PRIVACY POLICY
INFORMATION NOTE ON THE PROCESSING OF PERSONAL DATA WITHIN THE SG GSC ROMANIA’S RECRUITMENT PROCESS
1. GENERAL PROVISIONS
By this Information Note Societe Generale Global Service Centre SA (hereinafter “SG GSC”/ “the Company”) wishes to inform you of the reasons why your personal data are processed by SG GSC Romania, as well as of a series of other information regarding the processing of your personal data, so that you can express your informed consent regarding the possibility of SG GSC Romania to process your personal data in order to take the necessary steps for your recruitment.
Thus, after the communication by SG GSC Romania of this Information Note, you will be asked if you agree that your identification and contact data, as well as those contained in documents such as CVs, letters of intent, etc. (hereinafter referred to as “Personal Data”) to be processed by SG GSC Romania for the purposes described below, including the creation of a profile in the database of Societe Generale, as this processing operation is described below .
Also, if your personal data has been provided to us by other sources, such as recruitment agencies, who will also inform you and ask for your consent by virtue of their status as independent data controllers, SG GSC Romania will provide you, through the online platform that manages the Societe Generale database, with the Information Note on the processing of your data by SG GSC Romania. In these situations, you will be contacted by the recruitment agency with which you are in a direct relationship, and the latter will ask you if you agree that your personal data be communicated to SG GSC Romania in order to send an application for one of the open positions within SG GSC Romania. To the extent that you agree, the recruitment agency will enter your data into the online recruitment platform of Societe Generale. Subsequently, you will receive an email that will contain both an information link to your data and a link that will lead you to the possibility of exercising your right of opposition and to delete your personal data from the Societe Generale database.
2. APPLICABLE DEFINITIONS
Data Controller – the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data;
Data Processor – the natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;
Personal Data – any information relating to an identified or identifiable natural person (‘data subject’);
Data Subject – the person whose personal data are collected and processed – under this Policy, the candidate for one of the open positions within SG GSC Romania holds the quality of “data subject”;
GDPR – Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data;
Societe Generale – the group of entities Societe Generale Global Solution Center S.A. belongs to;
SG GSC Romania – Societe Generale Global Solution Centre S.A. – legal entity established in Romania and part of Societe Generale Group.
3. PROCESSED DATA CATEGORIES SG GSC
Romania collects and processes your identification data (e.g. name, surname, e-mail address, contact telephone number), information regarding your professional and educational experience (information found in the Curriculum Vitae), Curriculum Vitae, as well as and recommendations from previous employers in order to process them for carrying out the necessary steps to complete the recruitment process.
4. SOURCES WE USE TO COLLECT PERSONAL DATA
In addition to personal data obtained directly from you, we can obtain and process data relevant to the recruitment process from:
a. Recruitment agencies and online recruitment platforms (we obtain contact data, as well as data related to the professional, personal and social history of the candidates); b. Referrals of potential candidates made by SG GSC Romania employees; c. Referrals of potential candidates made by member companies of the Societe Generale group d. Professional networks or other online sources dedicated to the processes of recruitment or promotion of professional profiles
5. PERSONAL DATA PROCESSING PURPOSE SG GSC
Romania processes your personal data in order to take the necessary steps to start and complete the recruitment process. Fulfilling this purpose will consist, on the one hand, in verifying the information indicated above, and on the other hand, in interviews between you and the representatives of SG GSC Romania. We specify that the processing of this data is necessary, first of all, to determine your desire to take part or not in a recruitment process for one of the open positions within SG GSC Romania and, on the other hand, to evaluate your compatibility with the position for which SG GSC Romania is recruiting/ employing and/ or with any other open position within SG GSC Romania or SG Group of undertakings. Your refusal to provide personal data, as well as your objection to have your data processed by SG GSC Romania, may lead to SG GSC Romania’s inability to include you in the recruitment process and, where appropriate, to enter in contractual relations with you.
