Privacy policy for recruitment using Teamtailor The service for handling recruitments and simplifying the hiring process (the "Service") is powered by Teamtailor on behalf of team.blue Global ("Controller" “we” “us” etc.). It is important that the persons using the Service ("Users”) feel safe with, and are informed about, how we handle User's personal data in the recruitment process. We strive to maintain the highest possible standard regarding the protection of personal data. We process, manage, use, and protect User's Personal Data in accordance with this Privacy Policy ("Privacy Policy").
1. General We are the controller in accordance with current privacy legislations. The Users’ personal data is processed with the purpose of managing and facilitating recruitment of employees to our business.
2. Collection of personal data We are responsible for the processing of the personal data that the Users contributes to the Service, or for the personal data that we in other ways collects with regards to the Service. When and how we collect personal data We collect personal data about Users from Users when Users; make an application through the Service or otherwise, adding personal data about themselves either personally or by using a third-party source such as Facebook or LinkedIn; and use the Service to connect with our staff, adding personal data about themselves either personally or by using a third-party source such as Facebook or LinkedIn. provides identifiable data in the chat (provided through the website that uses the Service) and such data is of relevance to the application procedure; We collect data from third parties, such as Facebook, Linkedin and through other public sources. This is referred to as “Sourcing” and be manually performed by our employees or automatically in the Service. In some cases, existing employees can make recommendations about potential applicants. Such employees will add personal data about such potential applicants. In the cases where this is made, the potential applicant is considered a User in the context of this Privacy Policy and will be informed about the processing. The types of personal data collected and processed The categories of personal data that can be collected through the Service can be used to identify natural persons from names, e-mails, pictures and videos, information from Facebook and LinkedIn-accounts, answers to questions asked through the recruiting, titles, education and other information that the User or others have provided through the Service. Only data that is relevant for the recruitment process is collected and processed. Purpose and lawfulness of processing The purpose of the collecting and processing of personal data is to manage recruiting. The lawfulness of the processing of personal data is our legitimate interest to simplify and facilitate recruitment. Personal data that is processed with the purpose of aggregated analysis or market research is always made unidentifiable. Such personal data cannot be used to identify a certain User. Thus, such data is not considered personal data. The consent of the data subject The User consents to the processing of its personal data with the purpose of Controller’s handling recruiting. The User consents that personal data is collected through the Service, when Users; make an application through the Service, adding personal data about themselves either personally or by using a third-party source as Facebook or LinkedIn, and that Controller may use external sourcing-tools to add additional information; and when they use the Service to connect to Controller’s recruitment department, adding personal data about themselves either personally or by using a third-party source such as Facebook or LinkedIn. The User also consents to the Controller collecting publically available information about the User and compiles them for use in recruitment purposes. The User consents to the personal data being collected in accordance with the above a) and b) will be processed according to the below sections Storage and transfer and How long the personal data will be processed. The User has the right to withdraw his or her consent at any time, by contacting Controller using the contact details listed under 9. Using this right may however, mean that the User can not apply for a specific job or otherwise use the Service. Storage and transfers The personal data collected through the Service is stored and processed inside the EU/EEA, such third country that is considered by the European Commission to have an adequate level of protection, or processed by such suppliers that have entered into such binding agreements that fully complies with the lawfulness of third country transfers (as Privacy Shield) or to other supplies where the adequate safeguards are in order to protect the rights of the data subjects whose data is transferred. To obtain documentation regarding such adequate safeguards, contact us using the Contact details listed in 10. How long the personal data will be processed If a User does not object, in writing, to the processing of their personal data, the personal data will be stored and processed by us as long as we deem it necessary with regards to the purposes stated above. Note that an applicant (User) may be interesting for future recruitment and for this purpose we may store Users’ Personal Data until they are no longer of value as potential recruitments. If you as a User wish not to have your Personal Data processed for this purpose (future recruitment) please contact us using the contact details in paragraph 10.
