PRIVACY POLICY
INFORMATION NOTE ON THE PROCESSING OF PERSONAL DATA WITHIN THE SG GSC ROMANIA’S RECRUITMENT PROCESS
- GENERAL PROVISIONS
By this Information Note Societe Generale Global Service Centre SA (hereinafter “SG GSC”/ “the Company”) wishes to inform you of the reasons why your personal data are processed by SG GSC Romania, as well as of a series of other information regarding the processing of your personal data, so that you can express your informed consent regarding the possibility of SG GSC Romania to process your personal data in order to take the necessary steps for your recruitment.
Thus, after the communication by SG GSC Romania of this Information Note, you will be asked if you agree that your identification and contact data, as well as those contained in documents such as CVs, letters of intent, etc. (hereinafter referred to as “Personal Data”) to be processed by SG GSC Romania for the purposes described below, including the creation of a profile in the database of Societe Generale, as this processing operation is described below.
Also, if your personal data has been provided to us by other sources, such as recruitment agencies, who will also inform you and ask for your consent by virtue of their status as independent data controllers, SG GSC Romania will provide you, through the online platform that manages the Societe Generale database, with the Information Note on the processing of your data by SG GSC Romania. In these situations, you will be contacted by the recruitment agency with which you are in a direct relationship, and the latter will ask you if you agree that your personal data be communicated to SG GSC Romania in order to send an application for one of the open positions within SG GSC Romania. To the extent that you agree, the recruitment agency will enter your data into the online recruitment platform of Societe Generale. Subsequently, you will receive an email that will contain both an information link to your data and a link that will lead you to the possibility of exercising your right of opposition and to delete your personal data from the Societe Generale database.
- APPLICABLE DEFINITIONS
Data Controller – the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data;
Data Processor – the natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;
Personal Data – any information relating to an identified or identifiable natural person (‘data subject’);
Data Subject – the person whose personal data are collected and processed – under this Policy, the candidate for one of the open positions within SG GSC Romania holds the quality of “data subject”;
GDPR – Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data;
Societe Generale – the group of entities Societe Generale Global Solution Center S.A. belongs to;
SG GSC Romania – Societe Generale Global Solution Centre S.A. – legal entity established in Romania and part of Societe Generale Group.
- PROCESSED DATA CATEGORIES
SG GSC Romania collects and processes your identification data (e.g. name, surname, e-mail address, contact telephone number), information regarding your professional and educational experience (information found in the Curriculum Vitae), Curriculum Vitae, as well as and recommendations from previous employers in order to process them for carrying out the necessary steps to complete the recruitment process.
- SOURCES WE USE TO COLLECT PERSONAL DATA
In addition to personal data obtained directly from you, we can obtain and process data relevant to the recruitment process from:
- Recruitment agencies and online recruitment platforms (we obtain contact data, as well as data related to the professional, personal and social history of the candidates);
- Referrals of potential candidates made by SG GSC Romania employees;
- Referrals of potential candidates made by member companies of the Societe Generale group
- Professional networks or other online sources dedicated to the processes of recruitment or promotion of professional profiles
- PERSONAL DATA PROCESSING PURPOSE
SG GSC Romania processes your personal data in order to take the necessary steps to start and complete the recruitment process. Fulfilling this purpose will consist, on the one hand, in verifying the information indicated above, and on the other hand, in interviews between you and the representatives of SG GSC Romania.
We specify that the processing of this data is necessary, first of all, to determine your desire to take part or not in a recruitment process for one of the open positions within SG GSC Romania and, on the other hand, to evaluate your compatibility with the position for which SG GSC Romania is recruiting/ employing and/ or with any other open position within SG GSC Romania or SG Group of undertakings.
Your refusal to provide personal data, as well as your objection 1to have your data processed by SG GSC Romania, may lead to SG GSC Romania’s inability to include you in the recruitment process and, where appropriate, to enter in contractual relations with you.
