Processing of (personal) data by the entity in charge of the online application process

Privacy Statement Intigriti – Selection & Recruitment

1. Introduction

This Privacy Statement describes how INTIGRITI may process personal data in the context of its HR recruitment activities.

Who are we? Intigriti NV, a company incorporated and existing under the laws of Belgium with enterprise number 0660.623.646, has its headquarters at Klokstraat 16, 2600 Antwerp, Belgium.

The current privacy statement sets out which personal data we may process, how we may use it, with whom we may share it, and which rights you may have in this context. While this privacy statement describes how we usually process your personal data, the content of the current document may not be construed or interpreted as an obligation for us to process or preserve certain information. Moreover, we may decide not to process certain data about you and/or to delete any of your personal data prior to the completion of the processing term that is indicated below.

If you have any questions or remarks on how we process your personal data, please reach out to our privacy team at: privacy@intigriti.com .

2. Summary privacy statement

In order to inform you in an efficient and understandable manner about how we use your personal, we hereby provide a high-level overview of the processing activities we carry out.

Want more info? Please consult our Full privacy statement below.

2.1 Who are we?

Intigriti NV, a company incorporated and existing under the laws of Belgium with enterprise number 0660.623.646, has its headquarters at Klokstraat 16, 2600 Antwerp, Belgium.

2.2. How do we use and process your personal data?

We will mainly use your personal information to assess whether you are a suitable candidate for one or more of our vacancies, to compare you with other candidates, to select the ideal candidate and/or to make you a job offer.
If we contact you, or you contact us, via e-mail, telephone, regular post, or otherwise, we store any such written or digital communication.
If a discussion arises, we may further process your information to anticipate and/or handle that discussion or dispute.
We may use your information to generate aggregated/ anonymous statistics.

2.3. Who has access to your data?

Most of your data will stay within Intigriti, and will be shared with our personnel on a need-to-know basis.
We may engage processors, who can use your data only in accordance with our instructions thereto.

2.4. What are your rights?

In the context of the GDPR, you have certain rights in relation to your personal data, such as the right to be informed of the personal data we process about you, the right to rectify any data that is incorrect, and (in certain cases) the right to have your personal data deleted.
The exercise of these rights may be subject to legal conditions.
For an overview of the specific rights you have in the context of the processing of your personal data, please consult section 3.4 of this Privacy Statement.

2.5. How can you contact us?

Privacy@intigriti.com

3. Full privacy statement

In order to inform you more about how we use your personal data, we hereby provide a more detailed overview of the processing activities we carry out in the context of our platform.

Prefer to be informed of the essentials only? Please consult our Summary privacy statement above.

3.1. Who are we?

We are Intigriti NV, a company incorporated and existing under the laws of Belgium with enterprise number 0660.623.646.
Our principal seat of business is located at Klokstraat 16, 2600 Antwerp, Belgium.

3.2. How do we use and process your personal data?

We process the personal data described in the current section of this privacy statement. For each processing activity, we strive to explain why we process that data and will clarify the legal basis for the processing.

Searching for job candidates
When searching for suitable candidates for our vacancies, we may process your personal data.

Purpose:

We process the below information for the purpose of assessing whether you are a suitable candidate for one or more of our vacancies and to contact you in that context. We may also use this information to compare your qualifications with other candidates, to select the most suitable candidate for the job, to make you a job offer if we think you are the ideal candidate and/or to draft your employment contract.

Data Categories:

Identification data;
Contact details;
Personal details (date of birth, how you prefer to be addressed (M/V/X), area of residence, nationality);
Information about your education, diplomas, qualifications, and certificates;
Professional qualities, experience, skills, language knowledge,…
Information about your professional background (current or former professions and occupations, including company/employer, title, function, salary, etc.);
References;
Curriculum vitae and any personal data you mention therein;
Portfolios, test results, work-related content pieces;
Motivation letter and any personal data you mention therein;
Your expectations (e.g. in terms of salary, job content, remote working, working hours and vacation periods,…);
Information available on your professional social media profiles (e.g. Linkedin);
Photo;
Results from criminal record check (‘ok’ or ‘not ok’, we never store any details);
We may take notes about our conversations with you.

