Privacy policy for the Kolsquare employer branding and recruitment
Date of publication: 07-06-2024
We at Kolsquare manage our employer branding and recruitment process through our career site (the “Career Site”), and by using a related applicant tracking system.
In this privacy policy, we explain how we process your personal data if:
You visit our Career Site (you being a “Visitor”)
You connect with us via our Career Site, to create a profile with us and receive information about current or future vacancies with us (you being a “Connecting Candidate”)
You apply for a position with us, via our Career Site or a third party service (you being an ”Applying Candidate”)
We collect information about you from other parties, sites and services, since we believe your profile is of interest for our current or future vacancies (you being a “Sourced Candidate”)
We receive information about you from our employees or partners, since they believe your profile is of interest for our current or future vacancies (you being a “Referred Candidate”)
We receive information about you from a Candidate, who lists you as their reference (you being a “Reference”).
This privacy policy also describes what rights you have when we process your personal data, and how you can exercise these rights.
When we use the term “Candidate” in this privacy policy, we are referring to each of Connecting Candidates; Applying Candidates; Sourced Candidates; and Referred Candidates, unless it’s stated otherwise.
1. About processing of personal data
Personal data is all information that can be directly or indirectly linked to a living, physical person. Examples of personal data are: name, e-mail address, telephone number and IP address. Processing of personal data is any automated use of personal data - such as collecting, creating, analyzing, sharing, and deleting personal data.
There are laws and regulations on how companies may process personal data, so-called data protection laws. Different data protection laws apply to different types of use of personal data, and in different parts of the world. An example of a data protection law that is relevant for our use of your personal data, as described in this privacy policy, is the EU Data Protection Regulation (2016/679, “GDPR”).
Most obligations under the GDPR apply to the so-called data controller. A data controller is the entity that decides for which purposes personal data will be processed, and how the processing will be executed. The data controller can use a so-called data processor. A data processor is an entity that is only allowed to process personal data as instructed by the data controller, and may not use the personal data for its own purposes.
We are the data controller when we process your personal data as described in this Privacy policy.
2. What personal data do we process?
All individuals
Device information - If you visit our Career Site, we will collect information about your device, such as IP address, browser type and version, session behaviour, traffic source, screen resolution, preferred language, geographic location, operating system and device settings/usage.
Technical and statistical data - If you visit our Career Site, we will collect technical and statistical data about your use of the site, such as information about which URLs you visit, and your activity on the site.
Communications data - We will collect and store your communication with us, including the information you provided in the communication. This may include the content of emails, video recordings, messages on social media, the information you add to your account with us, surveys, etc.
Contact details - Such as your name, email address, telephone number and physical address.
Candidates
Data from interviews, assessments and other information from the recruitment process - Such as notes from interviews with you, assessments and tests made, salary requirements.
Information in your application - Such as your CV, cover letter, work samples, references, letters of recommendation and education.
Information in your public profile - Meaning the information we collect about you from public sources related to your professional experience, such as LinkedIn or the website of your current employer.
Information provided by references - Meaning the information we receive from our employees or partners who refer you to us, or by the persons you have listed as your references.
3. Where do we receive your personal data from?
All individuals
From the Career Site. If you visit our Career Site, we collect technical and statistical information about how you use the Career Site, and information from your device.
Directly from you. Most of the information we process about you, we receive directly from you, for example when you apply for a position with us or connect with us. You can always choose not to provide us with certain information. However, some personal data is necessary in order for us to process your application or provide you the information you request to get from us.
References
From the person for whom you are a reference. If a Candidate lists you as their reference, we will collect your contact details from the candidate to be able to contact you.
Candidates
From public sources. We may collect personal data about you from public sources, such as LinkedIn or the website of your current employer.
From our references. We may receive information about you from our employees or partners (such as recruitment service providers), when they believe your profile is of interest for our current or future vacancies.
From your references. If you provide us with references, we may collect information about you from them.
