Global Applicant Privacy Statement
This privacy notice describes how we collect and use personal information about you during your application process for employment with us, in accordance with applicable data protection and privacy laws.
It applies to all candidates of Cencora.
1.2 This notice applies to applicants and prospective employees of Cencora. This notice does not form part of any contract of employment or other contract to provide services.
1.3 It is important that you read and retain this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information and what your rights are under applicable data protection and privacy laws.
1.4 Controllers — If you are in Canada, the European Economic Area (EEA), Switzerland, Turkey or the UK, the controller of your personal information will be the corporate entity that manages the hiring process or employs you.
There are certain types of more sensitive personal information which require a higher level of protection, such as information about a person's health or sexual orientation.
(a) Contact Information: Contact details such as name, addresses, telephone numbers, and email address;
(b) Employment / Engagement Information: Start date and, if different, the date of your continuous employment, leaving date and your reason for leaving, and location of employment or workplace
(c) Recruitment Information: copies of right to work documentation, references and other information included in a CV/resume or cover letter or as part of the application process.
2.2 We may also collect, store, and use the following more sensitive types of personal information to the extent permitted by applicable law:
(a) Information about your race or ethnicity.
2.3 The processing of sensitive personal information about you is only carried out with your explicit consent for us to achieve a series of legitimate purposes, e.g., implementing human resources management, complying with employment and social security laws, providing you with certain assistance and/or protecting your life, health, and property safely in certain circumstances. We adopt appropriate security measures to protect the personal information we process, including sensitive personal information. We do not expect that our processing of sensitive personal information about you would impact your rights and interests adversely.
4.2 In some circumstances we may anonymize your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.
4.3 Once you are no longer a prospective employee or candidate of the company we will retain and securely destroy your personal information in accordance with applicable laws and regulations.
4.4 The specific retention periods may differ depending on where you are employed / engaged. For further information on our record retention policies and procedures please contact privacyops@cencora.com.
Categories of Personal Data | Purpose for processing |
---|---|
Categories (a)-(c) at 2.1 above | Making a decision about recruitment or appointment, determining the terms on which you work for us and checking you are legally entitled to work in the country. |
Categories (a)-(c) at 2.1 above | Administering human resource functions including talent management and succession planning – including, assessing qualifications for a particular job or task |
All categories of personal information at 2.1 above | To investigate and resolve complaints, grievances, disciplinary hearings, or misconduct |
All categories of personal information at 2.1 above | Preparing for and acting in relation to enquiries, investigations, legal disputes, or proceedings, including by governmental, administrative, judicial, or regulatory authorities |
Sensitive Personal Information: | |
Categories at 2.3 | To conduct meaningful equal opportunities monitoring and reporting |
We require third parties to respect the security of your personal information and to treat it in accordance with the law.
We may transfer your personal information outside of your country of employment / engagement.
6.2 How secure is my information with third-party service providers? All our third-party service providers are required to implement appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers where acting as processors to use your personal information for their own purposes. We only permit them to process your personal information for specified purposes and in accordance with our instructions.
6.3 When might you share my personal information with other entities within Cencora? We will share your personal information with other entities in our group as part of our regular reporting activities on company performance, in the context of a business reorganization or group restructuring exercise, for system maintenance support and hosting of data.
6.4 What about other third parties? We may share your personal information with other third parties, for example, auditors, accountants, and legal advisors.
6.5 We will also share your personal information in the context of the possible sale or restructuring of the business. In this situation we will, so far as possible, share anonymized / de-identified data with the other parties before the transaction completes. Once the transaction is completed, we will share your personal information with the other parties if and to the extent required under the terms of the transaction.
6.6 We may also need to share your personal information with a regulator or to otherwise comply with the law. This may include making returns to tax authorities, disclosures to stock exchange regulators, and disclosures to shareholders such as directors' remuneration reporting requirements.
6.7 If you would like to obtain information regarding the names and contact details of the parties with whom we share your personal information, their processing purpose and method, the categories of personal information shared with them, and the method and procedures for exercising your rights with them, please contact privacyops@cencora.com. Please note however that we may not be able to fulfil this request in all instances.
6.8 For additional information on sharing of personal information in California, U.S., please see Section 17.
10.2 Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is permitted by law.
11.2 For intra-group transfers of personal information, Cencora has entered into an intra-group data transfer agreement. For cross-border transfers of personal information to other recipients, Cencora will (as required by law) enter into data transfer agreements with the recipient, seek your consent for the transfer and/or take steps to ensure other appropriate safeguards have been implemented.