The data may be obtained from you directly, from recruiters, from references you have provided and/or from relevant public resources (such as professional websites or social media profiles).

Legal Basis:

The legal basis for the processing of your personal data is a contractual necessity: by processing your personal data we are taking pre-contractual measures for the performance of the employment contract between you and Intigriti.

We process this information based on your consent if you give us permission to further store your information after the processing term indicated hereunder.

Processing Term:

We strive to complete all selection procedures within three (3) months from receipt of the first candidacies. When the selection procedure is completed:

if you are not withheld, we will permanently delete or destroy your personal data within a period of 2 calendar years;
If you agree to be added to our talent pool, we may continue to store your information (each time) for an additional period of 2 years from receipt of your consent;
if you sign an employment agreement with us, we may add relevant information we hold about you to your personnel file. Before you sign your employment contract, we will provide you with the necessary information about how we will further process your personal data in that context.

Recipients:

Within our company, only authorized HR staff and/or staff involved in the application process have access to your data. We may share your information with external advisors (e.g. recruitment partners).

Furthermore, we use various suppliers and service providers and may share personal data with them, where this is needed or useful to enable them to provide their assistance or services to us (e.g. hosting providers or parties who assist us in securing our premises, etc.). These parties may only process your personal data in accordance with our instructions thereto.

Communication data
We process this information if you communicate with us by means of website forms, e-mail, telephone, face-to-face, or otherwise.

Purpose:

We store our written (including digital) communications with you for back-up and evidentiary purposes.

Data Categories:

Communication data, including any metadata (e.g. e-mails, e-mail address, time of receipt).

Legal Basis:

Our legitimate interests, namely our freedom to operate our business and our interest in preserving evidence of communications made.

Processing Term:

During the period relevant for legal action (currently 10 years).

Recipients:

Internally, we will share your information with our personnel that has a need to know it for the above purpose. Furthermore, we use various suppliers and service providers and may share personal data with them, where this is needed or useful to enable them to provide their assistance or services to us (e.g. hosting providers or parties who assist us in securing our premises, etc.). These parties may only process your personal data in accordance with our instructions thereto.

Risk and claims management
If, during the above storage term(s) a discussion arises between us, we may further preserve personal data that we process in the context of the other purposes outlined herein, for the purpose of allowing ourselves to demonstrate certain events or actions that took place and to resolve any disputes (including potential legal proceedings).

Purpose:

The data will be used for evidentiary purposes, to anticipate potential complaints, questions, demands, claims, proceedings and/or liabilities (either from or vis-à-vis- Intigriti) and, where applicable, to follow up on any such matters.

Data Categories:

Identification and contact data;
Personal characteristics (date of birth);
Activities of acceptance, confirmation, or permission (such as signatures, ticking boxes, etc.);
Actions you undertake vis-s-vis us (e.g. where you exercise a right to be forgotten);
Personal data included in agreements or linked to the signature thereof;
Other events or data that may be relevant to us for evidentiary purposes.

Legal Basis:

Legitimate interest, namely in the context of risk- and claims management (including the collection of debts).

Processing Term:

During the period relevant for legal action (in most cases this will be 10 years).

Recipients:

Internally, we will share your information with our personnel that has a need to know for the above purpose. Information may be shared with legal or other relevant advisors, court instances, bailiffs and other parties involved in a dispute, claim, or demand. Furthermore, we use various suppliers and service providers and may share personal data with them, where this is needed or useful to enable them to provide their assistance or services to us (e.g. hosting providers or parties who assist us in securing our premises, etc.). These parties may only process your personal data in accordance with our instructions thereto.

We will store your personal data within the European Economic Area, or countries that provide an adequate level of protection only. If personal data would be processed outside of the EEA, we will apply measures to ensure an adequate level of protection of your personal data, equivalent to the protection within the EEA.

3.3 Which rights do you have in relation to your personal data?

In accordance with the provisions of the GDPR, you have several rights with regard to the personal data that we process about you. We try to explain your rights here in a simplified way here. Please note that the exercise of your rights may be subject to additional legal conditions.

To exercise any of your rights, please send us a written request, using the contact details indicated in the “Introduction” of this Privacy Statement. We will respond to your request without undue delay, but in any event within one month of the receipt of the request. In the event of an extension of the term to respond or in the event we do not take action on your request, we will notify you.

