Privacy Notice for Exadel Group candidates (EU/EEA locations)

1. General Information

This notice is provided to you in accordance with Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (GDPR).

This privacy notice covers Exadel Group companies engaging candidates located in EU/EEA as listed in Appendix 1 (“Exadel”/”we”/”our”) and is dedicated to Exadel Group candidates and prospects (“you/yours”) as well as other individuals whose data have been shared with Exadel Group by the candidates (e.g. representatives of prior employers) (“your contacts”). This privacy notice (“Privacy Notice”) describes the Personal Data we collect about you, how we use that Personal Data, and your rights and the choices you have relating to your Personal Data.

The Exadel Group may conduct active (when we use recruitment agencies, search for suitable candidates on work platforms or rely on our referral program) or/and passive recruitment (when we publish our open roles on our careers website).
The recruitment process consists of three main stages:

• Application stage: collecting applications and supporting documents from the candidates or prospects and preliminary selection;
• Evaluation stage: reviewing applications and supporting documents, conducting interviews, tests and assessments for final selection, and;
• Job offer: background screening, employment contract preparation and obtaining documents entitling the selected candidate to work in a country where the role is located e.g. work permit).

This privacy notice does not apply to the use of your Personal Data that may be collected by third parties that Exadel Group does not own or control (e.g. our target clients, if they participate in the evaluation stage of the recruitment process) or that do not support Exadel Group in providing the Services (as our data processors).

“Personal Data” means any information relating to an identified or identifiable natural person as described in the GDPR. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

2. Data Controller

The data controller responsible for your Personal Data is the Exadel Group company where the position that you are interested in is open. Your Personal Data may be shared within other Exadel Group companies that may act as joint controllers, but your main data controller will remain the company where the role is open. You will find a complete list of Exadel Group companies in EU/EEA in Appendix 1. For any inquiries regarding your Personal Data, you can contact us at [email protected].

3. What data we collect about you

We collect, use, store and transfer different kinds of Personal Data about you. We have grouped together the following categories of Personal Data to explain how this type of information is used by us. These terms are used throughout this Privacy Notice:

• Identity data: first name, middle name, surname, title, date of birth, passport number or other official identity number;
• Contact data: email address, telephone number, residential location or address of place of residence;
• Professional experience: includes prior employers, roles, work period, responsibilities and achievements;
• Education data: educational institutions, learning period, acquired education, qualifications, certificates, attended conferences and trainings;
• Skills: knowledge of IT languages and foreign languages in general, driving skills, and other competencies, information provided by you in your CV, cover letter or other application documents;
• Your assessment information: summary of interview with the candidate, insights and opinions of person(s), who perform recruitment, candidate testing results;
• Information relating to private life: information volunteered by the candidate in the application form and supporting documents as well as during the interview;
• Work permit data: including visa, and other documents entitling individuals to be employed/provide service in a country where the role is open;
• Aggregated data: include statistical or demographic data. Aggregated data may be derived from your Personal Data but is not considered Personal Data in law as this data does not directly or indirectly reveal your identity. For example, we may aggregate your usage data to calculate the percentage of users accessing a specific website feature. You can read more about what data we collect with Cookies and Similar Technologies on our website: https://exadel.com/privacy-policy/;
• Sensitive Personal Data: health data and criminal offence related data (this Personal Data will only be collected and processed to the extent it is necessary and applicable for employment for a specific position and to the extent permitted by applicable law at the final stage of recruitment or once the candidate is employed);
• Professional social media profiles, e.g. LinkedIn: including professional experience, education data, skills and any other information available on your public social media profile (collected by us in accordance with the privacy protection rules established by the applicable social media platform);
• References, employers’ feedback: the name of the person giving reference or feedback on the candidate, his/her contact data, content of reference;

4. How your Personal Data is collected

We use different methods to collect Personal Data from and about you, including through the channels set out below.

Direct interactions with you

You give us your Personal Data in your direct interactions with us: (i) by filling in forms on our website; (ii) through our electronic portals and platforms, (iii) by corresponding with us by email or post, (iv) by speaking to us in person, over the telephone, or over online communication tools (e.g. Teams, Zoom, etc.) (v) whilst visiting our facilities.