Data we create ourselves or in cooperation with you. Information about your application and profile is usually created by us, or by us in cooperation with you, during the recruitment process. This may for example include notes from interviews with you, assessments and tests made.
4. For what purposes do we process your personal data?
Protect and enforce our rights, interests and the interests of others, for example in connection with legal claims.
Affected individuals: The individual(s) affected by the legal issue - this may include persons from all categories of individuals listed above.
Categories of personal data used: All the categories of personal data listed above can be used for this purpose.
Share your personal data with other recipients, for the purposes mentioned in Section 5 below.
Affected individuals: Varies depending on the purpose of the sharing, see Section 5 below.
Categories of personal data used: All the categories of personal data listed above may be used for this purpose.
Collect information about your use of the Career Site, using cookies and other tracking technologies, as described in our Cookie Policy.
Affected individuals: Visitors.
Categories of personal data used: Device information.
Maintain, develop, test, and otherwise ensure the security of the Career Site.
Affected individuals: Visitors.
Categories of personal data used: Device information; Technical and statistical data.
Analyse how the Career Site and its content is being used and is performing, to get statistics and to improve operational performance.
Affected individuals: Visitors.
Categories of personal data used: Device information; Technical and statistical data.
Provide you with updates about vacancies with us.
Affected individuals: Connecting Candidates.
Categories of personal data used: Contact details; Communications data.
Review profiles and applications sent to us. This also includes communicating with you about your application and profile.
Affected individuals: Connecting Candidates; Applying Candidates.
Categories of personal data used: All the categories of personal data listed above may be used for this purpose.
Collect and evaluate your professional profile on our own initiative. This also includes communicating with you regarding your profile.
Affected individuals: Sourced Candidates; Referred Candidates.
Categories of personal data used: All the categories of personal data listed above may be used for this purpose.
Contact you directly about specific, future vacancies with us.
Affected individuals: Candidates.
Categories of personal data used: All the categories of personal data listed above may be used for this purpose.
Record the interview(s) with you.
Affected individuals: Candidates.
Categories of personal data used: Communications data.
Contact you to ask for your participation in surveys
Affected individuals: Candidates.
Categories of personal data used: All the categories of personal data listed above may be used for this purpose.
Contact you to ask you to provide information about a Candidate, and evaluate the information you provide.
Affected individuals: References.
Categories of personal data used: Contact details; Communications data.
5. Whom do we share your personal data with?
Our service providers. We share your personal data with our suppliers who provide services and functionality in our employer branding- and recruitment process. For example, this includes recruitment service providers and the supplier of our Career Site and related applicant tracking system.
Our group companies. We share your personal data with our group companies, when they provide us services and functionality to our employer branding- and recruitment process, such as access to particular systems and software.
Companies providing cookies on the Career Site. If you consent to it, cookies are set by other companies than us, who will use the data collected by these cookies in accordance with their own privacy policy. You can find information about which cookies this applies to in our Cookie Policy.
To authorities and other public actors - when we are ordered to do so. We will share your personal data with authorities and other public actors when we have a legal obligation to do so.
To parties involved in legal proceedings. If needed to protect or defend our rights, we share your personal data with public authorities or with other parties involved in a potential or existing legal proceeding. This can for example be in case of discrimination claims.
Mergers and acquisitions etc. In connection with a potential merger, sale of company assets, financing, or acquisition of all or part of our business to another company, we may share your personal data to other parties involved in the process.
6. On what legal bases do we process your personal data?
To be able to process your personal data, we need to have a so-called legal basis. A legal basis is a reason for processing the personal data that is justified under the GDPR.
When we process your personal data for the purposes described in this Privacy Policy, the legal basis we rely on is normally that the processing is necessary for our legitimate interest in being able to recruit talent with the relevant competence for us. We have concluded that we have a legitimate interest in being able to perform the personal data processing for this purpose; that the processing is necessary to achieve that purpose; and that our interest outweighs your right not to have your data processed for this purpose.
You can contact us for more information about how this assessment was made. See Section 9 and 10 below for our contact information.
