draw conclusions about your personal or material circumstances, or that may lead to your identification.

 3. What data is collected?

 a) The following data is collected and processed for the automated processing of your application:


  • First name, last name, email address and, as necessary, address/place, date of birth, title, phone number, citizenship
  • Additional questions depending on the respective position (e.g. driver’s license)
  • Your CV, in particular information about your professional experience and training
  • Skills and competencies (e.g. Photoshop, MS Office)
  • Application photo
  • Qualifications, awards, and language skills
  • Cover letter
  • Any files and documents you may wish to upload
  • Special categories of personal data: If you provide any information in your application documents that falls into special categories of personal data as defined in Art. 9 (1) GDPR (e.g. information that implies your sexual orientation; information on your health; information that implies your ethnicity or religion), we will also process this data only within the legally permissible framework.

 b) We store the written electronic communication that takes place between you and the company to which you are applying. In addition, we process comments and evaluations concerning you that are created in the course of your application process.

 c) When accessing the domain, your web browser automatically sends certain usage data for technical reasons. This information is stored separately from other data in log files. Prescreen collects the following information:

  • Date and time as well as duration of the access
  • Browser type/version
  • Operating system
  • URL of the previously visited web page
  • Quantity of data transmitted
  • A GeoIP lookup is performed based on your IP address (Internet Protocol address)
  • Names of accessed files
  • http status code (e.g. “request successful”)
  • URL of the accessed web page
  • Access type (GET, POST)

 d) This data is technically required in order to offer the functions of the e-recruiting system and to ensure the stability and security of the system. It is stored by Prescreen for a period of 12 months. Any data that must be further retained for evidential purposes is excepted from being deleted until final clarification of the respective case


a) Prescreen uses “cookies” to operate its website. These are used to make your online application more user-friendly, more effective and more secure. Cookies are small text files that are stored on your computer. “Session cookies” are deleted as soon as you leave our website. In contrast, permanent cookies (e.g. to enable you to return to the application process at a later stage) remain on your computer’s hard drive until they are deleted by your browser. You may prevent the installation of cookies on your computer by adjusting your browser software accordingly. Please note, however, that in this case some functions of Prescreen may not be available to you to their full extent.

b) Cookies may be required to maintain the “functionality” of the website. The use of such cookies does not require consent and therefore cannot be deactivated. Cookies that are used to “analyse” your behaviour on our website are saved only with your consent. If we use cookies that require consent, a cookie banner will pop up when you first access our website, on which you can agree to the use of cookies that require consent. If you wish to change your cookie settings at a later date, you may do so on the website in the “Cookies” section.

c) Below you will find a list of the cookies used. 




Duration of storage

New Work SE  


This cookie is used to identify the user during their use of onlyfy one. The cookie is essential for the correct functionality of the website. The cookie is only valid until the browser window is closed.

Until the browser window is closed (session cookie).

New Work SE  


This cookie is used to restore an expired session. The cookie is essential for the correct functionality of the website.


Purpose and legal basis of data collection

 a) We process your personal data in accordance with the provisions of the European General Data Protection Regulation (GDPR) and the Austrian Data Protection Act. Your personal data is exclusively processed for the purposes defined in this Data Privacy Policy (e.g. to process your job application, transfer data to your personal file, if applicable, initiate a contract of employment, and maintain an employment relationship; or to keep your application on record in case there is no suitable vacant position).


  • steps prior to entering into a contract (Art. 6 (1) (b) GDPR)

The data is processed (in the event of employment) for the performance of necessary measures prior to entering into a contract and, subsequently, for legal obligations arising from your employment relationship. 


  • Data processing based on consent (Art. 6 (1) (a) GDPR)

If you gave us your consent for processing your personal data, your data will be processed exclusively for the purposes and within the scope defined in your Declaration of Consent (e.g. keeping your application on record for 24 months). You may also withdraw your consent at any time and independently of each other with effect for the future by sending an email to the VAMED Group at The revocation of consent does not affect the legality of data processing up to the time
of revocation.


