Employee Privacy Statement

Data Privacy Officer
gdpr.assessment@aon.com

Employee Data Protection Information

This document contains important information regarding data protection and the ways in which Aon’s Assessment Solutions (Aon) processes your personal data.

1. Purpose of the Processing

The employment relationship between yourself and Aon requires the processing of your personal data. Aon receives most of this personal data from you as part of your application and Onboarding process but will continue to collect personal data from you in the course of your employment.
Only data that is required in connection with your employment position will be processed - it will not be processed for any other purpose. The purposes of this processing are the:

- Establishment, administration, carrying out and termination of the employment relationship;
- Realisation of Aon’s legitimate business interests; and,
- Satisfaction of Aon’s legal obligations.

2. Legal Basis

2.1 The legal basis for the processing of your personal data is Article 6(1)(b) of Regulation (EU) 2016/679 (“GDPR”). Where national laws are applicable in this instance, Aon will inform you of these separately.

2.2 Where the processing of your personal data is not required for the establishment, administration or carrying out of your employment relationship, Aon may further process your personal data on the basis of Article 6(1)(f) of the GDPR. This will occur where the processing occurs based on legitimate interests pursued by Aon, which do not outweigh your rights as the data subject. The legitimate interests pursued by Aon are the carrying out of group-wide administrative tasks, the use and management of IT systems and infrastructure, the improvement of procedural and organisational structures and tasks, IT Security, occupational health and safety, insurances, travel services, relocation services and general compliance. Further legitimate interests are the carrying out and facilitation of Aon’s business interests and relationships with our business partners.

2.3 As an employer, Aon is subject to various legal obligations. These include the payment of duties and contributions, namely relevant taxes and social security contributions. Insofar as Aon processes or shares your personal data for this purpose, the legal basis for this will be Article 6(1)(c) of the GDPR. Where national laws provide for a more specific legal basis, Aon will inform you of these separately.

2.4 Where Aon processes special categories of your personal data (such as personal data relating to religion or health), the legal basis for this processing will be Article 9(2)(b) of the GDPR. Where national laws provide for a more specific legal basis, Aon will inform you of these separately.

2.5 In individual cases, the processing of your personal data may be based on your consent. In such instances, Aon shall expressly indicate to you that your consent is requested. Where this occurs, the legal basis for the processing shall be Article 6(1)(a) of the GDPR. Granting your consent is always voluntary. There will be no repercussions for not granting consent to a specific activity.

3. Recipients of your personal data

Your personal data will not be shared with third parties unless it is necessary for the purposes as described above. Where your personal data is shared, it will be restrained to the recipients as described below.

3.1 In certain circumstances, Aon will share your personal data with affiliates and subsidiaries of the Aon Group.

3.2 Aon will be obliged to disclose your personal data with a number of external agencies, namely the relevant tax office, insurance companies, pension providers, auditors and/or additional financial service providers. Aon will only share your personal data with these agencies as is required by law.

3.3 Aon works with various service providers (including payroll and accounting service providers), IT service providers and software vendors worldwide who will process your personal data depending on the nature of the application and service. This is particularly relevant where such services are provided as SaaS (Software as a Service).

3.4 Your personal data will be shared with relevant lawyers, tax advisors and creditors as required by Aon or by law.

3.5 Your personal data may be shared with suppliers, customers and other business partners where required to facilitate such business relationships.

4. Cross border Transfers

Aon is a global corporation. Therefore, your personal data may be transmitted to recipients in third countries that do not provide an adequate level of data protection per EU data protection laws. Where such transfer is required, Aon will ensure that sufficient safeguards are implemented, namely the conclusion of EU standard contractual clauses, and that your rights as the data subject are protected even where the processing occurs outside of the EU. These EU standard contractual clauses are considered adequate safeguards under the GDPR. Please contact GDPR Support if you would like a copy of these.

5. Storage of your personal data

Aon will not store your personal data for any longer than is necessary for the purpose. Where Aon is legally obliged to store your personal data, the period of retention will depend on national laws. These generally require a time period of between 3-10 years. Where national laws do not require the storage of your personal data, Aon will delete your personal data.

6. Your personal data rights

Aon will always provide information and assistance to you are regards your personal data and information therewith. You generally have the following rights over your personal data, as outlined below. When you make a request for your personal data, please specify in which form you wish to receive the information. If you do not specify this, Aon will respond to your request in the same form in which you made your request. We will make contact with you and attempt to resolve your request within a one month time frame. For manifestly unfounded or excessive requests, Aon is entitled to demand a reasonable fee or refuse the request.
Please contact your GDPR Executive if you wish to exercise your rights or obtain more information.

6.1 Access

You have the right to request confirmation as to whether Aon processes your personal data. Where Aon processes your personal data, you have the right to request access to your personal data.

6.2 Rectification

You have the right to request that inaccurate or incomplete personal data processed by Aon is rectified or completed. Your right to do so can be exercised by providing a supplementary statement. Where Aon has disclosed your personal data to other recipients, Aon will, where possible, inform them of such correction and provide information as to these recipients where you so request.

6.3 Erasure

You have the right to request the erasure of your personal data from Aon, where there is no legal exception for its retention. Please note that Aon is subjected to various legal storage requirements. Where Aon has disclosed your personal data to other recipients, Aon will, where possible, inform them of such correction and provide information as to these recipients where you so request.

6.4 Restriction of processing

You have the right in certain instances to request the restriction of the processing of your personal data. Where Aon has disclosed your personal data to other recipients, Aon will, where possible, inform them of such correction and provide information as to these recipients where you so request.

6.5 Data Portability

You may be entitled to request a copy of your personal data in a commonly used and machine readable format. This right includes the right to request Aon to transmit the personal data to another controller at your direction. This right is only available to you where the personal has been provided by you, and is processed on the basis of consent or on the performance of a contract, or where the processing is carried out by automated means.

7. Objection to the processing

In the instance that personal data is processed by Aon for the purpose of performing a task carried out in the public interest (Article 6(1)(e)), or for the purpose of Aon’s legitimate interests (Article 6(1)(f)), you may object to the future processing where Aon cannot demonstrate compelling legitimate grounds to continue the processing despite your request.

8. Withdrawing consent

Where the processing of your personal data is based on the basis of consent, you always maintain the right to withdraw consent for future processing, which shall have the same effect.

9. Complaints

You always maintain the right to submit a complaint with the competent supervisory authority in accordance with Article 77 of the GDPR in relation to Aon’s processing of your personal data

10. Provision of your personal data

The provision of your personal data is a necessity of your employment contract with us, as well as often required by national law. Failure or refusal to provide your personal data means we cannot carry out your employment contract or comply with necessary legal requirements. Not complying with these laws exposes Aon to risks of fines and other penalties. Aon will always provide you with information and explanations are to which personal data are specifically required pursuant to this.

11. Controller

The Controller of your personal data is:
Aon Assessment GmbH
Caffamacherreihe 16  
20355 Hamburg

12. Data Protection Officer

The Data Protection Officer can be contacted at:

gdpr.assessment@aon.com