Right to information and right of access

You have the right to confirmation as to whether or not we process your personal data and, in the event we do so, you have the right to access such personal data, together with certain additional information that you also find listed in this Privacy Statement. You have the right to receive from us a copy of your personal data we have in our possession, provided that this does not adversely affect the rights and freedoms of others. The first copy will be provided free of charge, but we reserve the right to charge a reasonable fee if you request further copies.

Right to rectification

If the personal data we hold about you is inaccurate or incomplete, you have the right to have this information rectified or, taking into account the purposes of the processing, completed. Have you noticed an error in the information we hold? Please let us know using the contact details below.

Right to erasure (“right to be forgotten”)
You have the right to ask us to erase your personal data. We are obliged to comply with this request in each of the following situations:

If we no longer need the data for the purposes for which it was collected or otherwise processed.
If the data is processed on the basis of consent, you withdraw your consent, and there is no other legal basis for the processing.
If you object to the processing on grounds relating to your particular situation and there are no overriding legitimate grounds for processing.
If you object to the processing of your data for direct marketing purposes.
If we have processed your personal data unlawfully.
If the personal data must be deleted to comply with a legal obligation to which we are subject.

There are certain exclusions to the right to erasure. Those exclusions include the situation where processing is necessary:

for exercising the right of freedom of expression and information;
for compliance with a legal obligation; or
for the establishment, exercise, or defense of legal claims.

Right to restriction of processing

You have the right to restrict the processing of your personal data (meaning that the personal data may only be stored by us and may only be used for limited purposes), if:

You contest the accuracy of the personal data (and only for as long as it takes to verify that accuracy);
The processing is unlawful and you request restriction (as opposed to exercising the right to erasure);
We no longer need the personal data for the purposes of our processing, but you require personal data for the establishment, exercise, or defense of legal claims; or
You have objected to processing, pending the verification of that objection.

In addition to our right to store your personal data, we may still otherwise process it but only:

with your consent;
for the establishment, exercise, or defense of legal claims;
for the protection of the rights of another natural or legal person; or
for reasons of important public interest.

We will inform you before we lift the restriction of processing.

Right to data portability

To the extent that the legal basis for our processing of your personal data is consent, and such processing is carried out by automated means, you have the right to receive your personal data from us in a structured, commonly used, and machine-readable format. However, this right does not apply where it would adversely affect the rights and freedoms of others. You also have the right to have your personal data transferred directly to another company, if this is technically possible, and/or to store your personal data for further personal use on a private device.

Right to withdraw your consent

If the processing is based on your consent, you have the right to withdraw this consent in the future. Please contact us if you no longer want to be included in our talent pool and/or no longer want to be contacted in the context of our vacancies.

Automated decision-making and profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you, or similarly significantly affects you.

Right to object to processing

Where we process your personal data based on legitimate interests, you have the right to object to the processing of your personal data on grounds relating to your particular situation. You also have the right to object to the use of your personal data for direct marketing purposes. In this case, no specific reason is required.

How can you exercise your rights?

You can contact your right to contact us per e-mail at: privacy@intigriti.com
We may ask you to prove your identity, for example by sending us a copy of the front of your identity card.

You have the right to lodge a complaint with the Belgian Data Protection Authority:

Data Protection Authority
Rue du Printing 35
1000 Brussels
Tel. +32 (0)2 274 48 00 - Fax +32 (0)2 274 48 35,
E-mail: contact@apd-gba.be

This is without prejudice to the possibility of taking legal action before the civil courts. If you have suffered damage as a result of the processing of your personal data, you can submit a claim for compensation.

3.4. Amendments to the privacy statement

We may update this Privacy Statement from time to time. If a change materially impacts how we handle any data we hold of you, we will inform you via e-mail.

