INFORMATION ON THE PROCESSING OF PERSONAL DATA ARTICLES 13 AND 14 OF REGULATION (EU) 2016/679 (‘GDPR’)

 

DATA CONTROLLER

Gi Group Belgium B.V, located at an Mommaertslaan 18 bus A, 1831 Machelen e-mail address be.privacy@gigroup.com

 

DATA PROTECTION OFFICER

The Data Protection Officer can be contacted at the following e-mail address: be.dpo@gigroup.com

 

PERSONAL DATA CATEGORIES AND DATA SOURCES

For the purposes set out below, the Controller will use the following categories of data: by way of example but not limited to, first name, surname, place and date of birth, residence and/or domicile, gender, telephone contact details, e-mail address, educational qualification, work experience and any further data you have entered in your CV.

Special categories of personal data:

We would also like to inform you that the Controller may process ‘special categories of data’ within the meaning of Article 9(2)(b) of the GDPR, e.g. data relating to disability, which may be contained in your CV or in any further documentation you may have submitted to the Controller.

If this is not the case, you will be given the opportunity to declare this information in your myGiGroup personal area or during a telephone interview or at one of the branches. This information is likely to reveal your state of health and falls under the special categories of data referred to in Article 9(1) of the GDPR and will be processed in accordance with the relevant legislation.

The legal basis applicable to the processing of special categories of personal data concerning you is your explicit consent pursuant to Article 9(2)(a) of the GDPR.

In the absence of your consent, it will not be possible to process data relating to membership of a protected category.

In any case, please do not indicate in your CV any special categories of data, for example, personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data intended to uniquely identify a natural person, data concerning a person’s health or sex life or sexual orientation).

Personal data are collected in the following ways:

Registration for the myGiGroup personal area via the Controller’ website (hereinafter also referred to as the ‘Site’) or via the App;

Third-party company websites (e.g. search engines for job offers) and social networks;

During an interview at one of the agencies

 

PURPOSES, LEGAL BASES AND RETENTION PERIODS

  1. Portal registration:

    Your data are processed for the purpose of registering in the personal area of the myGiGroup portal in order to create a personal profile on the portal that enables you to view our job offers and apply for them, in accordance with the Terms and Conditions available in the relevant section of the site.The legal basis applicable to the processing of your personal data for the purpose of registration on the portal is the performance of a contract within the meaning of Article 6(1)(b) of the GDPR.The retention period is 24 months from your last interaction with the Candidate’s personal area 

  2. Candidate Search and Selection Activities:

    Your data are processed both in case of application in response to a specific advertisement published on the Site, and in case of voluntary application through the Site for the pursuit of the purposes of search and selection of candidates, in particular:

    a. for placement on a temporary basis in our customer companies;

    b. for direct placement with our client companies; 

    c. for the implementation of measures or in the framework of collaborations and/or partnerships with public and private market operators, e.g. activation of traineeships, active labour policies, courses and training;

    d. to send you communications strictly related to the purposes of research and selection of candidates by traditional or automated contact methods, including communications relating to training course initiatives strictly related to a specific position, financed by our client companies or by inter-professional funds;

    e. to assess your professional skills and further training, to define individual and career development plans, to evaluate your performance when conducting psycho-aptitude, behavioural, technical or other assessments and tests.

    The legal basis applicable to the processing of your personal data for the purpose of search and selection of candidates is the execution of pre-contractual measures taken at your request pursuant to Article 6(1)(b) of the GDPR.

    The retention period is 24 months from your last interaction with the Candidate’s personal area.

  3. Sending job offers

    Your data may be processed to propose searches and selections of personnel in line with your profile in order to provide job placement, including by sending job offers by traditional or automated contact methods.The legal basis applicable to the processing of your personal data for the purpose of sending job proposals is the legitimate interest of the Controller in processing your data to secure your employment, pursuant to Article 6(1)(f) of the GDPR. If you object to such processing, your data will only be processed in the context of the specific selections for which you have appliedThe retention period is 24 months from your last interaction with the Candidate’s personal area or until you object to the processing.

  4. Aggregate analysis

    Your data may be processed:

    a. for analysis of aggregate data for statistical purposes, not aimed at detecting the behaviour of the data subjects and without direct effects on them, and for analysis of data for the purpose of verifying and forecasting company results and for internal and external auditing purposes, which do not affect the legal sphere of the data subjects. These analysis activities may also be carried out through the use of IT and artificial intelligence tools;

    b. in an aggregate manner for the maintenance and improvement of the systems used to perform the services, in a manner not aimed at detecting the behaviour of data subjects and without direct effect on them.The legal basis applicable to the processing of your personal data for the purpose of aggregate analysis is the legitimate interest of the Data Controller (maintenance and improvement of business systems) within the meaning of Article 6(1)(f) of the GDPR.The retention period is 24 months from your last interaction with the Candidate’s personal area or until you object to the processing.