There may be specific circumstances when the processing is only performed if and when you provide your consent to the processing. This is for example the case if we propose to record an interview with you. Please see Section 9 below for more information about your right to withdraw your consent.
7. When do we transfer your personal data outside of the EU/EEA, and how do we protect it then?
We always strive to process your personal data within the EU/EEA area.
However, some of our service providers process your personal data outside of the EU/EEA. We also use suppliers whose parent company, or whose subcontractor’s parent company, is based outside the EU/EEA. In these cases, we have taken into account the risk that the personal data may be disclosed to countries outside the EU/EEA, for example because of an authority request.
In cases where another recipient of your personal data (as described in Section 5 above) is based outside the EU/EEA, this will also mean that your personal data is transferred outside the EU/EEA.
When we, or one of our suppliers, transfer your personal data outside the EU/EEA, we will ensure that a safeguard recognized by the GDPR is used to enable the transfer. We use the following safeguards:
A decision by the EU Commission that the country outside of the EU/EEA to which your personal data is transferred has an adequate level of protection, which corresponds to the level of protection afforded by the GDPR. In particular, we rely on the EU Commission’s adequacy decision for the US via the so-called EU-US Data Privacy Framework, and the adequacy decision for the UK.
Entering into the EU Commission’s standard clauses with the recipient of the personal data outside the EU/EEA. This means that the recipient guarantees that the level of protection for your personal data afforded by the GDPR still applies, and that your rights are still protected.
When your personal data is transferred outside the EU/EEA, we also implement appropriate technical and organizational safeguards, to protect the personal data in case of a disclosure. Exactly which protective measures we implement depends on what is technically feasible, and sufficiently effective, for the particular transfer.
If you want more information about the cases in which your personal data is transferred outside the EU/EEA you can contact us using the contact details in Section 9 and 10 below.
8. For how long do we keep your personal data?
All individuals
If we process your personal data for the purpose of being able to protect and enforce our rights, we will keep your personal data until the relevant legal issue has been fully and finally resolved.
Visitors
We keep your personal data for one (1) year for security purposes. The retention periods for cookies are set out in our Cookie Policy. We keep your personal data to analyse the performance of the Career Site for as long as we keep personal data about you for other purposes.
Candidates
If you are a Connecting Candidate (only), we keep your personal data for as long as you remain connected with us.
For other types of Candidates, we keep your personal data to decide if you are a suitable candidate for the relevant vacancy(ies) with us.
If you don’t succeed in the initial recruitment process, we keep your personal data for as long as needed to consider, and potentially contact you, for relevant future job openings.
If you are hired, we will keep your personal data during your employment, for other purposes than those stated above, which you will be informed of.
References
We keep your personal data for as long as we keep the personal data of the Candidate for whom you acted as a reference.
9. What rights do you have, and how can you exercise them?
In this section, you will find information about the rights you have when we process your personal data. As described below, some of the rights only come into play when we process your personal data under a particular legal basis.
If you want to exercise any of the rights listed here, we suggest that you:
Visit the Data & Privacy page on our Career Site, where we offer features to let you exercise your rights;
Log in to your account with us, where you can use the settings in the account to exercise your rights; or
Contact us directly at julia.bunte@team.blue.
Right to be informed
You have the right to be informed about how we process your personal data. You also have the right to be informed if we plan to process your personal data for any purpose other than that for which it was originally collected.
We provide you with such information through this privacy policy, through updates on our Career Site (see also Section 11 below), and by answering any questions you may have for us.
Right to access your personal data.
You have the right to know if we process personal data about you, and to receive a copy of the data we process about you. In connection with receiving the copy of your data, you will also receive information about how we process your personal data.
Right to access and to request a transfer of your personal data to another recipient (“data portability”).
You can request a copy of the personal data relating to you that we process for the performance of a contract with you, or based on your consent, in a structured, commonly used, machine-readable format. This will allow you to use this data somewhere else, for example to transfer it to another recipient. If technically feasible, you also have the right to request that we transfer your data directly to another recipient.