3. Users’ rights Users have the right to request information about the personal data that is processed by us, by notifying in writing, us using the contact details below under paragraph 10 below. Users have the right to one (1) copy of the processed personal data which belongs to them without any charge. For further demanded copies, Controller has a right to charge a reasonable fee on the basis of the administrative costs for such demand. Users have the right to, if necessary, rectification of inaccurate personal data concerning that User, via a written request, using the contact details in paragraph 10 below. The User has the right to demand deletion or restriction of processing, and the right to object to processing based on legitimate interest under certain circumstances. The User has the right to revoke any consent to processing that has been given by the User to Controller. Using this right may however, mean that the User can not apply for a specific job or otherwise use the Service. The User has under certain circumstances a right to data portability, which means a right to get the personal data and transfer these to another controller as long as this does not negatively affect the rights and freedoms of others. User has the right to lodge a complaint to the supervisory authority regarding the processing of personal data relating to him or her, if the User considers that the processing of personal data infringes the legal framework of privacy law.
4. Security We prioritize the personal integrity and therefore works actively so that the personal data of the Users are processed with utmost care. We take the measures that can be reasonably expected to the make sure that the personal data of Users and others are processed safely and in accordance to this Privacy Policy and the GDPR-regulation. However, transfers of information over the internet and mobile networks can never occur without any risk, so all transfers are made on the own risk of the person transferring the data. It is important that Users also take responsibility to ensure that their data is protected. It is the responsibility of the User that their login information is kept secret.
5. Transfer of personal data to third party We will not sell or otherwise transfer Users’ personal data to third parties. We may transfer Users’ Personal Data to; our contractors and sub-contractors, acting as our Processors and Sub-Processors in accordance with our instructions, for the provision of the Service; authorities or legal advisors in case criminal or improper behaviour is suspected; and authorities, legal advisors or other actors, if required by us according to law or authority’s injunction. We will only transfer Users’ personal data to third parties that we have confidence in. We carefully choose partners to ensure that the User’s personal data is processed in accordance to current privacy legislations. We cooperate with the following categories of processors of personal data; Teamtailor, who supplies the Service, server and hosting companies, e-mail reference companies, video processing companies, information-sourcing companies, analytical service companies and other companies with regards to suppling the Service.
6. Aggregated data (non-identifiable personal data) We may share aggregated data to third parties. The aggregated data has in such instances been compiled from information that has been collected through the Service and can, for example, consist of statistics of internet traffic or the geological location for the use of the Service. The aggregated data does not contain any information that can be used to identify individual persons and is thus not personal data.
7. Cookies When Users use the Service, information about the usage may be stored as cookies. Cookies are passive text files that are stored in the internet browser on the User’s device, such as computer, mobile phone or tablet, when using the Service. We use cookies to improve the User’s usage of the Service and to gather information about, for example, statistics about the usage of the Service. This is done to secure, maintain and improve the Service. The information that is collected through the cookies can in some instances be personal data and is, in such instances, regulated by our Cookie Policy. Users can at any time disable the use of cookies by changing the local settings in their devices. Disabling of cookies can affect the experience of the Service, for example disabling some functions in the Service.
8. Changes We have the right to, at any time, make changes or additions to the Privacy Policy. The latest version of the Privacy Policy will always be available through the Service. A new version is considered communicated to the Users when the User has either received an email informing the User of the new version (using the e-mail stated by the User in connection to the use of the Service) or when the User is otherwise informed of the new Privacy Policy.
9. Contact For questions, further information about our handling of personal data or for contact with us in other matters, please use the below stated contact details; team.blue Global catarina.pinto@team.blue
team.blue HR Screening Policy
THIS HR SCREENING POLICY (hereinafter the “Policy”) has been developed by team.blue NV on behalf of itself and its group companies (hereinafter collectively, or as applicable, individually, the “Company” or “team.blue”), to provide guidance to the relevant stakeholders on the processing of candidate personal data in connection with pre-employment screening and verification activities (hereinafter the “Screening Activities”).
1 SCOPE
This Policy applies to the Company and its directors, officers and employees, so as any other person acting for or on behalf of the Company, to the extent they are involved in pre-employment activities.
Please refer to Annex 2 of this Policy for information on national regulatory requirements that may have an impact on the Screening Activities.
2 PURPOSE
The purpose of this Policy is to guide the Authorized Persons in conducting Screening Activities in a lawful, fair, and transparent manner, with due regard for candidates' privacy, rights, and freedoms.
This Policy outlines the specific activities, legal basis, and processes for conducting various Screening Activities necessary for employment-related decisions and supports compliance with European Legislation and National Legislation.
