Data protection policies

1) PREAMBLE

The Groupe Adéquat, a temporary employment company, collects and processes personal data relating to its employees and job applicants in its capacity as data controller.

The purpose of this document is to present the personal data processing policy implemented by the Groupe Adéquat.

The Data Protection Policy (hereinafter the “Policy”) aims to inform you of the rights and freedoms you may exercise regarding our use of your personal data and describes the measures we implement to protect them.

2) IDENTITY AND CONTACT DETAILS OF THE DATA CONTROLLER

The Groupe Adéquat is the “data controller” of personal data relating to the management of its website and the data of its employees and candidates. These processes are implemented in accordance with applicable law.

3) DATA PROTECTION OFFICER CONTACT DETAILS

The Groupe Adéquat has appointed a Data Protection Officer whose email contact is: dpo@groupeadequat.fr, or by post at: DPO – 115 avenue du Maréchal de Saxe, CS 43315, 69003 LYON, France.

4) SCOPE OF THE POLICY

The Groupe Adéquat collects personal data and may use it within the framework of various automated processing operations.

This Policy applies to all processing of personal data as defined by the General Data Protection Regulation (hereinafter “GDPR”) of 27 April 2016 concerning the protection of natural persons with regard to the processing of personal data and the free movement of such data.

A natural person is considered identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to their physical, mental, physiological, genetic, economic, cultural, or social identity.

A processing operation means any operation or set of operations performed, whether or not by automated means, on personal data or sets of personal data, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, erasure, or destruction.

5) PURPOSES, LEGALITY, AND RETENTION PERIODS OF PROCESSING

The purpose of processing corresponds to the objective pursued, i.e., the need it meets for the data controller.

By using the website, you may provide us with certain personal data concerning you, including information related to your identity, personal or professional contact details, and economic and financial information.

Each personal data processing operation carried out by the Groupe Adéquat relies on a specific legal basis.

Your personal data will not be further processed in a manner incompatible with the purposes described in this Policy or in the collection forms.

At the end of the retention periods described below, your personal data will be deleted, except for those that we are legally required to retain or that are necessary to safeguard your rights. These are placed in an archive database and kept for an additional period as detailed in the table below. At the end of this period, your personal data will be deleted.

The legal bases and retention periods associated with each purpose of processing your personal data are described below:

Website users:

Purpose	Description of processing	Legal basis	Retention period
Access	Provision of the website, products, and services offered on the website	Performance of the contracts or pre-contractual measures	3 years from your last activity on the website
Communication	Sending communications when you have indicated that you would like to receive this information or have purchased our products or services	Performance of the contract or pre-contractual measures	3 years from each communication
Cookies	Placement and reading of cookies not subject to obtaining your consent	Legitimate interest	13 months

Candidates :

Purpose	Description of processing	Legal basis	Retention period
Personal account	Creation of a personal account allowing you to track your applications on our website	Performance of the contract or pre-contractual measures	Your data is retained as long as you have an active personal account, never exceeding 3 years from your last activity
Application management	Allowing you to submit your CV, apply for specific positions, or subscribe to our job notification emails so that we can inform you of a vacancy matching your professional profile	Performance of the contract or pre-contractual measures	2 years
Skills management	Resume database management	Legitimate interest	2 years

Compliance with our legal and regulatory obligations and protection of your rights:

Purpose	Description of processing	Legal basis	Retention period
Accounting and taxation	Retention of invoices and other mandatory documents as part of managing our accounting and tax obligations	Compliance with our legal obligations	10 years from the end of the fiscal year
Exercising your rights	Management of your requests to exercise your rights	Compliance with our legal obligations	Your data is retained for 5 years. When the collection of identity verification documents was necessary, they are deleted as soon as the verification has been completed.
Public and judicial authorities	Handling requests from public or judicial authorities and communications with authorities	Legitimate interest	Your data is retained for the duration of the proceedings before the relevant authority.