- LEGAL BASIS FOR THE PERSONAL DATA PROCESSING
| The purpose of the processing | The legal ground of the processing |
| Collection and storage of identification data, including information from CV, letter of recommendation in order to identify suitable candidates for a certain position opened by SG GSC Romania | Your consent |
| Creation of the individual account in the online recruitment platform of Societe Generale | Your consent |
| Organizing interviews – contacting selected candidates and conducting job interviews | Conclusion of a contract or performance of necessary steps towards conclusion of a contract |
| Organizing tests regarding foreign languages knowledge level, as well as Hogan tests*, in case such tests will be a part of job interviews | Legitimate interest – determined by the SG GSC’S need of assurance of your professional compliance with the Individual Employment Agreement and Job description |
| Feedback collection following the end of the recruitment process | Legitimate interest – determined by the SG GSC’s need to identify opportunities of improvement and optimization of recruitment process, followed by the implementation of necessary measures |
| Filtering candidates on international sanctions and terrorism public lists established by acts / resolutions of international bodies, such as the United Nations Security Council, in order to prevent violations of legislation in international sanctions and terrorist financing area. | Legitimate interest – determined by the SG GSC’s need to: – prevent violations of the international sanctions regime (e.g. UN resolutions) and related national legislation (e.g. OUG 202/2008); – avoid the reputational risks generated by the association with persons who are on the international sanctions and terrorism lists; – comply with Societe Generale commitments in relation with the competent regulatory authorities which also provide for the implementation of adequate control mechanisms to prevent the breaches of the legislation |
| Identifying the candidates selected for the conclusion of the employment contract who are Politically Exposed Persons in order to identify and prevent the risks of corruption. | Legitimate interest – determined by the SG GSC’s need to: – avoid violations of national legislation on preventing and combating corruption and influence peddling; – comply with Societe Generale commitments in relation with the competent regulatory authorities which also provide for the implementation of adequate control mechanisms to prevent the breaches of the legislation |
| Identifying the candidates selected for the conclusion of the employment contract who are American Persons (US Person) | Legitimate interest – determined by the SG GSC’s need to: – identify the American persons (US Person) to whom the separate regime of international sanctions established by the USA (OFAC) applies; – comply with Societe Generale commitments in relation with the competent regulatory authorities which also provide for the implementation of adequate control mechanisms to prevent the breaches of the OFAC legislation.
|
| Identifying situations that may lead to a conflict of interest in the case of candidates selected for the conclusion of the employment contract
| Legitimate interest – determined by the SG GSC Romania’s need to prevent the occurrence of a conflict of interest.
|
| Starting and completing the employment process by submitting the identification and study documents in order to conclude the employment contract | Concluding a contract or taking the necessary steps to conclude a contract |
| Storage of the data of persons who have applied for a certain position, but have not been selected, or have applied without targeting a certain position, in order to contact them for other future positions within SG GSC Romania or in other companies in the Group (storage within the online recruitment platform Societe Generale) | Your consent |
| Communication of data of persons who have applied for a certain position within the GSC Romania, but have not been selected, or have applied without targeting a certain position, to other companies in the Societe Generale Group, in order to contact them for other existing positions within the Group. | Legitimate interest – determined by the SG GSC’s need to ensure the preservation of valuable human resources within the Group, as a strategic element for the development and achievement of common objectives within the Group. |
*In case you refuse to participate in the psychometric tests Hogan (in the event that it is proposed to participate in such test, case by case), objecting to the processing of your personal data listed below, we would like to inform you that the recruitment process will continue and your refusal will not constitute an eliminatory criterion, but it can constitute a differentiation criterion within the selection process for one of the positions opened by SG GSC.