6. LEGAL BASIS FOR THE PERSONAL DATA PROCESSING
| The purpose of the processing | The legal ground of the processing |
| Collection and storage of identification data, including information from CV, in order to identify suitable candidates for a certain position opened by SG GSC Romania | Your consent |
| Creation of the individual account in the online recruitment platform of Societe Generale | Your consent |
| Organizing interviews – contacting selected candidates and conducting job interviews | Concluding a contract or taking the necessary steps to conclude a contract |
| Filtering candidates on international sanctions and terrorism public lists established by acts / resolutions of international bodies, such as the United Nations Security Council, in order to prevent violations of legislation in international sanctions and terrorist financing area. | Legitimate interest – determined by the SG GSC’s need to: – prevent violations of the international sanctions regime (e.g. UN resolutions) and related national legislation (e.g. OUG 202/2008); – avoid the reputational risks generated by the association with persons who are on the international sanctions and terrorism lists; – comply with Societe Generale commitments in relation with the competent regulatory authorities which also provide for the implementation of adequate control mechanisms to prevent the breaches of the legislation |
| Identifying the candidates selected for the conclusion of the employment contract who are Politically Exposed Persons in order to identify and prevent the risks of corruption. | Legitimate interest – determined by the SG GSC’s need to: – avoid violations of national legislation on preventing and combating corruption and influence peddling; – comply with Societe Generale commitments in relation with the competent regulatory authorities which also provide for the implementation of adequate control mechanisms to prevent the breaches of the legislation |
| Identifying the candidates selected for the conclusion of the employment contract who are American Persons (US Person) | Legitimate interest – determined by the SG GSC’s need to: – identify the American persons (US Person) to whom the separate regime of international sanctions established by the USA (OFAC) applies; – comply with Societe Generale commitments in relation with the competent regulatory authorities which also provide for the implementation of adequate control mechanisms to prevent the breaches of the OFAC legislation.
|
| Identifying situations that may lead to a conflict of interest in the case of candidates selected for the conclusion of the employment contract
| Legitimate interest – determined by the SG GSC Romania’s need to prevent the occurrence of a conflict of interest. |
| Starting and completing the employment process by submitting the identification and study documents in order to conclude the employment contract | Concluding a contract or taking the necessary steps to conclude a contract |
| Storage of the data of persons who have applied for a certain position, but have not been selected, in order to contact them for other future positions within SG GSC Romania or in other companies in the Group (storage within the online recruitment platform Societe Generale) | Your consent |
| Communication of data of persons who have applied for a certain position within the GSC Romania, but have not been selected, to other companies in the Societe Generale Group, in order to contact them for other existing positions within the Group. | Legitimate interest – determined by the SG GSC’s need to ensure the preservation of valuable human resources within the Group, as a strategic element for the development and achievement of common objectives within the Group. |
- DURATION OF PERSONAL DATA PROCESSING
| Data categories | Data Subjects categories | Processing purpose | Retention period |
| Identification data, including information from CV, such as professional and educational experience | Persons who have applied for one of the positions opened by SG GSC Romania | Collection and storage of identification data, including information from CV, in order to identify suitable candidates for a certain position opened by SG GSC Romania | 5 years from the date of the application |
| Identification data, including information from CV, such as professional and educational experience | Persons who have applied for one of the positions opened by SG GSC Romania | Creation of the individual account in the online recruitment platform of Societe Generale | 2 years from the date of the application
|
| Identification data, contact details (telephone number, e-mail address), including the information from CV, such as professional and educational experience, the letter of recommendation, as well as the notes of the SG GSC Romania’s representative responsible for the recruitment process in relation with the course of the interviews and the candidate’s profile | Persons who have applied for one of the positions opened by SG GSC Romania | Organizing interviews – contacting selected candidates and conducting job interviews | 2 years from the date of the interview |
| Identification data (name, surname), country of residence and, occasionally, in case of a coincidence of name with a person included on the international sanctions lists, the date of birth can be processed. | Persons who have applied for one of the positions opened by SG GSC Romania and who have reached the final stage of the process. | Check that the person to be hired is not on the international sanctions and terrorism lists, considering the international and national legislation that prohibits companies from financing such persons. | 2 years from the date of personal data collection |
| Identification data (name and surname), American citizenship or ownership of a Green Card, if applicable
| Candidate selected by SG GSC Romania for the conclusion of the individual employment contract related to the position opened by SG GSC Romania | Identifying the candidates selected for the conclusion of the employment contract who are American Persons (US Person) to whom the distinct regime of international sanctions established by the USA (OFAC) applies. | 2 years from the date of personal data collection |
Identification data (name, surname) and, if applicable:
| Candidate selected by SG GSC Romania for the conclusion of the individual employment contract related to the position opened by SG GSC Romania | Identifying the candidates selected for the conclusion of the employment contract who find themselves in situations that would lead to the occurrence of a conflict of interest | 2 years from the date of personal data collection |
| Identification date (name and surname) and, occasionally, in case of a name coincidence with a public person (politically exposed), the date of birth can also be processed. If the status of politically exposed person is confirmed, the position / professional experience will also be processed.