6) SHARING OF PERSONAL DATA

To achieve the purposes described above and solely in the interest of pursuing these purposes, the personal data collected by the Groupe Adéquat may be shared, in whole or in part, with the following recipients:

Any company within the Groupe Adéquat;
Our clients in their capacity as employers or potential recruiters;
Recruitment intermediaries, particularly in the form of job boards (such as LinkedIn, Indeed, Hellowork…);
Your former employers and educational institutions;
Possible third-party service providers with which the Groupe Adéquat is affiliated.

We do not authorize our third-party service providers to use your personal data for their own purposes and only allow them to process your personal data for specific purposes and in accordance with our instructions, which implies compliance with this policy.

7) SECURITY AND CONFIDENTIALITY OF YOUR DATA

The data controller implements appropriate measures to ensure the security and confidentiality of your personal data, notably to prevent it from being distorted, damaged, or accessed by unauthorized third parties.

8) RESPONSE IN CASE OF DATA BREACH

Any incident involving a breach of personal data is reported without delay to the IT Department and the Data Protection Officer (DPO).

All appropriate measures, including informing the data subject, alerting the supervisory authority, and corrective actions, are implemented promptly.

9) INDIVIDUAL RIGHTS REGARDING PERSONAL DATA PROCESSING

Right of access
All data subject to processing grants the right to access it.
Exercising the right of access allows you to obtain and verify the data held by an organization, check its accuracy, and have it corrected or deleted.
This right can be exercised electronically or by mail.
Access is free of charge.
Reasonable fees related to processing the request may be charged.

Right to rectification
Exercising the right to rectification consists of correcting or completing personal data that is inaccurate, incomplete, ambiguous, or outdated.

Right to erasure of data
The right to erasure can only be exercised when a reason specifically provided by regulations exists.
In the absence of such a reason, Groupe Adéquat will not comply with the request, particularly if retention is necessary to comply with regulations or to establish, exercise, or defend legal rights.
The right to erase personal data may be exercised:

When the data is no longer necessary for the purposes for which it was originally collected or processed;
When previously given consent is withdrawn;
In case of objection to data processing without compelling legitimate grounds for the processing;
If the data processing is not in compliance with applicable regulations.

Right to restriction of data processing
The right to restrict personal data processing is determined by legislation and regulations.

Right to object to data processing
The right to object to data processing can be exercised at any time for reasons relating to the individual’s particular situation when the processing is based on the legitimate interest pursued by the data controller.
This right includes the right to object to direct marketing.

Right to data portability
The right to data portability allows obtaining part of the data in a readable format.
This right applies if three conditions are met:

The personal data is provided by the data subject and relates to contract performance;
The data is processed automatically and based on the prior consent of the data subject or the performance of a contract;
Exercising the right to portability must not infringe on the rights and freedoms of third parties whose data is included in the transmitted data following a portability request.

Right to withdraw consent
The right to withdraw consent applies when processing is based on consent. It can be withdrawn at any time without affecting prior processing for which consent was given.

Right to lodge a complaint with CNIL
The right to file a complaint with CNIL, located at 3 place de Fontenoy, 75007 PARIS, is available to everyone, without prejudice to any other administrative or judicial remedy.

Right to define post-mortem directives
The possibility to define specific directives regarding the retention, deletion, or sharing of personal data in case of death is available to everyone.
These directives only apply to processing implemented by the data controller and are limited to that scope.

9) HOW TO EXERCISE YOUR RIGHTS

All of the rights listed above can be exercised via the following email address: dpo@groupeadequat.fr or by mail at: DPO – Adéquat, 115 avenue du Maréchal de Saxe – CS 43315 – 69003 LYON CEDEX, France.

When exercising your rights, the requester must prove their identity by any means.

If there is doubt about the requester’s identity, the Groupe Adéquat reserves the right to request additional information necessary for identification.

Data Protection Policies