- DURATION OF PERSONAL DATA PROCESSING
| Data categories | Data subjects categories | Processing purpose | Retention period |
| Identification data, including information from CV, such as professional and educational experience, letter of recommendation | Persons who have applied for one of the positions opened by SG GSC Romania, as well as persons whose personal data have been collected by SG GSC Romania from public sources, such as recruitment sites (EJobs, Best Jobs, LinkedIn, HIPO etc.) | Collection and storage of identification data, including information from CV, letter of recommendation in order to identify suitable candidates for a certain position opened by SG GSC Romania | 2 years from the date of the application for applications submitted directly by the data subjects, as well as for applications accepted as a result of contacting by SG GSC Romania of potential candidates through platforms such as LinkedIn, EJobs, Best Jobs, Hipo; 2 years from the date of data collection by SG GSC Romania, for the data collected by SG GSC Romania from sources other than the data subject. |
| Identification data, including information from CV, such as professional and educational experience, letter of recommendation | Persons who have applied for one of the positions opened by SG GSC Romania, as well as persons whose personal data have been collected by SG GSC Romania from public sources, such as recruitment sites (EJobs, Best Jobs, LinkedIn, HIPO etc.) | Creation of the individual account in the online recruitment platform of Societe Generale | 2 years from the date of the application for applications submitted directly by the data subjects, as well as for applications accepted as a result of contacting by SG GSC Romania of potential candidates through platforms such as LinkedIn, EJobs, Best Jobs, Hipo; 2 years from the date of data collection by SG GSC Romania, for the data collected by SG GSC Romania from sources other than the data subject. |
| Identification data, contact details (telephone number, e-mail address), including the information from CV, such as professional and educational experience, the letter of recommendation, as well as the notes of the SG GSC Romania’s representative responsible for the recruitment process in relation with the course of the interviews and the candidate’s profile | Persons who have applied for one of the positions opened by SG GSC Romania, as well as persons whose personal data have been collected by SG GSC Romania from public sources, such as recruitment sites (EJobs, Best Jobs, LinkedIn, HIPO etc.) | Organizing interviews – contacting selected candidates and conducting job interviews | 2 years from the date of the interview;
|
| Identification data, contact details (telephone number, e-mail address), results of the tests regarding your knowledge level of foreign languages, reports resulted after Hogan tests | Persons who have applied for one of the positions opened by SG GSC Romania, as well as persons whose personal data have been collected by SG GSC Romania from public sources, such as recruitment sites (EJobs, Best Jobs, LinkedIn, HIPO etc.) | Check that the person who has applied for one of the positions opened by SG GSC Romania complies from a professional perspective with the Individual Employment Agreement and Job description. | Approximately 2 years from the date of the interview, except for the case when data subject exercised right to data deletion, to which will receive a response in term of 30 days from the date of the receival of the request by SG GSC |
| Identification data, contact details (telephone number, e-mail address), feedback provided regarding the recruitment process (consisting of responses provided to the questionnaire of the recruitment team) | Persons who have applied for one of the positions opened by SG GSC Romania and who have reached the final stage of the process (refused candidates and selected candidates) | Feedback collection following the end of the recruitment process | 2 years from the date of feedback collection |
| Identification data (name, surname), country of residence and, occasionally, in case of a coincidence of name with a person included on the international sanctions lists, the date of birth can be processed. | Persons who have applied for one of the positions opened by SG GSC Romania and who have reached the final stage of the process. | Check that the person to be hired is not on the international sanctions and terrorism lists, considering the international and national legislation that prohibits companies from financing such persons. | 2 years from the date of personal data collection |
| Identification data (name and surname), American citizenship or ownership of a Green Card, if applicable. | Candidate selected by SG GSC Romania for the conclusion of the individual employment contract related to the position opened by SG GSC Romania | Identifying the candidates selected for the conclusion of the employment contract who are American Persons (US Person) to whom the distinct regime of international sanctions established by the USA (OFAC) applies. | 2 years from the date of personal data collection |
| Identification data (name, surname) and, if applicable: · relationships with employees within SG GSC Romania (name, position, type of relationship) · holding a decision-making role, directly or through a close person, for a customer or supplier of SG GSC Romania (in the last year) | Candidate selected by SG GSC Romania for the conclusion of the individual employment contract related to the position opened by SG GSC Romania | Identifying the candidates selected for the conclusion of the employment contract who find themselves in situations that would lead to the occurrence of a conflict of interest. | 2 years from the date of personal data collection |