Third-party sources

We obtain Personal Data:

• From the recruitment agencies, who carry out the initial selection of the candidates;
• From social media, when verifying your information or when searching for new candidates;
• From your prior employer or other individual whose contact details you have provided to us to verify information that you have provided;
• From Exadel Group staff or other individuals who referred you for the role for which you are considered (Exadel Group referral program)

5. How we use your Personal Data

Application stage

Evaluation stage

Job offer stage

We only require information listed in section 3 to process your application. Please do not provide any other information, unless expressly requested by us. If you include information in your application and other accompanying documents that are not necessary for us to process for the above purposes, we will process this data on the basis of your consent that you expressed when you voluntarily provided this information to us.

6. Who do we disclose your Personal Data to

Personal Data will be disclosed for the purposes set forth herein or in accordance with applicable laws.

Your Personal Data may be shared with the following recipients:

Within Exadel group:

• Exadel recruiters
• Candidates selection team (e.g. Project Manager, Line Manager, HR, etc.)
• IT support and other service providers

Outside Exadel Group:

• Third-party service providers (e.g. Recruitment platform, GreenHouse)
• Legal and regulatory authorities as required by law
• IT system providers and IT support
• Our clients
• Technical interviewers

7. Data Transfers

Your Personal Data may be transferred to countries outside the European Economic Area (EEA) if necessary for the purposes outlined in this notice. In particular, your Personal Data might be shared with the Exadel Group headquarters in the USA. Your Personal Data will be hosted in the Exadel Group recruitment tool in the USA (Greenhouse Inc. Please see more information about this SaaS on the following website: greenhouse.com). We will ensure that appropriate safeguards are in place to protect your Personal Data in accordance with GDPR requirements. If you would like to receive more information about our safeguards, please contact us at [email protected].

8. Data Retention

We will retain your Personal Data only for as long as necessary to fulfil the purposes outlined in this privacy notice, or as required by law. If you have provided us with your consent to use your data for other and/or future recruitment purposes, we will retain your data for 365 days after your initial application was rejected or you withdrew from the recruitment process. If you do not provide your consent, your data will be deleted within two months from the end of your recruitment process, that is: rejection of your application, or, rejection of our offer, or withdrawal of your consent.

9. Your Rights

Under the GDPR, you have the following rights regarding your Personal Data:

• Right to access: You have the right to request access to your Personal Data.
• Right to rectification: You can request the correction of inaccurate or incomplete personal data.
• Right to erasure: You have the right to request the deletion of your Personal Data under certain circumstances.
• Right to restriction of processing: You can request the restriction of processing of your Personal Data in certain situations.
• Right to data portability: You have the right to receive your Personal Data in a structured, commonly used, and machine-readable format.
• Right to object: You can object to the processing of your Personal Data in certain situations, such as direct marketing.
• Right to lodge a complaint: If you believe that we have not complied with applicable data protection laws, you have the right to lodge a complaint with the data protection authority in your country. You will find the list of the Data Protection Authorities in EU/EEA and their contact details in Appendix 1.

If you wish to exercise your rights, please use the contact form available on our website: https://exadel.com/privacy-policy/.

10. Obligation to Provide Personal Data

Providing Personal Data listed in section 3 above that we will process for purposes described in section 5 based on all legal grounds except for consent, are necessary to process your application. Failure to provide such data may affect your recruitment process and we may not be able to proceed. Providing Personal Data based on consent is voluntary.

11. Automated Decision-Making

We do not make decisions based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

We believe in fair and transparent evaluation of candidates based on their qualifications, experience, and suitability for the roles they apply for. Human judgement and discretion are integral parts of our recruitment procedures. It means that even if your application is rejected at the initial stage of the recruitment process, the decision was based on our assessment of your suitability for the open role rather than profiling (e.g. if you have mistakenly applied for a wrong position, your application will most likely be rejected as your experience and qualifications will not match the position that you have applied for).

12. How we use Personal Data relating to other individuals collected from you

On certain occasions, when requested by us for background screening purposes, you may provide us with Personal Data of individuals who are not aware of our involvement or of our processing of their Personal Data (for instance, Personal Data of your prior employers’ representatives, who we could contact to verify your references). Before you pass any such Personal Data to us, you must therefore ensure that the relevant individuals have received any requisite privacy notices and there is an applicable legal basis to pass us such Personal Data in connection with the recruitment process.

13. Updates to this Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in our data processing practices or legal requirements. We will notify you of any significant changes. This version was issued in March 2024.

APPENDIX 1

List of Exadel Group companies in EU/EEA covered by this Privacy Notice and corresponding Data Protection Authorities (DPA):