| Candidate selected by SG GSC Romania for the conclusion of the individual employment contract related to the position opened by SG GSC Romania | Recruiting / hiring a politically exposed person may present a potential risk of corruption for SG GSC Romania. Identifying people exposed to this risk category is a necessary step to ensure that SG GSC Romania does not violate legislation on preventing and combating corruption | 2 years from the date of the employment decision |
| Identification data, contact data (telephone number, e-mail address) | Candidate selected by SG GSC Romania for the conclusion of the individual employment contract related to the position opened by SG GSC Romania
| Starting and completing the employment process by submitting the identification and study documents in order to conclude the employment contract | 2 years from the date of the employment decision |
| Identification data, including information from CV, such as contact details, professional and educational experience | Persons who have applied for a certain position within the SG GSC Romania | Storage of the data of persons who have applied for a certain position, but have not been selected, in order to contact them for other future positions within SG GSC Romania or in other companies in the Group (storage within the online recruitment platform Societe Generale) | 5 years from the date of personal data collection |
| Identification data, including information from CV, such as contact details, professional and educational experience | Persons who have applied for a certain position within the SG GSC Romania | Communication of data of persons who have applied for a certain position within the SG GSC Romania, but have not been selected, to other companies in the Societe Generale Group, in order to contact them for other existing positions within the Group. | 2 years from the date of personal data collection |
- DATA RECIPIENTS CATEGORIES
Your personal data, as described in the previous paragraphs, will be processed by SG GSC Romania for the purposes set out above. As a general rule, SG GSC Romania carries out its data processing activity on the Romanian territory. However, as explained below, there might be some situations when a part of the processing activities of your personal data performed for the purposes set below, is done outside of Romania and European Union, mostly in France and/or India.
If you applied for a certain position within GSC Romania, but you were not selected, but there are similar positions open within the Societe Generale Group, or if you submitted an application without targeting a specific position or when you applied , for other existing positions within the Societe Generale Group, your personal data will also be processed by other companies, part of the Societe Generale Group. This processing activity will take place in compliance with your rights and the necessary legal guarantees such as the Binding Corporate Rules or Standard Contractual Clauses, where applicable. For this situation, any entity recipient of your personal data acquires the quality of Data Controller, hence having all legal obligations regarding your personal data and with respect to the rights regarding the protection of your personal data, you can address this entity directly.
Also, within the limits of your consent, your personal data will be processed and stored through the online recruitment platform of the Societe Generale Group, called Taleo, which is located in France on the Societe Generale’s infrastructure, but also on the infrastructure of the IT solution provider called Taleo. The transfer of personal data outside the EU borders to this provider is carried out in accordance with the guarantees required by EU Regulation no. 679/2016 (“GDPR”) for the protection of natural persons with regard to the processing of personal data, guarantees represented by the signing with this provider of the Standard Contractual Clauses, in accordance with the Decisions of the European Commission.