Right to have your personal data deleted (“right to be forgotten”).
In some cases, you have the right to have us delete personal data about you. This is for example the case if it’s no longer necessary for us to process the data for the purpose for which we collected it; if you withdraw your consent; if you have objected to the processing and there are no legitimate, overriding justifications for the processing. (For the separate right to object, see below.)
Right to object against our processing of your personal data.
You have the right to object to processing of your personal data which is based on our legitimate interest, by referencing your personal circumstances.
Right to restrict processing.
If you believe that the personal data we process about you is inaccurate, that our processing is unlawful, or that we don’t need the information for a specific purpose, you have the right to request that we restrict the processing of such personal data. If you object to our processing, as described just above, you can also request us to restrict processing of that personal data while we make our assessment of your request.
When our processing of your personal data is restricted, we will (with the exception of storage) only process the data with your consent or for the establishment, exercise or defence of legal claims, to protect the rights of another natural or legal person, or for reasons relating to an important public interest.
Right to rectification.
You have the right to request that we rectify inaccurate information, and that we complete information about you that you consider incomplete.
Right to withdraw your consent.
When we process your personal data based on your consent, you have the right to withdraw that consent at any time. If you do so, we will stop processing your data for the purposes you’ve withdrawn your consent for. However, it doesn’t affect the lawfulness of processing that was based on your consent before it was withdrawn.
Right to raise a complaint.
If you have complaints about our processing of your personal data, you can raise a complaint with the data protection authority in France. You can find their contact details here.
You can also lodge a complaint with your national data protection authority, which you can find listed here if you are based in the EU. If you are based in the UK, you can lodge a complaint with the Information Commissioner’s Office, here.
10. Where can you turn with comments or questions?
If you want to get in touch with us to exercise your rights, or if you have any questions, comments or concerns about how we handle your personal data, you can reach us by sending an email to catarina.pinto@team.blue.
11. Updates to this Privacy policy
We update this privacy policy when necessary - for example, because we start processing your personal data in a new way, because we want to make the information even clearer to you, or if it’s necessary to do so in order to comply with applicable data protection laws.
We encourage you to regularly check this page for any changes. You can always check the top of this page to see when this privacy policy was last updated.
--
team.blue HR Screening Policy
THIS HR SCREENING POLICY (hereinafter the “Policy”) has been developed by team.blue NV on behalf of itself and its group companies (hereinafter collectively, or as applicable, individually, the “Company” or “team.blue”), to provide guidance to the relevant stakeholders on the processing of candidate personal data in connection with pre-employment screening and verification activities (hereinafter the “Screening Activities”).
1 SCOPE
This Policy applies to the Company and its directors, officers and employees, so as any other person acting for or on behalf of the Company, to the extent they are involved in pre-employment activities.
Please refer to Annex 2 of this Policy for information on national regulatory requirements that may have an impact on the Screening Activities.
2 PURPOSE
The purpose of this Policy is to guide the Authorized Persons in conducting Screening Activities in a lawful, fair, and transparent manner, with due regard for candidates' privacy, rights, and freedoms.
This Policy outlines the specific activities, legal basis, and processes for conducting various Screening Activities necessary for employment-related decisions and supports compliance with European Legislation and National Legislation.
3 REFERENCES, DEFINITION AND APPLICABLE LEGISLATION
Authority: means the local competent Data Protection Authority.
Authorized Person(s): refers to collaborators authorized to process Personal Data under the direct authority of the Company, in its role of Controller, under Arts. 4 (10) and 29 GDPR. Under the definition given by the Article 29 Working Party in its Opinion 2/2017, this includes: employees and former employees, managers, auditors, collaborators and VAT-registered workers, on-call, part-time workers, job-sharing, fixed-term contracts, internships, without distinction of role, function and/or level, as well as consultants and suppliers and, more generally, all those who use or have used corporate tools or personal tools to operate on the Company network or are aware of relevant corporate information such as, by way of example but not limited to: (a) the Personal Data of customers, employees, applicants and suppliers, including e-mail addresses; (b) all information relating to confidential information of a commercial, financial or business strategy nature; as well as (c) data and information relating to business processes, including the creation of trademarks, patents and industrial property rights, the protection of which is independent of the prejudicial effects that could result from its disclosure.
