Go to content
CHANGE COUNTRY

en

CHANGE COUNTRY

Applicant Privacy Notice

  • Last updated: April 2026

  • 1. Introduction


    Kia Europe GmbH ("Kia EU ”, “we ”, “us ”, “our ”) collects and processes personal data in connection with job applications submitted to Kia EU. The purpose of this privacy notice (“Privacy Notice ”) is to inform you about our processing of your personal data during the recruitment process in accordance with Articles 13 and 14 of the GDPR. It is addressed to applicants who apply for jobs at Kia EU (each an “Applicant ”, “you ”, “your ”).

    To facilitate and simplify the submission of necessary information, we use the online recruitment tool HireHive, which is provided by our service provider Assembly Point Ltd. This online recruitment tool is operated on the HireHive website, which means that you are redirected to this website via our career page or other means.

    Please note that in addition to this Privacy Notice, where appropriate, we may inform you about the processing of your personal data separately, for example in consent forms or additional privacy notices.

    If you disclose personal data to us about other individuals, please ensure that you are authorised to do so, and that the relevant personal data is accurate. Please also make sure that these individuals have been informed about this Privacy Notice.

  • 2. Controller


    Kia EU is the controller of the personal data processed in accordance with this Privacy Notice, unless expressly stated otherwise.

    Contact details

    Kia Europe GmbH
    Theodor-Heuss-Allee 11
    60486 Frankfurt am Main, Germany
    Email: info@kia-europe.com

    Further information about Kia EU can be found in our Legal Information section.

  • 3. Our Data Protection Officer


    We have appointed an external data protection officer (“DPO ”). You may contact our DPO at:

    Kia Europe GmbH
    - Data Protection Officer -
    Theodor-Heuss-Allee 11
    60486 Frankfurt am Main, Germany
    Email: dpo@kia-europe.com

  • 4. Collection of Personal Data


    We collect or obtain personal data about you from the following sources:

    • Data provided to us: Personal data that you provided to us (e.g. when you submit your job application).
    • Data we obtain in person: We collect personal data obtained during interactions with you (e.g. in-person or online job interviews).
    • Third-party information : When you use the “Apply with LinkedIn” feature on the HireHive platform, we obtain your name, email address and photo from the relevant LinkedIn entity and/or Assembly Point Ltd. (the provider of the HireHive platform). We will only obtain such data if you have requested the relevant LinkedIn entity to share the data with Assembly Point Ltd or us (as applicable).

  • 5. Categories of Personal Data that we Process


    We process the following categories of personal data about you:

    • Personal details: first name; last name; country; salutation; title; and photograph (if provided).
    • Contact details : correspondence address; telephone number; email address.
    • Professional details: your resume/CV; records of your expertise; qualification details; professional history (e.g. current title; number of years of working experience in the area you are applying for); information about your professional relationship with other institutions (e.g. current company; information about whether you are currently working for a Kia entity or have worked for a Kia entity in the past; agreed period of notice or from when you would be available); language abilities; and other professional skills.
    • Consent records: records of any consents you have given, together with the date and time, means of consent, and any related information (e.g., the subject matter of the consent).
    • Payment details: bank account number; account holder name; IBAN details, in the context of potential reimbursement of travel expenses to the applicant.
    • Others: annual gross salary expectations; how you learned about the position that you are applying for; if you got referred for the position, name of the person who is working for the relevant Kia entity; any other information that you provide to us in connection with your application.

    You have the right not to provide your personal data to us. However, please note that we will be unable to process your application if you do not provide certain personal data. In our application form, we have made it clear which data are necessary for us to be able to process your application and which data are optional.

  • 6. Purposes of Processing and legal basis for Processing


    The purposes for which we process the categories of personal data identified in section 5 above, subject to applicable law, and the legal bases on which we perform such processing are as follows:



    Purpose of Processing Legal basis for Processing

    A. Recruitment and job applications:
    recruitment activities; contacting applicants and communicating with applicants; interview activities; analysis of suitability for the relevant position; records of hiring decisions; offer details; and acceptance details.

    We may invite you to participate in an online interview conducted via the video conferencing tool Microsoft Teams. Please refer to our MS Teams Privacy Notice to learn more about your data protection rights and our processing of your personal data in connection with the use of Microsoft Teams. Our MS Teams Privacy Notice is accessible here.

    • • The Processing is necessary to take steps prior to entering into a contract with us (Art. 6(1)(b) GDPR); or


    • • Your consent (Art. 6(1)(a) GDPR) - for the processing activities that are entirely voluntary. This legal basis is only used where processing is not necessary or obligatory in any way.

    B. Legal compliance: compliance with our legal and regulatory obligations under applicable law.

    • • The Processing is necessary for compliance with a legal obligation (Art. 6(1)(c) GDPR); and


    • • For the rest: legitimate interest (Art. 6(1)(f) GDPR) - in ensuring compliance with legal obligations, to the extent that such legitimate interest is not overridden by your interests, fundamental rights, or freedoms.

    C. Establishment, exercise and defence of legal claims: management of legal claims; establishment of facts and claims, including collection, review and production of documents, facts, evidence and witness statements; exercise and defence of legal rights and claims, including formal legal proceedings.

    • • Legitimate interest (Art. 6(1)(f) GDPR) - in establishing, exercising or defending our legal rights, to the extent that such legitimate interest is not overridden by your interests, fundamental rights, or freedoms.;

  • 7. Disclosure of Personal Data to Third Parties


    Within our company, we ensure that only such persons or departments will have access to your personal data that require the relevant data for the above-mentioned purposes (on a “need-to-know” basis).

