Processing of (personal) data by the entity in charge of the online application process
General information
This data privacy statement, which refers exclusively to data collected as part of the online application process, is to inform you about how your personal data that is collected as part of the online application process is handled at our end.
The controller
The controller under data protection law is:
Procys B.V.
Commercial register entry number: 24193147/000019905211
Registration Court: Netherlands
Personal data collected as part of the application process
Personal data means any information concerning the personal or material circumstances of an identified or identifiable individual. This includes information such as, for example, your name, address, telephone number and date of birth, but also data relating to your specific career etc. by reference to which a specific individual can be identified with reasonable effort. However, information which cannot be (in)directly associated with your real-life identity is not personal data.
Depending on the role and stage of the recruitment process, the personal data we process may include identification and contact details, information contained in your CV and application documents, professional qualifications, skills, work experience, education, language abilities, location, interview and assessment information, correspondence with us, and information generated through the recruitment process.
Fundamentals and purposes of processing personal data collected from application documents and during the application process
If you apply to us electronically, i.e. via e-mail or using our online form, we will collect and process your personal data for the purpose of executing the application process and preparing contracts.
By submitting an application via our recruitment website, you express your interest in taking up work with us. In this context, you transmit personal data, which we will use and store exclusively for the purpose of your job search / application process.
Furthermore, you can choose to upload expressive documents such as a cover letter, your CV and reference letters. These may contain additional personal data such as date of birth, address etc.
Only authorized HR staff and/or staff involved in the application process have access to your data.
We process recruitment data as necessary to take steps at your request before entering into an employment contract (Article 6(1)(b) GDPR), to comply with legal obligations applicable to us (Article 6(1)(c) GDPR), and, where appropriate, on the basis of our legitimate interests in administering an effective and secure recruitment process, assessing candidates consistently, verifying information relevant to a role, preventing fraud and defending legal claims (Article 6(1)(f) GDPR). Where applicable law requires consent for a particular processing activity, we will request it separately and you may withdraw it in accordance with applicable law.
If special categories of personal data are processed during recruitment, we will do so only where a valid condition under Article 9 GDPR and applicable national law is available. We do not require applicants to provide special-category data unless it is necessary and legally permitted.
AI-assisted application screening
We may occasionally use Personio’s AI-assisted Talent Screening Agent to support the staff involved in reviewing applications. The tool analyses personal data contained in your application, in particular your CV and information concerning qualifications, skills, experience, education, language abilities and location that is relevant to the vacancy. It presents authorised recruitment staff with a structured overview of this information and an indication of how the application corresponds to role-related screening criteria.
The AI tool is used as an advisory and organisational aid. It does not make the final hiring, rejection or other employment decision. Authorised HR personnel and/or hiring staff remain responsible for reviewing applications and making recruitment decisions. We do not rely on a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR.
We configure screening criteria to relate to the requirements of the relevant role. We do not intentionally use protected characteristics, or proxies for protected characteristics, as screening criteria. The tool is not intended to infer special-category data. If such information is contained in an application, it will be handled only to the extent permitted by applicable law.
Background verification
For certain roles and generally at a later stage of the recruitment process, we may conduct proportionate pre-employment background checks where these are necessary and permitted by applicable law.
For these checks, we may process and disclose information to a third party necessary to verify your identity and the employment and education information you have provided. Relevant information may be obtained from you and, where appropriate and legally permitted, from former employers, educational institutions, verification sources and official or publicly available sources.
The legal basis for a background check will depend on the role, the check and the applicable jurisdiction. It may include our legitimate interests in verifying material information provided during recruitment and protecting the integrity and security of our hiring process (Article 6(1)(f) GDPR), steps connected with entering into an employment relationship (Article 6(1)(b) GDPR), and/or compliance with a legal obligation (Article 6(1)(c) GDPR). Where applicable law requires your consent or authorisation for a check, we will obtain it separately before carrying out that check.
We will not request or use background information that is not reasonably necessary for the relevant role. Checks involving criminal-conviction data or other specially protected information will only be carried out where specifically authorised by applicable law and subject to the safeguards required by that law.
The personal data is stored, as a rule, exclusively for the purpose of filling the vacancy for which you have applied.
Your data will be stored for a period of up to 180 days after the application process has been concluded. This is usually done to fulfill legal requirements and/or defending ourselves against any claims arising from legal provisions. After this period, we are obligated to delete or anonymize your data. In case of anonymization, the data will only be available to us in the form of so-called metadata, without any direct personal reference, for statistical analysis (for example, share of male and/or female applicants, number of applications per specified period of time etc.).
Furthermore, we reserve the right to store your data for up to 365 days after the application process has been concluded for the purpose of adding it to our Talent Pool in order to identify any other vacancies that may be of interest to you. We will ask for your written permission to be added to our Talent Pool.
Should you be offered and accept a position with us during the application process, we will store the personal data collected as part of the application process for at least the duration of your employment.
Background-verification information will be retained only for as long as necessary for the recruitment purpose, legal or compliance requirements, and the establishment, exercise or defence of legal claims. Where a successful candidate is hired, information that is necessary for the employment relationship may be transferred to the relevant personnel record in accordance with our employee retention rules.
Disclosure of data to third parties
Data transmitted as part of your application will be transferred using TLS encryption and stored in a database. This database is operated by Personio GmbH, which offers a human resource and applicant management software solution (https://www.personio.com/legal-notice/). In this context, Personio is our processor under article 28 of the GDPR. In this case, the processing is based on an agreement for the processing of orders between us as the controller and Personio.
Where we use the Talent Screening Agent, the relevant application data is processed within the Personio recruitment environment for the purpose described above and subject to our data processing arrangements with Personio.
Where a background check is carried out, relevant applicant data will be disclosed to third party, where necessary for the verification, to parties such as former employers, educational institutions and verification sources. The third party processes personal data on our behalf to provide the requested background-verification services, subject to the applicable contractual data-protection arrangements.
Our service providers may use approved subprocessors. Access is limited to what is necessary to provide the relevant recruitment or verification service and is subject to contractual confidentiality, security and data-protection obligations.
International data transfers
Some service providers or their subprocessors may process personal data outside the European Economic Area. Where personal data is transferred to a country that has not been recognised by the European Commission as providing an adequate level of protection, we will ensure that an appropriate transfer mechanism under Chapter V GDPR is in place, such as the European Commission’s Standard Contractual Clauses where applicable, together with any supplementary measures required in the circumstances. Information about the applicable safeguards may be requested using the contact details below.
Rights of data subjects
If we as the controller process personal data, you as the data subject have certain rights under Chapter III of the EU General Data Protection Regulation (GDPR), depending on the legal basis and the purpose of the processing, in particular the right of access (article 15 of the GDPR) and the rights to rectification (article 16 of the GDPR), erasure (article 17 of the GDPR), restriction of processing (article 18 of the GDPR), and data portability (article 20 of the GDPR), as well as the right to object (article 21 of the GDPR). If the personal data is processed with your consent, you have the right to withdraw this consent under article 7 III of the GDPR.
Where processing is based on our legitimate interests, you may object to that processing in accordance with Article 21 GDPR. You also have the right to lodge a complaint with the competent data protection supervisory authority.
To assert your rights as a data subject in relation to the data processed during this online application process, please contact openprovider-jobs@m.personio.com
Concluding provisions
We reserve the right to adjust this data privacy statement at any point in time to ensure that it is in line with the current legal requirements at all times, or in order to accommodate changes in the application process or other processes. In this case, the new data privacy statement applies to any later visit of this recruitment website or any later job application.