3 REFERENCES, DEFINITION AND APPLICABLE LEGISLATION
Authority: means the local competent Data Protection Authority.
Authorized Person(s): refers to collaborators authorized to process Personal Data under the direct authority of the Company, in its role of Controller, under Arts. 4 (10) and 29 GDPR. Under the definition given by the Article 29 Working Party in its Opinion 2/2017, this includes: employees and former employees, managers, auditors, collaborators and VAT-registered workers, on-call, part-time workers, job-sharing, fixed-term contracts, internships, without distinction of role, function and/or level, as well as consultants and suppliers and, more generally, all those who use or have used corporate tools or personal tools to operate on the Company network or are aware of relevant corporate information such as, by way of example but not limited to: (a) the Personal Data of customers, employees, applicants and suppliers, including e-mail addresses; (b) all information relating to confidential information of a commercial, financial or business strategy nature; as well as (c) data and information relating to business processes, including the creation of trademarks, patents and industrial property rights, the protection of which is independent of the prejudicial effects that could result from its disclosure.
Data Controller or Controller: means the natural or legal person, public authority, agency or organization which, individually or jointly with others, determines the purposes and means of data processing activities; where the purposes and means of such processing are determined by European Union or
Member State law, the Controller or the specific criteria applicable to its designation may be established by Union or Member State law.
Data Processor or Processor: means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
Data Subject: means refers to an identified or identifiable natural person. By way of example but not limited to, partnerships, sole proprietorships, professionals and agents of joint stock companies may be considered as Data Subjects.
DPO or Data Protection Officer: a natural or legal person represented by a natural person, whose appointment by the Data Controller or Data Processor is mandatory under art. 37.1 of the GDPR, and who must have specialist knowledge of the European and National Legislation, security best practices and the Processing Activities conducted by the Data Controller or Data Processor, in order to assist them in matters concerning privacy compliance.
European Legislation: means the applicable European Union law.
GDPR: means the General Data Protection Regulation (EU) n. 679/2016.
Joint Controllers: two or more controllers who jointly determine the purposes and means of processing, are considered as joint controllers.
Judicial Data: Personal Data relating to criminal convictions and offences or related to security measures.
National Legislation: means, within the European Union/European Economic Area, the Member State applicable legislation; outside of the European Union/European Economic Area, means the applicable national legislation.
Personal Data: means any information concerning an identified or identifiable Data Subject. A Data Subject considered identifiable is one who can be identified, directly or indirectly, by an identifier such as a name, an identification number, location data, an online identifier or by one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.
Privacy Policy for Candidates: means the information notice for candidates written according to the Arts. 13 and 14 GDPR by the relevant Company of team.blue group.
Processing Activities: means a wide range of operations performed on Personal Data, including by manual or automated means. It includes the collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of Personal Data.
Special Categories of Personal Data: means Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or membership of a trade union, as well as Genetic Data, Biometric Data for the univocal identification of a Data subject, and Data concerning their health, sexual activity or sexual orientation.
This Policy is written in accordance with the GDPR, whereas specific requirements may be set by the National Legislation or Authority. Please refer to Annex 2 of this Policy for detailed information on the exact provisions that should be considered under the National Legislation.
Unless otherwise specified, all capitalized terms shall have the meaning given in this section “References, Definition and Applicable Legislation”.
4 DATA PROTECTION ROLES
The Company acts as the Data Controller, responsible for determining the purposes and means of processing candidate personal data.
Where the Company outsources the Screening Activities (see section “Screening Activities”) to third party service provider(s) (Authorized Agent, please refer to Annex 1 of this Policy for more information), the Authorized Agent typically acts as a Data Processor and processes data strictly on the Company’s instructions in compliance with a Data Processing Agreement (DPA), pursuant to Article 28 GDPR, and applicable legislations.
5 SCREENING ACTIVITIES
The Human Resource (HR) Department, which is responsible for recruitment activities, is tasked by team.blue group with the management of Screening Activities. All references to the “Screening Function” in this document refer to the Authorized Persons and/or third parties, including any Authorized Agents, required or contracted by the Company to carry out the requisite Screening Activities on behalf of the latter.
The Screening Function may request the support of the managing role of the HR Department, the privacy office (or the Data Protection Officer) at any time in case of doubts about the Processing of Personal Data.