  • Data processing based on legitimate interest (Art. 6 (1) (f) GDPR).

We may, where necessary, process your data beyond the scope and purpose of the employment contract in order to safeguard legitimate interests of ours or third parties.


b) We would like to point out that for the purposes of direct advertising, we will send you electronic messages about new job offers from companies to which you have previously applied. On behalf of those companies, we process your name, your email address and the data you entered in your previous application. You may object to receiving these messages at any time by sending an email to the VAMED Group at

6. Is data transferred to or collected by third parties?

Data collected within the context of your application is not published or forwarded without authorisation, i.e. without your consent, to third parties. Apart from our employees who process your data in the course of providing our services, we transfer your data to the following recipients:

a) Companies you wish us to contact in the course of your application as well as to companies (including companies managed through VAMED) responsible for corporate human resources management within the VAMED Group (VAMED Aktiengesellschaft, VAMED Engineering GmbH, VAMED Management und Service GmbH, VAMED Technical Service GmbH, VAMED Standortentwicklung und Engineering GmbH, and Vamed KMB Krankenhausmanagement und Betriebsführungsges.mbH).
b) If we are not able to consider your application for the job advertisement you are primarily interested in, we will within the framework of our corporate human resources management transmit your applicant data to other companies within the VAMED Group (including companies managed through VAMED) that might have adequate vacancies.
c) Sub-contracted processors acting as IT service providers help us to provide our services and in the context of hosting services. They have registered offices in Austria and Germany, and are contractually obliged to comply with applicable data protection provisions as well as with provisions regarding data protection and confidentiality under this contract.
d) If the calendar function is used, your data is processed during and for the purpose of setting appointments within the application process in accordance with Art. 6 (1) (f) GDPR. The calendar function is provided by an IT service provider (Cronofy Ltd., United Kingdom). The United Kingdom is classified as a secure third country based on the adequacy decision of the European Commission. Further information on data protection at Cronofy is available here: and


7. Storage periods

 a) Personal data of rejected applicants is stored for a maximum of six months, starting from the date of rejection of the application.

 b) If you decide to withdraw your application before the end of the application process, i.e. if you delete your data and your account, the stored data will be restricted for the period of the ongoing application process, and permanently deleted six months after the end of the application process.

 c) If you give us your consent within the framework of the job application, we will store your data for two years starting with your application for the purpose for future consideration and contact in case of adequate vacancies.

 d) Longer storage periods may result from data being required to assert, exercise or defend legal claims with regard to public authorities or if statutory storage periods apply. The data will be stored as long as necessary to fulfil these purposes.

 8. Your rights with regard to stored data

a) You have the right to free information about the personal data about you that we process, as well as the right to correct and erase data, to limit data processing, and the right to data transferability. If you wish to assert these rights or obtain further information about them, please send an email to the VAMED Group at

b) As a matter of principle, our Data Privacy Policy and our responsibility and liability in this connection does not cover websites of third-party providers to which we provide links or to which you are forwarded. We are also not responsible for subsequent data processing by the operators of those websites in such cases.

 9. Withdrawal option 

a) You may at any time withdraw your consent given as required by data protection law, with effect for the future. If you wish to exercise your right to withdraw, please send an email to the VAMED Group at
b) If we use cookies that require consent on our website and you agreed to their use, you may withdraw that consent on our website in the “Cookies” section. You will find further information about cookies under Section 4 “Cookies”.

10. Complaints to the data protection authorities

If you believe that our processing of your data violates applicable data protection regulations, you have the right to lodge a complaint with the Austrian Data Protection Authority or the otherwise competent supervisory authority (in particular in the Member State of your place of residence or work).

Contact details of the controller


Mag. Per-Oliver GUSTAVSON

Corporate Data Protection Officer VAMED Group


Sterngasse 5

A-1230 Vienna



+43 1 601 27-0