In the case when you have been contacted by SG GSC Romania following the identification of your professional profile on online network by one of our representatives, there might be the possibility for your personal data to be processed by one of the representatives of Societe Generale Global Solution Centre Ltd (GSC India), an entity part of Societe Generale Group, located in India.For this reason , GSC Romania concluded a written contract with this entity in order to outsource the initial part of the recruitment process, part represented by the identification and contact of certain relevant profiles for the positions opened within GSC Romania. Therefore, if your profile or your public CV, found on professional social networks or within other platforms including LinkedIn, but not limited to , has been identified by one of GSC India’s representatives, these representatives will process your contact personal data in order to present you a career opportunity opened within GSC Romania and to communicate you GSC Romania’s Information note on the processing of your personal data (the present document) for you to present your informed consent. To the extent that you do not want to be part of the recruitment process of SG GSC Romania or you will not respond as a result of the initial communications made on behalf of SG GSC Romania, SG GSC Romania, alone or through its partners, will no longer contact you for these purposes. The partnership concluded between GSC Romania and GSC India is governed by the Standard Contractual Clauses issued by European Commission in order to ensure the necessary measures for the protection of personal data when these are transferred outside of European Union, but also the additional technical and organizational measures. The way in which SG GSC India representatives, acting on behalf of SG GSC Romania, will be able to contact you is represented by electronic communications via e-mail or the messaging service of your operator, or by initiating a telephone call, but only after you have expressed your consent regarding the possibility of SG GSC Romania to process your personal data, consent provided only after reading this Information note. To the extent that you wish to receive more information regarding these measures, you can send us a written request to: data-protection-sggscro.eur@socgen.com.
- RIGHTS YOU BENEFIT FROM AS A RESULT OF THE PROCESSING OF PERSONAL DATA BY SG GSC ROMANIA
 As a data subject, you benefit from a series of rights provided by the European Regulation no. 679/2016 on the protection of personal data (GDPR), as described below, as well as these rights are regulated by the GDPR. The provisions of this Policy on the rights of the data subject regarding the processing of his data apply in accordance with the European Regulation no. 679/2016, as well as in accordance with the national legislation in force.
- Right to data access
As a data subject you have the right to request and obtain from SG GSC Romania a confirmation of the fact that your data are or are not processed by SG GSC Romania and, if so, you have the right to access those data, as well as to information such as: the purposes of processing, the categories of data processed, the recipients or categories of recipients of the data, the retention period of the data thus processed. Also, to the extent that SG GSC Romania has obtained your personal data from other sources and not from you directly, you may request any available information regarding the source of the data thus collected.
- Right to rectification
As data subject, you have the right to obtain from SG GSC Romania the rectification and / or completion of inaccurate and / or incomplete personal data concerning you.
- Right to data deletion (Right to be forgotten)
As a data subject, you have the right to obtain from SG GSC Romania the deletion of personal data concerning you, and SG GSC Romania has the obligation to delete personal data without undue delay if one of the following reasons applies:
- personal data are no longer necessary for the purposes for which they were collected or processed
- you withdraw your consent based on which the processing takes place, where the basis for the processing of the data is represented by your consent
- you exercise your right to opposition;
- the personal data has been illegally processed
- the personal data must be deleted in order to comply with a legal obligation of SG GSC Romania under Union or national law;
- the personal data were collected in connection with the provision of information society services.
SG GSC Romania’s obligation to delete your personal data will not apply to the extent that the processing is necessary:
(a) for the exercise of the right to free expression and information:
(b) for compliance with a legal obligation which provides for processing under Union or national law;
(c) for establishing, exercising or defending a right in court.
- Right to restriction of processing
As data subject you have the right to request and to obtain from SG GSC Romania the restriction of processing of the data belonging to you in case one of the following applies.
(a) you challenge the accuracy of the data, for a period that allows SG GSC Romania to verify the accuracy of the
data;
(b) the processing is illegal, and you object to the deletion of personal data, requesting in return the restriction of their use;
(c) SG GSC Romania no longer needs personal data for the purpose of processing, but you request them for the establishing, exercise or defense of a right in court; or
(d) you have objected to the processing of data for the period of time in which it is verified whether the legitimate rights of SG GSC Romania prevail over those invoked by you.
- Right to data portability
As data subject you have the right to receive the personal data concerning you and which you have provided to SG GSC Romania in a structured, commonly used and machine-readable format (e.g. through an online form), and you have the right to transmit this data to another operator, without obstacles from SG GSC Romania, if:
(a) processing is based on consent; and
(b) the processing is performed by automatic means.
- Right to opposition
You may object at any time, for reasons related to your particular situation, to the processing carried out on the basis of the public interest or the legitimate interest pursued by SG GSC Romania or by a third party. SG GSC Romania will no longer process personal data belonging to you as a result of the exercise of this right by you, unless SG GSC Romania has legitimate and compelling reasons justifying the processing or when the purpose of further processing of data is represented by the establishment, exercise or defense of a right in front of court by SG GSC Romania.