5.1. DETERMINATION OF SCREENING ACTIVITIES
The Screening Function may undertake any or all of the defined activities in respect of candidates as deemed appropriate. The Screening Function is required to assess and determine the necessary activities on a case-by-case basis, and must ensure that it is proportionate, role-specific, and compliant with European Legislation and/or National Legislation.
1. Verification of Identity Document: team.blue may be required to verify a candidate’s identity in accordance with applicable national laws. For this purpose, the personal data provided by the candidate may be verified against a valid identity document, which the candidate will be requested to submit to the Authorized Agent.
Legal Basis: Performance of a contract to which the data subject is party or taking steps at the data subject's request prior to entering into a contract
2. Education: team.blue may need to verify a candidate’s educational background to confirm credentials relevant to the job role and to ensure compliance with job-specific competency requirements. For this purpose, the educational details provided by the candidate may be verified with the relevant institutions in each applicable jurisdiction.
Legal Basis: This processing is carried out on the basis of the Company’s legitimate interests (Article 6(1)(f) GDPR), specifically the interest in ensuring that candidates meet the required qualifications for the role and in maintaining the integrity of the recruitment process.
3. Work Experience: team.blue may need to verify a candidate’s previous work experience to confirm the accuracy of the employment history provided and to assess suitability for the role. For this purpose, the candidate’s employment details may be verified with the references identified by the candidate.
Legal Basis: This processing is carried out on the basis of the Company’s legitimate interests (Article 6(1)(f) GDPR), namely the interest in ensuring the accuracy of a candidate’s employment history, assessing their suitability for the role and the Company, and in maintaining the integrity of the recruitment and selection process.
4. Work Permit Check (Right to Work): team.blue may be required to confirm that a candidate has the legal right to work in the country where the role is based, in accordance with applicable immigration and employment laws. For this purpose, the personal data provided by the candidate may be verified against relevant official documentation.
Legal Basis: This processing is carried out to comply with the Company’s legal obligations under applicable employment and immigration laws to confirm that a candidate has a valid right to work. The lawful basis for this activity is therefore Article 6(1)(c) GDPR (compliance with a legal obligation). Where required, documentation of the specific jurisdictional requirements will be maintained to demonstrate compliance.
5. Criminal Background Check: team.blue may need to verify a candidate’s criminal background where permitted by applicable laws and necessary for the position applied for. For this purpose, relevant
personal data may be checked with the appropriate authorities in the relevant jurisdictions to ensure suitability and maintain a safe working environment.
Legal Basis: This processing is carried out on the basis of the Company’s legitimate interests (Article 6(1)(f) GDPR), specifically the interest in protecting its systems, data, and customers by verifying the integrity and trustworthiness of candidates for security-sensitive roles. Where this legal basis is confirmed, a Legitimate Interests Assessment (LIA) will be documented in compliance with GDPR and applicable national laws governing criminal record checks.
Where relevant, a Legitimate Interest Assessment (LIA), pursuant to Article 6(1)(f) GDPR and/or Data Protection Impact Assessment (DPIA), pursuant to Article 35 GDPR, have been conducted and documented, aimed at identifying the risks and balancing the rights and freedoms of the data subjects with the legitimate interests of the Company, which have yielded a positive outcome for the Company.
5.2. PROCESS FOR SCREENING ACTIVITIES
Once the Screening Function has determined the appropriate activities for a candidate, it will carry out the Screening Activities or, as applicable, it will task the Authorized Agent with carrying out the Screening Activities, together with the necessary candidate personal data and adequate instructions. The Screening Function is responsible for ensuring that instructions provided to the Authorized Agent are in compliance with this Policy, European Legislation and/or National Legislation.
The Screening Function, or as applicable, the Authorized Agent will contact the candidate to initiate the screening and verification activities upon receiving instructions from the Screening Function. To facilitate this process, the Company may share certain common personal data collected during the recruitment process with the Authorized Agent to initiate the relevant activities.
The Screening Function, or as applicable, the Authorized Agent shall collect the requisite documentation and additional personal data necessary to perform the requested activities directly from the candidate. The Authorized Agent may also require the candidate to sign a Screening Declaration Form in order to proceed with the checks.
