Last updated: 07/10/2024
This policy (hereinafter referred to as the “Policy”) covers the processing of personal data of candidates for a position within HYVIA in the context of (i) a response to a job offer published on the HYVIA website https://www.hyvia.eu/ (the “Site”) or on a third-party site and/or (ii) a spontaneous application via the form on the Site or by any other means (hereinafter collectively referred to as “you”).
Your personal data is processed in accordance with the terms of the Policy. The purpose of the Policy is to inform you about the processing of personal data concerning you and to present the commitments made by HYVIA regarding the protection of personal data.
For any questions regarding our Policy, you can contact us by email at: data.office@hyvia.eu or by letter at the address mentioned above.
The data collected during your application is processed by HYVIA, a simplified joint-stock company, registered with the R.C.S. of Versailles under number 899 902 191, whose registered office is located at 42 route de Beynes, 78640 Villiers-Saint-Frédéric, represented by Mr. Nicolas Champetier, in his capacity as President, as the data controller (“HYVIA” or “we”).
HYVIA has appointed the law firm Harlay Avocats as the Data Protection Officer (the “DPO”), who can be contacted at the following email address: data.office@hyvia.eu.
Personal data is processed by HYVIA as the data controller for the specific, explicit, and legitimate purposes described below.
The data processing for the following purposes is necessary for the execution of pre-contractual measures taken at your request:
– processing applications; and
– managing interviews.
You are informed that the collection of the personal data identified below is necessary for the execution of pre-contractual measures taken at your request. Therefore, the collection and provision of this personal data condition the proper execution of the aforementioned pre-contractual measures. Failure to provide this personal data will prevent HYVIA from processing your application.
The data processing for the purpose of profiling is based on HYVIA’s legitimate interest in identifying potential candidates to strengthen its workforce.
Finally, HYVIA may process your data to create a CV database to contact you in case of new opportunities, provided you consent to it.
HYVIA processes only the personal data strictly necessary to achieve the purposes described above, which includes the following categories of data:
– Identification data: Name, first name, email address, phone number;
– Professional life data: professional experiences, education level, diplomas, all information provided on your CV, assessment of the candidate, and results of the situational exercise during an interview if applicable, any additional information you may provide during your application and/or an interview.
In compliance with the applicable texts, the processed data is communicated to the recipients indicated below when it is strictly necessary in view of their functions and missions.
Personal data may be communicated to the following recipients:
– authorized personnel within HYVIA, including the Human Resources department and the concerned managers;
– HYVIA’s subcontractors.
These recipients ensure the strict confidentiality of the personal data in their possession.
5. Subcontracting
When HYVIA uses subcontractors, it communicates your personal data only after obtaining an assurance and guarantees regarding their ability to meet these security and confidentiality requirements for personal data.
Furthermore, contracts are concluded between HYVIA and these subcontractors in compliance with the applicable regulations.
6. Are personal data transferred outside the European Economic Area?
The various categories of personal data processed by HYVIA, as outlined above, may be subject to data transfers outside the European Economic Area. When these countries do not have an adequacy decision from the European Commission, the transfers of personal data to these third countries are therefore governed by the conclusion of standard contractual clauses adopted by the European Commission or by any other appropriate guarantee provided by the GDPR.
In general, when we transfer your personal data outside the European Economic Area, we always do so securely and legally:
– either by transferring the personal data to a recipient located in a country that has been subject to an adequacy decision by the European Commission certifying that it has an adequate level of protection for personal data;
– or by executing or having executed the Standard Contractual Clauses approved by the European Commission as ensuring an adequate level of protection for your personal data;
– or by using any appropriate guarantees referred to in Article 46 of the GDPR.
You can obtain a copy of the guarantees governing data transfers outside the European Economic Area by requesting it at the following email address: data.office@hyvia.eu.
7. What are the retention periods for the processed data?
The processed data is kept only for the time necessary to achieve the purposes pursued during its collection. The retention periods applied to the data are proportionate to the purposes for which they were collected.
When your application is successful, your personal data is kept in the active database for the duration of the recruitment process until the hiring decision. After this decision, your data may be reused and retained for general personnel management purposes during your period of employment.
When your application is not successful, your personal data is retained for 3 months after the conclusion of the recruitment process. If you consent, your data may be retained for 2 years from the last contact with you to feed a CV database and contact you in case of new opportunities.
Beyond this period, your personal data is archived for evidential purposes, with administrations or social bodies, or any other authority, or for probative purposes (for example, in the event of litigation).