    In some cases, we may disclose your personal data to third parties solely for the purposes set out above and in compliance with applicable laws. Where third parties act as our processors, we have entered into a data processing agreement with each such processor in accordance with Art. 28(3) GDPR.

    The potential recipients of your personal data include the following companies, institutions, or persons:

    • Legal and regulatory authorities, upon request;
    • Accountants, auditors, consultants, lawyers and other outside professional advisors to Kia EU, subject to binding contractual obligations of confidentiality;
    • Any relevant party, regulatory body, governmental authority, law enforcement agency or court, to the extent necessary for the establishment, exercise or defence of legal claims;
    • Our service providers (IT, finance, facility management), including Assembly Point Ltd., which provides the online recruitment tool HireHive.

  • 8. International Transfer of Personal Data


    We may transfer your personal data to other third parties, as noted in section 7 above. Some of these recipients may be located in countries that are neither Member States of the European Union nor members of the European Economic Area (“Third Country ”). For some Third Countries, the European Commission has determined that they provide an adequate level of protection for personal data (e.g., Republic of Korea, United Kingdom, Switzerland), which also includes the USA to the extent that the receiving company in the USA participates in the EU-U.S. Data Privacy Framework (see https://www.dataprivacyframework.gov (“Adequate Jurisdiction ”).

    Where we transfer personal data to a recipient that is located in a Third Country that has not been determined an Adequate Jurisdiction, we (or our processors in the EU/EEA that transfer personal data to sub-processors in such Third Countries, as applicable) provide appropriate safeguards by way of entering into data transfer agreements adopted by the European Commission ("Standard Contractual Clauses") with the recipients or taking other effective measures to provide an adequate level of data protection.

    You may request a copy of the respective safeguards by contacting us or our data protection officer (see section 2 and section 3 above).

  • 9. Data Retention


    We take all reasonable steps to ensure that your personal data are only processed for the minimum period necessary for the purposes set out in this Privacy Notice. The duration for which we retain your personal data is determined based on the following criteria:

    1. We retain personal data in a form that permits identification only for as long as:
    a) We maintain an ongoing relationship with you; or
    b) Your personal data are necessary in connection with the lawful purposes set out in this Privacy Notice, for which we have a valid legal basis,

    plus:

    2. The duration of:
    a) Any applicable limitation period under applicable law (i.e. any period during which any person could bring a legal claim against us in connection with your personal data, or to which your personal data are relevant); and
    b) An additional two (2) month period following the end of such applicable limitation period (so that, if a person brings a claim at the end of the limitation period, we are still afforded a reasonable amount of time in which to identify any personal data that are relevant to that claim) (for example, this means that we will retain the personal data of individuals whose applications have not been successful for up to six (6) months from rejecting the application),

    and:

    3. In addition, if any relevant legal claims are brought, we may retain relevant personal data for additional periods necessary for the establishment, exercise or defense of that claim.

    During the periods described in paragraphs (2)(a) and (2)(b) above, we will restrict our processing of your personal data to storage of, and maintaining the security of, those data, except to the extent that those data need to be reviewed in connection with any legal claim, or any obligation under applicable law.

    Once the periods in paragraphs (1), (2) and (3) above, each to the extent applicable, have been concluded, we will permanently delete or destroy the relevant personal data.

  • 10. Your Legal Rights


    If you have any questions about our processing of your personal data, we are happy to provide you with information about the personal data concerning you and the related processing activities.

    Under the GDPR, you have the right to request access to your personal data and further information about our processing of your personal data (Art. 15 GDPR). Subject to the legal requirements being met, you also have a right to obtain: (a) rectification of your personal data (Art. 16 GDPR); (b) erasure of your personal data (Art. 17 GDPR); and (c) restriction of processing of your personal data (Art. 18 GDPR). You also have a right to data portability (Art. 20 GDPR) and a right to lodge a complaint with a data protection authority (Art. 77 GDPR, sec. 19 BDSG).

    Where we process your personal data on the basis of your consent, you have the right to withdraw your consent at any time (Art. 7(3) GDPR). The withdrawal of your consent will not affect the lawfulness of processing based on such consent before its withdrawal.

    Your right to object: Where we process your personal data on the basis of legitimate interests, you have the right to object to such processing at any time on grounds relating to your particular situation (Art. 21(1) GDPR). Furthermore, where we process your personal data for direct marketing purposes, you have the right to object to such processing at any time (Art. 21(2) GDPR).

    To exercise your rights, you may contact us at any time using the contact details provided in section 2 or section 3 above.

  • 11. Updates


    This Privacy Notice may be updated or amended from time to time (e.g., to reflect changes in applicable law or changes in our practices regarding the processing of personal data). We encourage you to read this Privacy Notice carefully, and to regularly check this page to review any changes we might make in accordance with the terms of this Privacy Notice.

  • 12. Definitions


    “BDSG” means the German Federal Data Protection Act (Bundesdatenschutzgesetz der Bundesrepublik Deutschland).

    “controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

    “GDPR” means Regulation (EU) 2016/679 (General Data Protection Regulation). “personal data” means any information relating to an identified or identifiable natural person.

    “process”/ ”processing” means any operation or set of operations which is performed on personal data or on sets of personal data, such as collection, recording, organisation, structuring, storage, adaption or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

    “processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.