Upon completion of the screening process, the Authorized Agent shall upload the relevant documentation (“Screening Outcome”) to the designated platform. Based on Screening Outcome, the Screening Function may notify the appropriate stakeholders within the HR Department involved in the recruitment process for the next steps to be taken as per the established procedure.
5.3. INTERNAL DISCLOSURE OF CANDIDATE SCREENING OUTCOME
The Screening Function may share the Screening Outcome of any candidate, to the extent necessary, with other departments or Companies of the team.blue group.
5.4. DATA TRANSFERS BY AUTHORIZED AGENT
The Authorized Agent may be authorized to transfer the candidate's personal data to third parties based in countries outside the EEA/EU for the purposes of conducting the requisitioned Screening Activities, particularly, where necessary for the candidate to enter into employment contracts with the Company, pursuant to Article 49(1)(b) GDPR.
Please refer to Annex 2 of this Policy for detailed information on the exact provisions that should be considered under the National Legislation.
5.5. REQUESTS BY CANDIDATES UNDERGOING SCREENING ACTIVITIES
Candidates who are subject to Screening Activities at the instruction of the Company may exercise any of the entitled rights under European Legislation and/or National Legislation, including GDPR rights such as right of access, erasure, and correction.
Where a candidate exercises their GDPR right of erasure and has shared their information (including any documentation) directly to the Company or through the Authorized Agent, the Company shall delete the relevant records from its corporate applications, to the extent permitted by Article 17 GDPR. Please refer to the Company Procedure on Data Subject Requests Management for more information.
5.6. RETENTION OF PERSONAL DATA
The Company will retain personal data only for as long as necessary to fulfill the purposes outlined in the "Screening Activities" section and to comply with legal obligations. The relevant retention periods will be as defined in the Privacy Policy of Candidates of the Company.
If the candidate is subsequently hired, that is where the Screening Outcome returned a positive outcome, the processing of their Personal Data will be regulated by the relevant information notice for employees or such other notices provided by the Company based on the role of the employee.
5.7. SECURITY OF DATA
The Company has implemented, where applicable also via the Authorized Agents, appropriate technical and organizational measures to ensure the security and integrity of personal data.
6 NON-COMPLIANCE NOTIFICATIONS AND DISCIPLINARY MEASURES
All legal and natural persons identified in this Policy are expected to fully comply with the Policy and other data protection documentation notified from time to time.
The Legal Department, in collaboration with the Privacy Office (and with the Group Data Protection Officer), shall evaluate any exemptions from adherence to particular provisions of this document and other data protection documentation released from time to time. Exemptions are to be considered if special circumstances do not allow for the practical implementation of a requirement, if a National Legislation supports a requested exemption, and/or if there are compensating controls in place to mitigate the risk of non-compliance.
7 REVIEW AND UPDATES
The maintenance and periodic review of this Policy shall be carried out by the team.blue group, in particular by the Privacy Office and the HR Department, with the support of the Group Data Protection Officer (DPO), as applicable.
8 ANNEX 1: LIST OF AUTHORIZED AGENTS
team.blue has engaged the following third-party service providers as Authorized Agents to conduct Screening Activities on its behalf.
The Authorized Agents will be subject to this Screening Policy in addition to the relevant service agreements entered into with the Company.
NAME OF AUTHORIZED AGENT
Validata Group BV, trading as DISA Global Solutions (“Validata”)
RELEVANT INFORMATION
DISA Global Solutions
Apollolaan 151, 1077 AR Amsterdam.
Privacy Notice of Validata can be accessed at the following address: https://disa.com/emea/privacy-website/.
9 ANNEX 2-A: NATIONAL REQUIREMENTS AND RECOMMENDATIONS
Criminal record checks may only be carried out in jurisdictions where such processing is expressly permitted under applicable national law and where the Company has established a lawful basis in accordance with Article 6(1)(f) GDPR and Article 10 GDPR.
At present, criminal record checks may be conducted for relevant roles in the following jurisdictions:
· Denmark
· The Netherlands
· United Kingdom
· Ireland
· Germany
· Türkiye
The Company has received clear legal recommendations not to perform criminal record checks in the following jurisdictions at this time:
· Spain
· Portugal
· France
These recommendations are binding for operational purposes and must be followed until this policy is formally updated to permit such checks based on verified legal authority.