11.3 For further information about cross-border transfers, please contact privacyops@cencora.com.
12.2 We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.
(a) Request access to your personal information. This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
(b) Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
(c) Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
(d) Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your situation which makes you want to object to processing on this ground.
(e) Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
(f) Request the transfer of your personal information to another party (known as data portability).
(g) Right to withdraw consent. Where you may have provided your consent to the processing of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact privacyops@cencora.com. Once we have received and verified your request to withdraw your consent, we will no longer process your personal information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.
13.2 We do not make any decisions about you using automated means.
13.3 If you want to exercise your privacy rights, please contact privacyops@cencora.com.
13.4 You also have a right to complain about the processing of your personal information with a privacy regulator.
13.5 Additional country-specific rights are set out in Annex 2.
13.6 Your duty to inform us of changes. It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your working relationship with us.
14.2 We have also appointed a data protection advisor for compliance with Swiss privacy laws. Please contact the data protection advisor via privacyops@cencora.com.
14.3 We have also appointed a grievance officer for compliance with Indian privacy laws. Please contact the grievance officer via privacyops@cencora.com.
16.2 When you visit our Sites, we may place a “cookie” or other online tracking devices (e.g., web beacons) that recognizes you. The cookies and other tracking technologies may also collect information about your IP address or actions taken in connection with the Sites. We may use cookies or similar tracking technologies to capture information about the use of our Sites, including to improve your user experience. You can find more information about our use of cookies on this Site by referring to our cookie banner pop-up.
Categories of Personal Information | Purpose for Processing | Legal Basis (where you are employed / engaged in the EEA/UK/Turkey (as applicable)) |
---|---|---|
All categories of personal information at 2.1 above | Making a decision about recruitment or appointment, determining the terms on which you work for us and checking you are legally entitled to work in the country. | This is necessary to enter a contract with you (EEA/UK: Article 6(1)(b), GDPR; Turkey: Article 5(2)(c), Law no. 6698 on the Protection of Personal Data (“Law”)) Cencora has a legal obligation to do so (EEA/UK: Article 6(1)(c), GDPR; Turkey: Article 5(2)(ç), Law) |
All categories of personal information at 2.1 above | Administering human resource functions including talent management and succession planning – including, assessing qualifications for a particular job or task | To be able to manage and perform our contract with you (EEA/UK: Article 6(1)(b), GDPR; Turkey: Article 5(2)(c), Law) To be able to manage and perform our contract with you (EEA/UK: Article 6(1)(b), GDPR; Turkey: Article 5(2)(c), Law) Cencora has a legitimate interest to ensure that we manage our human resource related functions effectively and efficiently including, ensuring that our personnel meet performance objectives, and are suitably trained (EEA/UK: Article 6(1)(f), GDPR; Turkey: Article 5(2)(f), Law) |
All categories of personal information at 2.1 above | To investigate and resolve complaints, grievances, disciplinary hearings, or misconduct | Cencora has a legal obligation to do so (EEA/UK: Article 6(1)(c), GDPR; Turkey: Article 5(2)(ç), Law) Cencora has a legitimate interest to manage its business and to resolve any complaints, grievances, or allegations of misconduct effectively (EEA/UK: Article 6(1)(f), GDPR; Turkey: Article 5(2)(f), Law) |
All categories of personal information at 2.1 above | Preparing for and acting in relation to enquiries, investigations, legal disputes, or proceedings, including by governmental, administrative, judicial, or regulatory authorities | Cencora has a legitimate interest to manage its business and to ensure that all investigations and proceedings etc. are managed efficiently and effectively (EEA/UK: Article 6(1)(f), GDPR) Cencora has a legal obligation to do so (EEA/UK: Article 6(1)(c), GDPR) In Turkey: It is necessary for the establishment, exercise, or protection of any right of Cencora (Article 5(2)(e) Law) |
All categories of personal information at 2.1 above | In connection with a potential asset or stock acquisition of Cencora, or the outsourcing or insourcing of services provided by employees, providing reasonable diligence material to a third party, or meeting any disclosure obligations as required by law | Cencora has a legitimate interest to manage its business (EEA/UK: Article 6(1)(f), GDPR; Turkey: Article 5(2)(f), Law) Cencora has a legal obligation to do so (EEA/UK: Article 6(1)(c), GDPR; Turkey: Article 5(2)(ç), Law) |
Sensitive Personal Information: | ||
Categories at 2.2(a) and gender identity | To conduct meaningful equal opportunities monitoring and reporting where permitted by applicable laws | To comply with employment laws and other laws (Article 9(2)(b), GDPR; Germany: Sec 26 BDSG) In Turkey: Based on your explicit consent (Article (6)(2) Law) |
For candidates in France or contractors located in France, you also have the right to give specific instructions concerning the fate of your personal data after your death.
