I am a candidate

Introduction

At GEB, we collect and process personal data of individuals applying for a job. We understand the importance of protecting your personal data and respecting your fundamental privacy right. Therefore, we commit to ensure the confidentiality and security of your personal data.

With the provision of this notice, we aim at informing you about our practices regarding collection, use and disclosure of personal data in the context of job applications. It further informs you, the applicant, on your privacy-related rights.

For all processing of personal data during the application process, GEB is the responsible data controller as we determine both the why (purpose) and the how (means) of processing. 

Our privacy page was last updated on April 2nd 2024.

Definitions

For the purpose of our employee privacy page, the following definition apply: 

How does GEB collect your personal data?

GEB collects your personal data directly from you in the following ways:

• Information we received from you during the recruitment process 

  During the recruitment and hiring process and interviews, you provide us with certain types of personal data (e.g. CV data). When you are hired, we retain this data and it becomes part of your GEB employee file.

We also receive personal data indirectly from you: 

• Information we received from recruitment agencies and head hunters

  We cooperate with several recruitment agencies, platforms (e.g. StepStone and Monster) and head hunters. From them we receive personal data such as your CV and contact details. 

We limit as much as possible the processing of your personal data on paper. However, due to certain legal obligations we are required to store and retain certain types of personal data in paper format.

Which personal data does GEB process?

To facilitate the application process we have with you, we may collect and process different types of personal data about you, including:  

• Name and surname;
• Home address;
• Email address;
• Telephone number;
• Place and Date of birth /age;
• Gender;
• Nationality;
• Civil state and family composition;
• Social security number;
• Bank account number;
• Copy of ID card or passport;
• Any other data which may be found on your CV and cover letter (hobby’s, interests, certifications, education, etc.);
• Application interview notes, reviews, evaluations, reference letters;
• Offers made to an applicant. 

For which purposes does GEB use your personal data?

We collect and process your personal data based on the legitimate interest we have to recruit individuals and properly assess their skill and capabilities. Based on your consent we retain the data to have a “talent pool” for when future opportunities may open up. More specifically, we use your personal data for the following purposes: 

• Recruitment purposes 

  We collect and process personal data to facilitate the recruitment process and assess whether or not the applicant is suitable for the vacancy in question. Personal data information are being processed during the whole hiring process as we conduct job interviews, screen every application, make you a job offer, etc. 

  During this phase we carry out screening and vetting processes that may involve requesting references from third parties, using third party sources and performing sanctions checks. 

• Creation of a “talent pool”

  When a candidate is not immediately selected, we retain his or her personal data for a limited period in order to maintain a “talent pool” for when a future vacancy may open up. 

• Complying with any legal obligations GEB may have

  We further process your personal data for all other legal obligations GEB may have as an employer and branch of foreign legal person established in the Grand Duchy of Luxembourg. These obligations include processing your personal data to perform checks to ensure compliance with requirements under the applicable International Sanctions regimes.

• Retaining proof or evidence

  We further process your personal data for all other legal obligations GEB may have as an employer and branch of foreign legal person established in the Grand Duchy of Luxembourg. These obligations include processing your personal data to perform checks to ensure compliance with requirements under the applicable International Sanctions regimes.

  We store personal data in order to defend GEB in case of a complaint, injunction, claim or other legal action from a rejected applicant in relation to discrimination, equality or unfair treatment. 

With which parties does GEB share your personal data and why?

We share your personal data with the following parties:

• Law enforcement, government and regulatory agencies or other third parties as required by, and in accordance with, applicable laws or regulations

  Within the limits of the applicable laws, we share your personal data with authorities, law enforcement and government agencies, whenever it is required in order to meet a reporting obligation upon their request and in order to prevent criminal activities, meet national security requirements or respect law enforcement injunctions. 

Normally we do not transfer personal data of applicants to countries that are not in the European Economic Area (EEA). However, if such transfer does occur and the country does not fall under a Commission adequacy decision, GEB will ensure that appropriate safeguards are in place that provide sufficient protection for your fundamental privacy rights and freedoms. Such safeguards include, but are not limited to, Standard Contractual Clauses, as approved by the European Commission.

Which rights do you have and how can you exercise them?

GEB respects to the fullest extent the rights you have as a data subject. These rights include: 

• The right of access

You have the right to access all the information GEB has on you. This includes whether or not we have any data on you, the purposes for which we process your data, the types of personal data concerned, the recipients to whom your personal data will be disclosed and the rights you have under the GDPR. 

• The right of rectification

You have the right to rectify inaccurate, incorrect or outdated personal data we may have on you. Where personal data is incomplete, you have the right to complete it, including by means of providing a supplementary statement.

• The right of erasure 

You have the right to have your personal data erased without undue delay if one of the following conditions applies:

1. The personal data is no longer necessary for the purpose for which it was collected;
2. You withdraw your consent, if the legal basis for processing is consent;
3. You exercise your right to object and we have no overriding legitimate grounds to continue the processing;
4. The personal data has been unlawfully processed;
5. We have to erase your personal data to be in compliance with a legal obligation under EU or Member State law. 

It is up to GEB to assess the presence of the abovementioned criteria.

The right of restriction 

You have the right to obtain from us restriction to processing your personal data if one of the following conditions applies:

1. For the period enabling us to verify the accuracy of your personal data, if you have contested the accuracy of the personal data;
2. The processing is unlawfully and you request the restriction of processing instead of the erasure of the data concerned;
3. We no longer need the personal data for the purposes for which it was collected but you need it for the establishment, exercise or defence of legal claims;
4. When you exercised your right to object, for the period we need to verify whether the legitimate grounds we rely upon override yours. 

It is up to GEB to assess the presence of the abovementioned criteria.

The right to data portability 

You have the right to receive the personal data you directly provided to us in a structured, commonly used and machine-readable format and transfer it to another data controller. We will not hinder you if you exercise this right.

The right to object and not be subject to automated individual decision making (including profiling)

You have the right to object, at any time and on grounds specifically related to your particular situation, to the processing of your personal data provided that we process the data concerned based on our legitimate interest. In such case we will no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or the processing is necessary for the establishment, exercise or defence of legal claims.

Furthermore you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you.

The right to withdraw your consent

You have the right to withdraw your consent at any time for the processing activities for which we requested your consent. Any processing of your personal data we may have performed before your withdrawal shall remain lawful.

The right to lodge a complaint with the supervisory authority

You have the right to lodge a complaint with the competent supervisory authority in Luxembourg: the National Data Protection Commission (Commission Nationale pour la Protection des Données – CNPD)  (https://cnpd.public.lu/en/commission-nationale.html) or any other supervisory authority in another country.

You can exercise your privacy rights by sending an email to privacy@geb.com. We will duly address all your privacy related requests and provide you with an answer within a period of one month after receiving the request. Due to the complexity of your request, we may exceptionally require more time to provide you with an answer. We will inform you within one month after receiving the request of such extension, as well as the reason for the extension and the estimated timeframe in which we will provide you with an answer, which will never exceed an additional period of two months. 

How long will GEB keep your personal data?

GEB will only retain your personal data for as long as is necessary to fulfil the purpose for which we collected it. Upon receiving your consent, we will retain your personal data for 6 months after the notification of rejection in case there is a relevant job offering for which you will be a fitting candidate. If an applicant is hired, all personal data becomes part of his or her employee file and thus processed in accordance with “employee privacy notice”.