| Identification date (name and surname) and, occasionally, in case of a name coincidence with a public person (politically exposed), the date of birth can also be processed. If the status of politically exposed person is confirmed, the position / professional experience will also be processed. | Candidate selected by SG GSC Romania for the conclusion of the individual employment contract related to the position opened by SG GSC Romania | Recruiting / hiring a politically exposed person may present a potential risk of corruption for SG GSC Romania. Identifying people exposed to this risk category is a necessary step to ensure that SG GSC Romania does not violate legislation on preventing and combating corruption. | 2 years from the date of the employment decision |
| Identification data, contact data (telephone number, e-mail address) | Candidate selected by SG GSC Romania for the conclusion of the individual employment contract related to the position opened by SG GSC Romania
| Starting and completing the employment process by submitting the identification and study documents in order to conclude the employment contract | 2 years from the date of the employment decision;
|
| Identification data, including information from CV, such as contact details, professional and educational experience, letter of recommendation, where applicable | Persons who have applied for a certain position within the SG GSC Romania or have applied without targeting a certain position | Storage of the data of persons who have applied for a certain position, but have not been selected, or have applied without targeting a certain position, in order to contact them for other future positions within SG GSC Romania or in other companies in the Group (storage within the online recruitment platform Societe Generale) | 2 years from the date of personal data collection |
| Identification data, including information from CV, such as contact details, professional and educational experience, letter of recommendation, where applicable | Persons who have applied for a certain position within the SG GSC Romania or have applied without targeting a certain position | Communication of data of persons who have applied for a certain position within the SG GSC Romania, but have not been selected, or have applied without targeting a certain position, to other companies in the Societe Generale Group, in order to contact them for other existing positions within the Group. | 2 years from the date of personal data collection;
|
- DATA RECIPIENTS CATEGORIES
Your personal data, as described in the previous paragraphs, will be processed by SG GSC Romania for the purposes set out above. As a general rule, SG GSC Romania carries out its data processing activity on the Romanian territory. However, as explained below, there might be some situations when a part of the processing activities of your personal data performed for the purposes set below, is done outside of Romania and European Union, mostly in France and/or India.
If you applied for a certain position within GSC Romania, but you were not selected, but there are similar positions open within the Societe Generale Group, or if you submitted an application without targeting a specific position or when you applied, for other existing positions within the Societe Generale Group, your personal data will also be processed by other companies, part of the Societe Generale Group. This processing activity will take place in compliance with your rights and the necessary legal guarantees such as Standard Contractual Clauses, where applicable. For this situation, any entity recipient of your personal data acquires the quality of Data Controller, hence having all legal obligations regarding your personal data and with respect to the rights regarding the protection of your personal data, you can address this entity directly.
Another category of data recipients is represented by the service providers of evaluation services (in the event you are included in an evaluation process, as part of the job interview), which will process your personal data for the purpose of performing your professional evaluation for the assurance of your professional compliance with the Individual Employment Agreement and Job description. Therefore, in order to establish your foreign languages knowledge level, your personal data will be sent to Eucom Business Language SRL, a service provider of evaluation of foreign languages knowledge level, which acts as an independent Data Controller, in compliance with the provision of EU Regulation no. 679/2016 (GDPR), having its own purposes and determining its own means of processing of your personal data, independently from SG GSC. Following the communication of your personal data to this service provider by SG GSC, this service provider will process your personal data in compliance with its own policies and procedures and, to the extent that you are not content with the way in which your personal data is processed or protected, you can address a request in this regard to SG GSC or directly to this service provider. Another service provider of evaluation processes is represented by Hart Human Resource Consulting SRL, service provider of psychometric Hogan tests, evaluations provided with the purpose of establishing your personality elements, along with business practical elements in order to select the candidates who will have a managerial role.
*Hogan test evaluates the grade in which certain behavioural categories are visible to others. Hogan test aims to provide SG GSC with information related to:
- description of the way in which candidates face stress elements in their interaction with others, how they manage and tackle their work related tasks and solve problems;
- description of behavioural tendencies in situations of stress and fatigue which may influence the work related activity;
- description of interests and values which are important to candidates.