8. How is the processed personal data protected?
HYVIA places great importance on the security of the processed personal data.
HYVIA implements appropriate technical and organizational security measures to protect personal data from destruction, loss, alteration, unauthorized disclosure, or unauthorized access to such personal data.
9. What are your rights?
You have the following rights concerning the processing of personal data concerning you.
a) Right of access
You can obtain confirmation of whether your personal data is being processed or not. When your personal data is processed, you have the right to request a copy of your processed personal data and the following information regarding:
– the purposes of the processing;
– the categories of personal data concerned;
– the recipients or categories of recipients to whom the personal data has been or will be disclosed, particularly recipients established in third countries or international organizations;
– where possible, the period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
– the existence of the right to request from the data controller the rectification or erasure of your personal data, the right to request a restriction of the processing of your personal data, the right to object to such processing;
– the right to lodge a complaint with a supervisory authority;
– information relating to the source of the personal data where the personal data is not collected directly from you;
– the existence of automated decision-making, including profiling, and, where applicable, meaningful information about the logic involved, as well as the significance and the expected consequences of such processing for you;
– when the personal data is transferred to a third country or an international organization, information on the appropriate safeguards.
b) Right to rectification
You can request that your personal data be rectified and/or completed if it is inaccurate, incomplete, ambiguous, or outdated, as soon as possible.
c) Right to erasure of data
You can request the erasure of your personal data when one of the following reasons applies:
– the personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
you object to the processing of your personal data when there is no compelling legitimate ground for the processing;
– the personal data has been unlawfully processed;
– the personal data must be erased to comply with a legal obligation required by European Union law or the law of the Member State to which HYVIA is subject.
The right to erasure of personal data is not a general and absolute right. Therefore, it can only be granted if one of the reasons provided for in Article 17 of the GDPR applies.
Furthermore, HYVIA may not be able to respond favorably to a request for erasure in certain cases. This will be the case, for example, if HYVIA is required to retain personal data to meet a legal or regulatory obligation or if the processing of personal data is necessary for the establishment, exercise, or defense of legal claims.
d) Right to restriction of data processing
You can request the restriction of the processing of your personal data under the conditions provided by the applicable legislation and regulations. The cases in which the restriction of the processing of personal data can be requested are as follows:
– When you contest the accuracy of the personal data concerning you: the restriction of the processing must then be implemented until HYVIA can verify the accuracy of the personal data concerned;
– the processing is unlawful, but you oppose the erasure of the personal data: restriction of the processing is then an alternative to erasure of the personal data;
– HYVIA no longer needs to process the personal data, but you require the personal data for the establishment, exercise, or defense of legal claims;
– You have objected to the processing: the restriction of the processing must then be implemented during the verification of whether the legitimate grounds pursued by HYVIA override yours.
e) Right to object to data processing
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data based on the legitimate interest of HYVIA.
In the event of the exercise of such a right, HYVIA will no longer process the personal data subject to the objection unless it demonstrates compelling legitimate grounds for continuing the processing. These grounds must be superior to your interests and rights and freedoms, or the continuation of the processing may be justified for the establishment, exercise, or defense of legal claims.
f) Right to withdraw your consent
You can withdraw your consent at any time when the processing is based on your consent. We will then cease to process your personal data in the future, without affecting the lawfulness of the processing of your personal data carried out prior to the withdrawal of your consent.
g) Right to define directives concerning the storage, erasure, and communication of your personal data after your death
You can define specific directives concerning the storage, erasure, and communication of your personal data after your death with HYVIA’s services. These specific directives will only concern the processing of personal data implemented by HYVIA and will be limited to this scope.
You can also define general directives concerning the storage, erasure, and communication of your personal data after your death with a trusted third party certified and responsible for ensuring that your wishes are respected, in accordance with the applicable regulations.
h) Right to lodge a complaint
If, despite all the care taken by HYVIA in protecting your personal data, you believe that your rights are not being respected, you have the right to lodge a complaint with the Commission Nationale de l’Informatique et des Libertés (CNIL) at the following address: 3 Place de Fontenoy – TSA 80715 – 75334 PARIS CEDEX 07.
i) How to exercise your rights
For any request concerning the exercise of your rights, you can address your request to the following email address: data.office@hyvia.eu, providing proof of your identity by any means. In case of reasonable doubt regarding your identity, you may be asked for a copy of an identity document.