V3(2023)
Last reviewed on 24 January 2023

Processing of (personal) data by the operator of the recruitment website

General information

This recruitment website is operated by Personio SE & Co. KG, which offers a human resource and candidate management software solution (https://www.personio.com/legal-notice/). Data transmitted as part of your application will be transferred using TLS encryption and stored in a database. The sole controller of this data within the meaning of article 24 of the GDPR is the enterprise carrying out this online application process. Personio’s role is limited to operating the software and this recruitment website and, in this context, being a processor under article 28 of the GDPR. In this case, the processing by Personio is based on an agreement for the processing of orders between the controller and Personio. In addition, Personio SE & Co. KG processes further data, some of which may be personal data, to provide its services, in particular for operating this recruitment website. We will refer to this in more detail below.

The controller

The controller under data protection law is:
Personio SE & Co. KG
Seidlstraße 3
80335 München
Tel.: +49 (89) 1250 1004
Entry in the commercial register
Commercial register entry number: HRA 115934
Registration Court: Amtsgericht München
Data Protection Officer contact: privacy@personio.com

Access logs (“server logs”)

Each access to this recruitment website automatically causes general protocol data, so-called server logs, to be collected. As a rule, this data is a pseudonym and thus does not allow for inferences about the identity of an individual. Without this data, it would, in some cases, be technically impossible to deliver or display the contents of the software. In addition, processing this data is absolutely necessary under security aspects, in particular for access, input, transfer, and storage control. Furthermore, this anonymous information can be used for statistical purposes and for optimizing services and technology. In addition, the log files can be checked and analyzed retrospectively when unlawful use of the software is suspected. The legal basis for this is §25 subsection 2 Sentence 2 TDDDG. Generally, data such as the domain name of the website, the web browser and web-browser version, the operating system, the IP address, as well as the timestamp of the access to the software is collected. The scope of this log process does not exceed the common log scope of any other site on the web. These access logs are stored for a period of up to 7 days. There is no right to object to this.

Error logs

So-called error logs are generated for the purpose of identifying and fixing bugs. This is absolutely necessary to ensure we can react as quickly as possible to possible problems with displaying and implementing content (legitimate interest). As a rule, this data is a pseudonym and thus does not allow for inferences about the identity of an individual. The legal basis for this is §25 subsection 2 Sentence 2 TDDDG. When an error message occurs, general data such as the domain name of the website, the web browser and web-browser version, the operating system, the IP address, as well as the timestamp upon occurrence of the respective error message and/or specification is collected. These error logs are stored for a period of up to 7 days. There is no right to object to this.

Use of cookies

So-called cookies are used on parts of this recruitment website. They are small text files which are stored on the device with which you access this recruitment website. As a general rule, cookies serve the purpose of ensuring secure access to a website (“absolutely necessary”), implementing certain functionalities such as standard-language settings (“functional”), improving the user experience or the performance of the website (“performance”), or placing targeted advertisements (“marketing”). On this recruitment website, we generally use only cookies that are absolutely necessary, functional or performance-related, in particular for implementing certain default settings such as language, for identifying the job advertising channel, or for analyzing the performance of a job advert via which a user accessed this recruitment website. The use of cookies is absolutely necessary for providing our services and thus for the performance of the contract (article 6 (1) b) of the GDPR). Period of storage: up to 1 month or until the end of the browser session Right to object: You can determine via your browser settings whether you allow or object to the use of cookies. Please note that deactivating cookies may result in limited or completely blocked functionalities of this recruitment website.

Rights of data subjects

If Personio SE & Co. KG as the controller processes personal data, you as the data subject have certain rights under Chapter III of the EU General Data Protection Regulation (GDPR), depending on the legal basis and the purpose of the processing, in particular the right of access (article 15 of the GDPR) and the rights to rectification (article 16 of the GDPR), erasure (article 17 of the GDPR), restriction of processing (article 18 of the GDPR), and data portability (article 20 of the GDPR), as well as the right to object (article 21 of the GDPR). If the personal data is processed with your consent, you have the right to withdraw this consent under article 7 III of the GDPR. To assert your rights as a data subject in relation to the data processed for the purpose of operating this recruitment website, please refer to Personio SE & Co. KG’s Data Protection Officer (see item B).

Concluding provisions

Personio reserves the right to adjust this data privacy statement at any point in time to ensure that it is in line with the current legal requirements at all times, or in order to accommodate changes in the services offered, for example when new services are introduced. In this case, the new data privacy statement applies to any later visit of this recruitment website or any later job application.