Data Controller or Controller: means the natural or legal person, public authority, agency or organization which, individually or jointly with others, determines the purposes and means of data processing activities; where the purposes and means of such processing are determined by European Union or
Member State law, the Controller or the specific criteria applicable to its designation may be established by Union or Member State law.
Data Processor or Processor: means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
Data Subject: means refers to an identified or identifiable natural person. By way of example but not limited to, partnerships, sole proprietorships, professionals and agents of joint stock companies may be considered as Data Subjects.
DPO or Data Protection Officer: a natural or legal person represented by a natural person, whose appointment by the Data Controller or Data Processor is mandatory under art. 37.1 of the GDPR, and who must have specialist knowledge of the European and National Legislation, security best practices and the Processing Activities conducted by the Data Controller or Data Processor, in order to assist them in matters concerning privacy compliance.
European Legislation: means the applicable European Union law.
GDPR: means the General Data Protection Regulation (EU) n. 679/2016.
Joint Controllers: two or more controllers who jointly determine the purposes and means of processing, are considered as joint controllers.
Judicial Data: Personal Data relating to criminal convictions and offences or related to security measures.
National Legislation: means, within the European Union/European Economic Area, the Member State applicable legislation; outside of the European Union/European Economic Area, means the applicable national legislation.
Personal Data: means any information concerning an identified or identifiable Data Subject. A Data Subject considered identifiable is one who can be identified, directly or indirectly, by an identifier such as a name, an identification number, location data, an online identifier or by one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.
Privacy Policy for Candidates: means the information notice for candidates written according to the Arts. 13 and 14 GDPR by the relevant Company of team.blue group.
Processing Activities: means a wide range of operations performed on Personal Data, including by manual or automated means. It includes the collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of Personal Data.
Special Categories of Personal Data: means Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or membership of a trade union, as well as Genetic Data, Biometric Data for the univocal identification of a Data subject, and Data concerning their health, sexual activity or sexual orientation.
This Policy is written in accordance with the GDPR, whereas specific requirements may be set by the National Legislation or Authority. Please refer to Annex 2 of this Policy for detailed information on the exact provisions that should be considered under the National Legislation.
Unless otherwise specified, all capitalized terms shall have the meaning given in this section “References, Definition and Applicable Legislation”.
4 DATA PROTECTION ROLES
The Company acts as the Data Controller, responsible for determining the purposes and means of processing candidate personal data.
Where the Company outsources the Screening Activities (see section “Screening Activities”) to third party service provider(s) (Authorized Agent, please refer to Annex 1 of this Policy for more information), the Authorized Agent typically acts as a Data Processor and processes data strictly on the Company’s instructions in compliance with a Data Processing Agreement (DPA), pursuant to Article 28 GDPR, and applicable legislations.
5 SCREENING ACTIVITIES
The Human Resource (HR) Department, which is responsible for recruitment activities, is tasked by team.blue group with the management of Screening Activities. All references to the “Screening Function” in this document refer to the Authorized Persons and/or third parties, including any Authorized Agents, required or contracted by the Company to carry out the requisite Screening Activities on behalf of the latter.
The Screening Function may request the support of the managing role of the HR Department, the privacy office (or the Data Protection Officer) at any time in case of doubts about the Processing of Personal Data.
5.1. DETERMINATION OF SCREENING ACTIVITIES
The Screening Function may undertake any or all of the defined activities in respect of candidates as deemed appropriate. The Screening Function is required to assess and determine the necessary activities on a case-by-case basis, and must ensure that it is proportionate, role-specific, and compliant with European Legislation and/or National Legislation.
1. Verification of Identity Document: team.blue may be required to verify a candidate’s identity in accordance with applicable national laws. For this purpose, the personal data provided by the candidate may be verified against a valid identity document, which the candidate will be requested to submit to the Authorized Agent.
