Privacy Policy for Recruitment

The service for managing recruitment and streamlining the hiring process (the “Service”) is provided by Lucca on behalf of Helexia (the “Controller”, “we”, “our”, etc.). It is important that those using the Service (the “Users”) feel secure and are informed about how we process their personal data as part of their recruitment process. We strive to maintain the highest possible standards of personal data protection. We process, manage, use and protect Users’ personal data in accordance with this Privacy Policy.

1. General

We are responsible for processing personal data in full compliance with applicable privacy legislation. Users’ personal data is processed for the purpose of managing and streamlining the recruitment of employees for our company.

2. Collection of personal data

We are responsible for processing the personal data that Users provide to the Service, or the personal data that we collect in any way in connection with the Service.

When and how we collect personal data

We collect personal data from Users when they:

• submit a request via the Service or otherwise and provide personal data relating to themselves, either directly or via a third-party source such as Facebook or LinkedIn; and
• use the Service to connect with our staff, adding personal data relating to themselves either directly or via a third-party source, such as Facebook or LinkedIn;
• and provide identifiable data in our chat (on the website operating the Service) that is relevant to an application process;

We collect data from third parties, such as Facebook, LinkedIn and other public sources. This is known as “sourcing”, an activity carried out manually by our staff or automatically by the Service.

In some cases, existing employees may make recommendations regarding potential candidates. These employees will add personal data relating to these potential candidates. Where this is done, the potential candidate will be regarded as a User for the purposes of this Privacy Policy and will be informed of the processing of their data.

Types of personal data collected and processed

The categories of personal data that may be collected via the Service may be used to identify individuals on the basis of names, email addresses, photographs and videos, information from Facebook and LinkedIn accounts, answers to questions asked during the recruitment process, job titles, educational qualifications or any other information that the User or any other person has provided via the Service. Only data relevant to the recruitment process is collected and processed.

Purpose and lawfulness of processing

The purpose of collecting and processing personal data is to manage the recruitment process. The lawfulness of processing personal data is based on our legitimate interest in simplifying and facilitating recruitment.

Personal data processed for the purposes of aggregated analysis or market research will be systematically anonymised. Such personal data cannot be used to identify a specific User. Consequently, this data is not considered to be personal data.

Consent of the data subject

The User consents to the processing of their personal data for the purpose of managing the Manager’s recruitment process. The User consents to personal data being collected via the Service when Users:

• submit an application via the Service, adding personal data relating to themselves either directly or by using a third-party source such as Facebook or LinkedIn, and when the Manager may use external sourcing tools to add further information; and
• when they use the Service to connect to the Manager’s recruitment service, adding personal data relating to themselves either directly or via a third-party source such as Facebook or LinkedIn.

The User also consents to the Manager collecting publicly available information about the User and compiling it for use for recruitment purposes.

The User consents to the personal data collected in accordance with (a) and (b) above being processed in accordance with the following sections: Storage and Transfer and Duration of Processing of Personal Data.

The User shall have the right to withdraw their consent at any time by contacting the Administrator using the contact details set out in paragraph 9. Exercising this right may, however, mean that the User will not be able to apply for a specific job or otherwise use the Service.

Storage and Transfers

Personal data collected via the Service is stored and processed within the EU/EEA, or in a third country deemed by the European Commission to offer an adequate level of protection, or processed by service providers who have entered into binding agreements that fully comply with the legal requirements for transfers to third countries, or to other services where adequate safeguards are in place to protect the rights of data subjects whose data is transferred. To obtain documentation regarding these adequate safeguards, please contact us using the contact details provided in paragraph 9.

Duration of personal data processing

Unless a User objects in writing to the processing of their personal data, such data will be stored and processed by us for as long as we deem necessary in view of the purposes set out above. Please note that a candidate (User) may be of interest for future recruitment and, to this end, we may need to retain Users’ personal data until they are no longer considered potential candidates. If, as a User, you do not wish your personal data to be processed for this purpose (future recruitment), please contact us using the contact details set out in paragraph 9.

3. Users’ rights

Users have the right to request information about the personal data processed by our services by notifying us in writing using the contact details set out in paragraph 9 below. Users have the right to receive one (1) copy of their personal data free of charge. For any further copies requested, the Data Controller shall be entitled to charge a reasonable fee, based on the administrative costs incurred in processing such a request.

Users have the right, where necessary, to rectify any inaccurate personal data concerning them by submitting a written request to the contact details set out in paragraph 9 below.

The user may request the erasure or restriction of their data, or exercise their right to object to the processing of their data on the grounds of a legitimate interest, regardless of the circumstances.

The User has the right to withdraw any consent to processing that they have given to the Controller. Exercising this right may, however, mean that the User will no longer be able to apply for a specific job vacancy or otherwise use the Service.

In certain circumstances, the User has a right to data portability, which means they have the right to obtain their personal data and transfer it to another Controller, provided this does not adversely affect the rights and freedoms of others.

The user shall have the right to lodge a complaint with the supervisory authority regarding the processing of their personal data if they consider that the processing of such personal data infringes the legal framework set out in the Data Protection Act.

4. Security

We prioritise personal integrity and therefore work actively to ensure that users’ personal data is processed with the utmost care. Consequently, we take the measures that can reasonably be expected to ensure that the personal data of users and other individuals is processed securely and in accordance with this privacy policy and the GDPR.

However, data transfers over the internet and mobile networks can never be entirely risk-free; consequently, all transfers are made at the sender’s own risk. It is important that users also take responsibility for ensuring that their data is properly protected. It is the user’s responsibility to ensure that their login details remain confidential.

5. Transfer of personal data to third parties

We will not sell or transfer Users’ personal data to third parties in any way.

We may transfer Users’ personal data:

• to our partners and subcontractors, acting as data processors and subcontractors in accordance with our instructions, in order to provide the Service;
• to the authorities or legal advisers in the event of suspected criminal or inappropriate behaviour; or
• to the authorities, legal advisers or any other similar body, where required by law or where we are requested to do so by the relevant authority.

We only transfer Users’ personal data to third parties we trust. We carefully select our partners to ensure that Users’ personal data is processed in accordance with applicable data protection legislation. We cooperate with the following categories of personal data processors: Lucca, which provides the Service; server and hosting companies; email marketing companies; video processing companies; information providers; analytics service providers; and any other companies involved in the provision of the Service.

6. Aggregated data (non-personally identifiable data)

We may share aggregated data with third parties. In such cases, the aggregated data has been compiled from information collected via the Service and may, for example, consist of internet traffic statistics or geographical location data relating to the use of the Service. Aggregated data does not contain any information that can be used to identify individual persons and is therefore not personal data.

7. Cookies

When Users use the Service, information relating to their use may be stored in the form of cookies. Cookies are passive text files that are stored in the web browser on the User’s device (a computer, mobile phone or tablet) whilst using the Service. We use these cookies to improve the User’s experience of the Service and to collect information on, for example, usage statistics for the Service.

Users may disable cookies at any time by changing the local settings on their devices. Disabling cookies may affect their experience of the Service, for example by disabling certain features of the Service.

8. Amendments

We reserve the right to make changes or additions to our Privacy Policy at any time. The latest version of our Privacy Policy will always be available via the Service. A new version will be deemed to have been communicated to Users when they have received an email informing them of the new version (using the email address provided by the User in connection with their use of the Service), or when they have been informed in another way of the new Privacy Policy.

9. Contact

If you have any questions, would like further information about the processing of your personal data, or have any other enquiries, please use the contact details provided below: gdpr@helexia.eu