Also, within the limits of your consent, your personal data will be processed and stored through the online recruitment platform of the Societe Generale Group, called Taleo, which is located in France on the Societe Generale’s infrastructure, but also on the infrastructure of the IT solution provider called Taleo. The transfer of personal data outside the EU borders to this provider is carried out in accordance with the guarantees required by EU Regulation no. 679/2016 (“GDPR”) for the protection of natural persons with regard to the processing of personal data, guarantees represented by the signing with this provider of the Standard Contractual Clauses, in accordance with the Decisions of the European Commission.
If you applied for a certain position within GSC Romania which implies, within the performance of the activity, collaboration with Societe Generale Global Solution Centre Pvt. Ltd.’s representatives, (SG GSC India), whether requires, within the recruitment process of candidates for a certain position, the considerable expertise, knowledge or experience of SG GSC India’s representatives, your personal data will be processed by SG GSC India, entity located in India, part of Societe Generale SA Group and strategic partner of SG GSC. Therefore, as far as your personal data transfer to SG GSC India is concerned, transfer activity which involves access of SG GSC India to SG GSC data, this transfer/access activity was assessed through the performance of a Transfer Impact Assessment, became part of Data Transfer Agreement incapsulating the Standard Contractual Clauses issued by EU Commission and benefits from additional technical and organisational measures, contractual elements negotiated and signed between SG GSC and SG GSC India.
To the extent that you wish to receive a copy of the Standard Contractual Clauses, as well as more information regarding the transfer of your personal data performed by SG GSC, including all supplementary measures, you can contact our Data Privacy Officer to the following email address: data-protection-sggscro.eur@socgen.com
- RIGHTS YOU BENEFIT FROM AS A RESULT OF THE PROCESSING OF PERSONAL DATA BY SG GSC ROMANIA
As a data subject, you benefit from a series of rights provided by the European Regulation no. 679/2016 on the protection of personal data (“GDPR”), as described below, as well as these rights are regulated by the GDPR. The provisions of this Policy on the rights of the data subject regarding the processing of his data apply in accordance with the European Regulation no. 679/2016, as well as in accordance with the national legislation in force.
- Right to data access
As a data subject you have the right to request and obtain from SG GSC Romania a confirmation of the fact that your data are or are not processed by SG GSC Romania and, if so, you have the right to access those data, as well as to information such as: the purposes of processing, the categories of data processed, the recipients or categories of recipients of the data, the retention period of the data thus processed. Also, to the extent that SG GSC Romania has obtained your personal data from other sources and not from you directly, you may request any available information regarding the source of the data thus collected.
- Right to rectification
As data subject, you have the right to obtain from SG GSC Romania the rectification and / or completion of inaccurate and / or incomplete personal data concerning you.
- Right to data deletion (“Right to be forgotten”)
As a data subject, you have the right to obtain from SG GSC Romania the deletion of personal data concerning you, and SG GSC Romania has the obligation to delete personal data without undue delay if one of the following reasons applies:
- personal data are no longer necessary for the purposes for which they were collected or processed
- you withdraw your consent based on which the processing takes place, where the basis for the processing of the data is represented by your consent
- you exercise your right to opposition;
- the personal data has been illegally processed
- the personal data must be deleted in order to comply with a legal obligation of SG GSC Romania under Union or national law;
- the personal data were collected in connection with the provision of information society services.
SG GSC Romania’s obligation to delete your personal data will not apply to the extent that the processing is necessary:
(a) for the exercise of the right to free expression and information:
(b) for compliance with a legal obligation which provides for processing under Union or national law;
(c) for establishing, exercising or defending a right in court.
- Right to restriction of processing
As data subject you have the right to request and to obtain from SG GSC Romania the restriction of processing of the data belonging to you in case one of the following applies.
(a) you challenge the accuracy of the data, for a period that allows SG GSC Romania to verify the accuracy of the
data;
(b) the processing is illegal, and you object to the deletion of personal data, requesting in return the restriction of their use;
(c) SG GSC Romania no longer needs personal data for the purpose of processing, but you request them for the establishing, exercise or defense of a right in court; or
(d) you have objected to the processing of data for the period of time in which it is verified whether the legitimate rights of SG GSC Romania prevail over those invoked by you.