  5. Legal defence

    Your data may also be processed for the purpose of establishing, exercising or defending a legal claim against us.The legal basis applicable to the processing of your personal data for the purpose of legal defence is the legitimate interest of the Controller (exercise or defence of a right in court) within the meaning of Article 6(1)(f) of the GDPR.The retention period is 10 years after registration and retained for the duration of the litigation, until the time limit for appeal is exhausted

  6. Marketing

    Your data may be processed to send you information and promotional communications relating to the services offered by the Data Controller (in particular, training initiatives, career development, coaching), or to carry out studies and statistical and/or market research on employment services, using both traditional and automated contact methods (e.g. e-mail, SMS, instant messaging systems, operator calls, paper mail).The legal basis applicable to the processing of your personal data for marketing purposes is your consent pursuant to Article 6(1)(a) of the GDPR.The retention period is 24 months from your last interaction with the Candidate’s personal area or until your consent is revoked.At the end of the aforementioned retention periods, Personal Data will be destroyed, deleted or anonymised, in accordance with technical deletion and backup procedures.

 

NATURE OF DATA PROVISION AND CONSEQUENCES OF REFUSAL

The provision of the data marked with an asterisk in the registration form for the myGiGroup personal area is necessary to enable the Controller to complete your registration (Portal Registration purposes); therefore, any refusal to provide the requested data will prevent the Controller from completing your registration with myGiGroup.

Providing the data marked with an asterisk in the data collection form on the Site or requested from the agencies is necessary to allow the Controller to pursue the search and selection purposes; therefore, any refusal to provide the requested data will prevent the Controller from carrying out the search and selection activity and will not allow your application to be considered.

The provision of data for Marketing purposes is optional. Any refusal to provide data or consent will have no consequence on your registration to myGiGroup and will not prevent the Controller from carrying out the search and selection activities.

 

PROCESSING METHODS

The processing of personal data will take place mainly by means of electronic tools and computerised procedures, but also by means of traditional tools and manual procedures, always under the supervision of appropriate security measures to counter the risk of destruction, loss, alteration or unauthorised disclosure of personal data, or of accidental or unlawful access to them.

 

RECIPIENTS OF DATA

Your data may only be processed by employees of the company departments authorised to process them as being responsible for pursuing the above-mentioned purposes. These employees have received adequate operational instructions in this regard.

Your personal data may be communicated by the Controller, for the pursuit of the above-mentioned purposes, to the following entities:

  • Client companies or entities;
  • Ministry of Labour;
  • Public bodies in the framework of the implementation of active labour policy paths or measures;
  • Other market players in the case of partnerships;
  • Legal advisers;
  • Training organisations;
  • Evaluation services;
  • Group companies;
  • Audit and/or supervisory bodies.

Your personal data may also be processed by persons, expressly appointed as Data Processors, who provide the Controller:

  • Site management and maintenance services;
  • Candidate database management and maintenance services;
  • Archiving services;
  • Mailing services for communication;
  • Market research services;
  • Evaluation and training service;
  • Event organisation services;
  • Marketing services.

An up-to-date list of recipients can be obtained by sending a request to the Controller.

Personal data provided by candidates will not be disseminated.

Data transfers to countries outside the EEA:

Your data may be transferred to the recipients referred to in the previous section located outside the European Economic Area (“EEA”), and in particular to countries whose level of data protection has been deemed adequate by the European Commission (Art. 45 of the GDPR), or, in the absence of such an adequacy decision, by signing standard contractual clauses (“SCC”) with the importer (Art. 46(2)(c) and (d) of the GDPR).

In the absence of the aforementioned adequate safeguards, any transfers to countries outside the EEA may be made on the basis of the exceptions provided for in Article 49(1)(b) and (c) of the GDPR. Data subjects will be specifically informed of such transfers.

The adequacy decisions can be consulted at the following link: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en

A copy of the standard contractual clauses signed by the Controller may be obtained by sending a request to the Controller).

 

RIGHTS OF THE DATA SUBJECTS

You are entitled to the rights set out in Articles 15 to 22 of the GDPR, where applicable.

In particular, you may request from the Data Controller access to your personal data, the rectification or erasure of the same, the integration of incomplete data, the restriction of processing in the cases provided for by Article 18 GDPR, as well as the objection to processing in the case of data processed for direct marketing purposes or for legitimate interests of the Data Controller.

He/she also has the right to receive the data provided to the Controller in a structured, commonly used and machine-readable format and, if technically feasible, to transmit it to another Data Controller without hindrance, if the conditions for the exercise of the right to portability set out in Article 20 of the GDPR are met.

These rights may be exercised by writing by post to the above addresses, or by e-mail to the following e-mail address: be.privacy@gigroup.com. It is understood that if the request is made electronically, the information will be provided in a commonly used electronic format.

He/she also has the right to lodge a complaint with the competent supervisory authority (in particular in the Member State where he/she normally resides or works or in the State where the alleged infringement occurred).