Privacy Policy
Last updated: October 2026
1. Controller and data protection contact
The controller responsible for processing your personal data on this website is SGS Plant Services GmbH, Gewerbepark 1, 4751 Dorf an der Pram, Austria.
For questions about data protection and to exercise your rights, contact us at office@sgs-plant.com. Questions about your application are answered at jobs@sgs-plant.com.
2. Hosting and infrastructure
This website is operated by Vercel Inc. (USA). Vercel provides hosting and server functions, stores uploaded CVs in non-public storage (Vercel Blob, data centre in Frankfurt) and briefly creates server logs with technical data such as IP address, time and page requested.
We store applications, referral data and settings in a database of the provider Turso (ChiselStrike Inc., USA).
The legal basis is our legitimate interest in operating the website securely and reliably (Art. 6(1)(f) GDPR). Where data is transferred to the USA, we rely on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses (Chapter V GDPR).
3. Cookies and local storage
The following entries are stored in your browser. We load analytics and marketing services (section 4) and their cookies only with your consent (§ 165(3) TKG 2021). You can change or withdraw your choice at any time via “Cookie settings” in the footer of every page.
- NEXT_LOCALE (cookie): selected language – until the end of the session
- sgs_cookie_consent (local storage): your cookie choice – 12 months
- _ga, _ga_<ID> (Google Analytics cookies, only with consent): distinguishing visitors – up to 2 years
- _fbp (Meta Pixel cookie, only with consent): attributing visits from ads – 3 months
- sgs_ab_tests (local storage): assignment to a text variant of the home page – until you clear the storage
- sgs_utm_params (session storage): origin of the visit, e.g. an ad campaign – until the tab is closed
- sgs_exit_intent_shown / sgs_exit_intent_last_shown: whether the notice on leaving the page has been shown – session or 30 days
- sgs_chat_notice_ack (session storage): chat data notice read – until the tab is closed
- sgs_referral (session storage): referral code from a referral link – until the tab is closed
- Login cookies of the admin area: only for signed-in staff – at most 24 hours
4. Web analytics and marketing
Only if you agree in the cookie settings (Art. 6(1)(a) GDPR) do we use the following services. Without consent they are not loaded; withdrawal takes effect for the future.
- Google Analytics 4 (Google Ireland Ltd., Ireland): audience measurement with shortened IP address and without Google Signals. A transfer to Google LLC in the USA is possible; it relies on the EU-US Data Privacy Framework.
- Meta Pixel (Meta Platforms Ireland Ltd., Ireland): measuring whether visits from our ads lead to applications, and targeting these ads. A transfer to Meta Platforms Inc. in the USA is possible; it relies on the EU-US Data Privacy Framework.
5. Application
When you apply through our form, we process: name, phone number, email address, place of residence, selected professions, work experience, availability, details of assembly and industry experience, previous employers and plants, your CV if you upload one, the origin of your visit (e.g. a campaign), the language of the application and a referral code if you came through a referral.
The purpose is to review your application and to contact you. The legal basis is taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR); the automatic analysis of your CV is based on your consent (Art. 6(1)(a) GDPR, see section 6).
Recipients are our recruiting team and Resend Inc. (USA), through which we send you the confirmation of receipt and our team an internal notification; the transfer relies on standard contractual clauses.
We rank applications internally with a score so that we can process them faster. This is not an automated decision within the meaning of Art. 22 GDPR: every application is reviewed by a person.
6. CV and automatic analysis
Your CV is stored in non-public storage at Vercel (data centre in Frankfurt) and can only be accessed by our recruiting team after signing in.
To save you typing, we read the CV automatically as soon as you upload it and suggest entries for the form. For this it is transmitted to OpenRouter Inc. (USA) and processed there by an AI model, currently from Anthropic PBC (USA). You check every suggestion yourself; no automated decision is made.
The legal basis is your consent (Art. 6(1)(a) GDPR), which you give by uploading the CV after the notice in the form. You can withdraw it by removing the file before submitting or by writing to us. The CV is deleted together with the application; uploads that are not submitted are deleted after 24 hours.
7. Live chat
Chat messages are sent to OpenRouter Inc. (USA) and to the AI model of a US provider configured there by us in order to answer them. We do not store the chat history; it disappears when you close the page. Before your first message we inform you about this in the chat window.
Please do not enter health data or other particularly sensitive information in the chat. The legal basis is our legitimate interest in answering questions quickly (Art. 6(1)(f) GDPR).
8. WhatsApp and phone
If you write to us via WhatsApp, you do so at your own request. WhatsApp is operated by WhatsApp Ireland Ltd. (Meta), which processes its own data in the process; details can be found in WhatsApp's privacy notice. We use calls and messages only to handle your request.
9. Referral programme
Employees can recommend applicants through personal links. When such a link is opened, we count the click and attribute a later application to the referral. For this we store two pseudonyms, formed with a secret key (HMAC) and changing daily: one from IP address and browser identifier and one from the IP address alone. We do not store the browser identifier itself. The pseudonyms are deleted after 30 days.
The legal basis is our legitimate interest in attributing and rewarding referrals correctly (Art. 6(1)(f) GDPR).
10. Retention periods
We delete data automatically after these periods. If you are hired, we transfer the necessary details to your personnel file.
- Application and CV: 6 months after the last processing
- Contact requests not pursued: 6 months
- CV uploads that were not submitted: 24 hours
- Referral pseudonyms: 30 days
- Your cookie choice: 12 months
- Server logs of the host: briefly, according to the host's rules
11. Your rights
You have the right of access, rectification, erasure, restriction of processing and data portability (Art. 15–20 GDPR), the right to object to processing based on legitimate interests (Art. 21 GDPR) and the right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR). To do so, write to office@sgs-plant.com.
You can also lodge a complaint with the Austrian Data Protection Authority (Österreichische Datenschutzbehörde): Barichgasse 40–42, 1030 Wien, dsb@dsb.gv.at, www.dsb.gv.at.
12. Changes and status
We adapt this statement when our website or the legal situation changes. Last updated: October 2026.