- Right to data portability
As data subject you have the right to receive the personal data concerning you and which you have provided to SG GSC Romania in a structured, commonly used and machine-readable format (e.g. through an online form), and you have the right to transmit this data to another operator, without obstacles from SG GSC Romania, if:
(a) processing is based on consent; and
(b) the processing is performed by automatic means.
- Right to opposition
You may object at any time, for reasons related to your particular situation, to the processing carried out on the basis of the public interest or the legitimate interest pursued by SG GSC Romania or by a third party. SG GSC Romania will no longer process personal data belonging to you as a result of the exercise of this right by you, unless SG GSC Romania has legitimate and compelling reasons justifying the processing or when the purpose of further processing of data is represented by the establishment, exercise or defense of a right in front of court by SG GSC Romania.
Except for the right to contact the National Supervisory Authority for Personal Data Processing, you can exercise any of these rights by submitting a request to privacysupport@socgen.com or directly to the Data Protection Officer at data-protection-sggscro.eur@socgen.com or by submitting a written request, dated and signed to Sector 6, Boulevard Iuliu Maniu 6P, Building Complex Campus 6, Campus 6.3 Building, 8th floor.
National Supervisory Authority for Personal Data Processing (ANSPDCP)
28-30 G-ral Gheorghe Magheru Bld., District 1, post code 010336, Bucharest, Romania
- WITHDRAWAL OF CONSENT
For those processing operations of your personal data which, according to the above provisions, are based on your consent, you may withdraw your consent at any time by submitting a request to this effect to privacysupport@socgen.com or directly to the Data Protection Officer at data-protection-sggscro.eur@socgen.com or by submitting a written request, dated and signed to Sector 6, Boulevard Iuliu Maniu 6P, Building Complex Campus 6, Campus 6.3 Building, 8th floor.
- LOCATION WHERE YOUR DATA ARE PROCESSED OR STORED
In order to fulfill the purposes presented above, your personal data will be processed in Romania. However, SG GSC Romania, as part of the Societe Generale Group, benefits from a part of the technical infrastructure of the Societe Generale Group, which is located in France, as well as from technical support from other Group entities located in the European Union, as well as in other non-EU countries, such as India. Thus, your personal data will be stored on the infrastructure located in France, processed and accessed remotely, by accessing the Societe Generale Group infrastructure, by SG GSC India, entity located in India, and to the extent that any transfers to countries that do not provide an adequate level of protection will be necessary, they will be made in compliance with the appropriate guarantees, as these are provided by the European Regulation no. 679/2016 on the protection of natural persons with regard to the processing of personal data and the free movement of such data.
- TECHNICAL AND ORGANIZATIONAL MEASURES APPLIED BY SG GSC ROMANIA IN ORDER TO ENSURE THE SECURITY OF PERSONAL DATA
SG GSC Romania has implemented a series of technical and organizational measures so as to ensure the protection of personal data processed. These measures include the following:
- Limiting the personal data collected and processed to those strictly necessary for the recruitment of candidates;
- Granting access to personal data only to staff who require such access, depending on the responsibilities held within the SG GSC Romania, as well as the need to know, to see and to have;
- Pseudonymization and / or encryption of personal data, where such processing allows the achievement of the purposes for which the data were initially collected;
- Ensuring the necessary courses for the personnel involved in the data processing operations, so that they know exactly the internal procedures and the legal provisions applicable in the matter of personal data protection;
- Implementation of the necessary technical measures in order to ensure backup, as well as in order to restore access to data in a timely manner in the event of an incident of a physical or technical nature;
- Ensuring the confidentiality, integrity, availability and resilience of personal data processing systems by implementing the necessary technical and organizational measures, such as computer security and physical security measures to ensure the prevention of unauthorized disclosure of data and unauthorized access to data.
- CONTACT DETAILS OF THE SG GSC ROMANIA DATA PROTECTION OFFICER
Societe Generale Global Solution Centre S.A. – data-protection-sggscro.eur@socgen.com/ privacysupport@socgen.com