Except for the right to contact the National Supervisory Authority for Personal Data Processing, you can exercise any of these rights by submitting a request to privacysupport@socgen.com or directly to the Data Protection Officer at data-protection-sggscro.eur@socgen.com or by submitting a written request, dated and signed to Bucharest, Strada Preciziei Nr. 24, West Gate, H4 Building, 4th floor.
National Supervisory Authority for Personal Data Processing (ANSPDCP)
- G-ral Gheorghe Magheru Bld., District 1, post code 010336, Bucharest, Romania
- WITHDRAWAL OF CONSENT
For those processing operations of your personal data which, according to the above provisions, are based on your consent, you may withdraw your consent at any time by submitting a request to this effect to privacysupport@socgen.com or directly to the Data Protection Officer at data-protection-sggscro.eur@socgen.com or by submitting a written request, dated and signed to 6P Iuliu Maniu Blvd., Campus 6, 6.3 Building, 8th Floor, District 6, Bucharest, Romania.
- LOCATION WHERE YOUR DATA ARE PROCESSED OR STORED
In order to fulfill the purposes presented above, your personal data will be processed in Romania. However, SG GSC Romania, as part of the Societe Generale Group, benefits from a part of the technical infrastructure of the Societe Generale Group, which is located in France, as well as from technical support from other Group entities located in the European Union, as well as in other non-EU countries, such as India. Thus, your personal data will be stored on the infrastructure located in France, and to the extent that any transfers to countries that do not provide an adequate level of protection will be necessary, they will be made in compliance with the appropriate guarantees, as these are provided by the European Regulation no. 679/2016 on the protection of natural persons with regard to the processing of personal data and the free movement of such data. Also, considering the operational support offered in the recruitment process by GSC India, for some of the positions of GSC Romania, GSC Romania transfers the operation of consulting the public databases and contacting the targeted data subjects who can become potential candidates of GSC Romania, in the name and on behalf of GSC Romania.
Thus, your personal data will be consulted from India, and where you express your consent, they will be collected by the representatives of GSC India and stored in France, and the representatives of GSC India, as a result of your consent – they could also contact you by phone, therefore, processing from India, your phone number.
- TECHNICAL AND ORGANIZATIONAL MEASURES APPLIED BY SG GSC ROMANIA IN ORDER TO ENSURE THE SECURITY OF PERSONAL DATA
SG GSC Romania has implemented a series of technical and organizational measures so as to ensure the protection of personal data processed.
These measures include the following:
1. Limiting the personal data collected and processed to those strictly necessary for the recruitment of candidates;
2. Granting access to personal data only to staff who require such access, depending on the responsibilities held within the SG GSC Romania, as well as the need to know, to see and to have;
3. Pseudonymization and / or encryption of personal data, where such processing allows the achievement of the purposes for which the data were initially collected;
4. Ensuring the necessary courses for the personnel involved in the data processing operations, so that they know exactly the internal procedures and the legal provisions applicable in the matter of personal data protection;
5. Implementation of the necessary technical measures in order to ensure backup, as well as in order to restore access to data in a timely manner in the event of an incident of a physical or technical nature;
6. Ensuring the confidentiality, integrity, availability and resilience of personal data processing systems by implementing the necessary technical and organizational measures, such as computer security and physical security measures to ensure the prevention of unauthorized disclosure of data and unauthorized access to data.
7. Conclusion of the Standard Contractual Clauses to guarantee personal data transfer operations outside the borders of the European Union, supplemented with additional technical and organizational measures in order to limit the risks derived from the lack of a regulatory framework similar to that of Europe in the recipient country. Among these measures are: saving and storing of data and documents containing personal data only on the infrastructure located in Europe, the performance of periodic trainings with the designated personnel from the recipient country in order to make them aware of all the measures and rights provided by the legislation applicable in Europe regarding ensuring the confidentiality of data, etc.
- CONTACT DETAILS OF THE SG GSC ROMANIA DATA PROTECTION OFFICER
Societe Generale Global Solution Centre S.A. – data-protection-sggscro.eur@socgen.com / privacysupport@socgen.com.