Legal Basis: Performance of a contract to which the data subject is party or taking steps at the data subject's request prior to entering into a contract
2. Education: team.blue may need to verify a candidate’s educational background to confirm credentials relevant to the job role and to ensure compliance with job-specific competency requirements. For this purpose, the educational details provided by the candidate may be verified with the relevant institutions in each applicable jurisdiction.
Legal Basis: This processing is carried out on the basis of the Company’s legitimate interests (Article 6(1)(f) GDPR), specifically the interest in ensuring that candidates meet the required qualifications for the role and in maintaining the integrity of the recruitment process.
3. Work Experience: team.blue may need to verify a candidate’s previous work experience to confirm the accuracy of the employment history provided and to assess suitability for the role. For this purpose, the candidate’s employment details may be verified with the references identified by the candidate.
Legal Basis: This processing is carried out on the basis of the Company’s legitimate interests (Article 6(1)(f) GDPR), namely the interest in ensuring the accuracy of a candidate’s employment history, assessing their suitability for the role and the Company, and in maintaining the integrity of the recruitment and selection process.
4. Work Permit Check (Right to Work): team.blue may be required to confirm that a candidate has the legal right to work in the country where the role is based, in accordance with applicable immigration and employment laws. For this purpose, the personal data provided by the candidate may be verified against relevant official documentation.
Legal Basis: This processing is carried out to comply with the Company’s legal obligations under applicable employment and immigration laws to confirm that a candidate has a valid right to work. The lawful basis for this activity is therefore Article 6(1)(c) GDPR (compliance with a legal obligation). Where required, documentation of the specific jurisdictional requirements will be maintained to demonstrate compliance.
5. Criminal Background Check: team.blue may need to verify a candidate’s criminal background where permitted by applicable laws and necessary for the position applied for. For this purpose, relevant
personal data may be checked with the appropriate authorities in the relevant jurisdictions to ensure suitability and maintain a safe working environment.
Legal Basis: This processing is carried out on the basis of the Company’s legitimate interests (Article 6(1)(f) GDPR), specifically the interest in protecting its systems, data, and customers by verifying the integrity and trustworthiness of candidates for security-sensitive roles. Where this legal basis is confirmed, a Legitimate Interests Assessment (LIA) will be documented in compliance with GDPR and applicable national laws governing criminal record checks.
Where relevant, a Legitimate Interest Assessment (LIA), pursuant to Article 6(1)(f) GDPR and/or Data Protection Impact Assessment (DPIA), pursuant to Article 35 GDPR, have been conducted and documented, aimed at identifying the risks and balancing the rights and freedoms of the data subjects with the legitimate interests of the Company, which have yielded a positive outcome for the Company.
5.2. PROCESS FOR SCREENING ACTIVITIES
Once the Screening Function has determined the appropriate activities for a candidate, it will carry out the Screening Activities or, as applicable, it will task the Authorized Agent with carrying out the Screening Activities, together with the necessary candidate personal data and adequate instructions. The Screening Function is responsible for ensuring that instructions provided to the Authorized Agent are in compliance with this Policy, European Legislation and/or National Legislation.
The Screening Function, or as applicable, the Authorized Agent will contact the candidate to initiate the screening and verification activities upon receiving instructions from the Screening Function. To facilitate this process, the Company may share certain common personal data collected during the recruitment process with the Authorized Agent to initiate the relevant activities.
The Screening Function, or as applicable, the Authorized Agent shall collect the requisite documentation and additional personal data necessary to perform the requested activities directly from the candidate. The Authorized Agent may also require the candidate to sign a Screening Declaration Form in order to proceed with the checks.
Upon completion of the screening process, the Authorized Agent shall upload the relevant documentation (“Screening Outcome”) to the designated platform. Based on Screening Outcome, the Screening Function may notify the appropriate stakeholders within the HR Department involved in the recruitment process for the next steps to be taken as per the established procedure.