India:
For applicants located in India, you also have the right to nominate any individual who will exercise your rights in case of your death or incapacity and you have the right to grievance redressal. You can contact us about how we process your personal information, our obligations in relation to such personal information and/or with regard to your rights in relation to your personal information. We will respond to your grievances within one month from the date of receiving your grievance redressal request. If you are dissatisfied with our response, you have the right to approach the Data Protection Board.
Portugal:
For candidates in Portugal or contractors located in Portugal, you also have the right to appoint who after your death can exercise your rights (otherwise, it will be your heirs) and/or determine that they should not be exercised and/or give instructions on the fate of your personal information regarding certain categories of personal information (special categories of personal information, private life, image and data related to communications).
Turkey:
For applicants in Turkey or contractors located in Turkey: you also have the right to receive details of the recipients to whom we transfer personal information (in country or abroad), claim compensation for damage arising from the unlawful processing of your personal information, object to the automated processing of your personal information where a negative result is produced.
California:
1. If you are a California resident, you have certain rights in relation to your personal information as follows:
1.1 Your Right to Access Information We Collect and Share About You: We are committed to ensuring that you know what personal information we collect. To that end, you can ask us for the following information from us with respect to the personal information that we have collected about you in the 12 months prior to our receipt of your request:
- Specific pieces of personal information we have collected about you;
- Categories of personal information we have collected about you;
- Categories of sources from which such personal information was collected;
- Categories of personal information that the business sold or disclosed for a business purpose about you;
- Categories of third parties to whom the personal information was sold or disclosed for a business purpose; and
- The business or commercial purpose for collecting or selling your personal information.
1.2 Your Right to Request Deletion of Personal Information We Have Collected from You: Upon your request and subject to exceptions in the law, we will delete the personal information we have collected from you.
1.3 Your Right to Request to Correct Personal Information We Hold About You: You have the right to request that we correct personal information we hold that you believe is not accurate. We will take steps to determine the accuracy of the personal information that is the subject of your request to correct, and in doing so will consider the totality of the circumstances relating to the personal information you have identified as being incorrect. We may ask that you provide documentation regarding your request to correct to assist us in evaluating the request.
1.4 California Shine the Light: California Civil Code Section 1798.83, also known as the “Shine the Light” law, permits California residents to annually request, free of charge, information about the personal information (if any) disclosed to third parties for direct marketing purposes in the preceding calendar year. To make a request, please contact us at privacyops@cencora.com.
1.5 Our Commitment to Honoring Your Rights: If you exercise any of the rights explained in this privacy notice, we will continue to treat you fairly.
1.6 Exercising Your Rights and How We Will Respond: To exercise your access or deletion rights, or to ask a question about your data subject rights, contact us at privacyops@cencora.com, or click here. We will first acknowledge receipt of your request within 10 business days of receipt of your request. We will then provide a substantive response to your request as soon as we can, generally within 45 days from when we receive your request, although we may be allowed to take longer to process your request under certain circumstances. If we expect your request is going to take us longer than normal to fulfill, we will let you know. We usually act on requests and provide information free of charge, but we may charge a reasonable fee to cover our administrative costs of providing the information in certain situations. In some cases, the law may allow us to refuse to act on certain requests. When this is the case, we will endeavor to provide you with an explanation as to why.
1.7 Verification of Identity – Access or Deletion Requests: We will ask you for two or three pieces of personal information and attempt to match those to information that we maintain about you. If we are unable to verify your identity with the degree of certainty required, we will not be able to respond to the request. We will notify you to explain the basis of the denial.
1.8 Authorized Agents: You may designate an agent to submit requests on your behalf. The agent can be a natural person or an entity that is registered with the California Secretary of State. If you would like to designate an agent to act on your behalf, you and the agent will need to comply with our verification process. Specifically, if the agent submits requests to access, know, correct, or delete your personal information, the agent will need to provide us with your signed permission indicating the agent has been authorized to submit the request on your behalf. We will also require that you verify your identity directly with us or confirm with us that you provided the agent with permission to submit the request. Please note that this subsection does not apply when an agent is authorized to act on your behalf pursuant to a valid power of attorney. Any such requests will be processed in accordance with California law pertaining to powers of attorney.