5.3. INTERNAL DISCLOSURE OF CANDIDATE SCREENING OUTCOME
The Screening Function may share the Screening Outcome of any candidate, to the extent necessary, with other departments or Companies of the team.blue group.
5.4. DATA TRANSFERS BY AUTHORIZED AGENT
The Authorized Agent may be authorized to transfer the candidate's personal data to third parties based in countries outside the EEA/EU for the purposes of conducting the requisitioned Screening Activities, particularly, where necessary for the candidate to enter into employment contracts with the Company, pursuant to Article 49(1)(b) GDPR.
Please refer to Annex 2 of this Policy for detailed information on the exact provisions that should be considered under the National Legislation.
5.5. REQUESTS BY CANDIDATES UNDERGOING SCREENING ACTIVITIES
Candidates who are subject to Screening Activities at the instruction of the Company may exercise any of the entitled rights under European Legislation and/or National Legislation, including GDPR rights such as right of access, erasure, and correction.
Where a candidate exercises their GDPR right of erasure and has shared their information (including any documentation) directly to the Company or through the Authorized Agent, the Company shall delete the relevant records from its corporate applications, to the extent permitted by Article 17 GDPR. Please refer to the Company Procedure on Data Subject Requests Management for more information.
5.6. RETENTION OF PERSONAL DATA
The Company will retain personal data only for as long as necessary to fulfill the purposes outlined in the "Screening Activities" section and to comply with legal obligations. The relevant retention periods will be as defined in the Privacy Policy of Candidates of the Company.
If the candidate is subsequently hired, that is where the Screening Outcome returned a positive outcome, the processing of their Personal Data will be regulated by the relevant information notice for employees or such other notices provided by the Company based on the role of the employee.
5.7. SECURITY OF DATA
The Company has implemented, where applicable also via the Authorized Agents, appropriate technical and organizational measures to ensure the security and integrity of personal data.
6 NON-COMPLIANCE NOTIFICATIONS AND DISCIPLINARY MEASURES
All legal and natural persons identified in this Policy are expected to fully comply with the Policy and other data protection documentation notified from time to time.
The Legal Department, in collaboration with the Privacy Office (and with the Group Data Protection Officer), shall evaluate any exemptions from adherence to particular provisions of this document and other data protection documentation released from time to time. Exemptions are to be considered if special circumstances do not allow for the practical implementation of a requirement, if a National Legislation supports a requested exemption, and/or if there are compensating controls in place to mitigate the risk of non-compliance.
7 REVIEW AND UPDATES
The maintenance and periodic review of this Policy shall be carried out by the team.blue group, in particular by the Privacy Office and the HR Department, with the support of the Group Data Protection Officer (DPO), as applicable.
8 ANNEX 1: LIST OF AUTHORIZED AGENTS
team.blue has engaged the following third-party service providers as Authorized Agents to conduct Screening Activities on its behalf.
The Authorized Agents will be subject to this Screening Policy in addition to the relevant service agreements entered into with the Company.
NAME OF AUTHORIZED AGENT
Validata Group BV, trading as DISA Global Solutions (“Validata”)
RELEVANT INFORMATION
DISA Global Solutions
Apollolaan 151, 1077 AR Amsterdam.
Privacy Notice of Validata can be accessed at the following address: https://disa.com/emea/privacy-website/.
9 ANNEX 2-A: NATIONAL REQUIREMENTS AND RECOMMENDATIONS
Criminal record checks may only be carried out in jurisdictions where such processing is expressly permitted under applicable national law and where the Company has established a lawful basis in accordance with Article 6(1)(f) GDPR and Article 10 GDPR.
At present, criminal record checks may be conducted for relevant roles in the following jurisdictions:
· Denmark
· The Netherlands
· United Kingdom
· Ireland
· Germany
· Türkiye
The Company has received clear legal recommendations not to perform criminal record checks in the following jurisdictions at this time:
· Spain
· Portugal
· France
These recommendations are binding for operational purposes and must be followed until this policy is formally updated to permit such checks based on verified legal authority.