The GDPR expects the protection of personal data.
Personal data, as defined by the GDPR, is any information relating to an identified or identifiable natural person.
An "identifiable natural person" is defined as a natural person who can be identified, directly or indirectly, in particular by an identifier, such as a name, an identification number, location data, or by one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.
In order to guarantee respect for personal data, the GDPR defines several rights that our users can exercise.
It is imperative to reply to the requester only at the email address attached to the user account expressing the request in order to guarantee that the data is addressed to the right person.
If the user is no longer part of the customer's workforce, proof of identity must be requested in order to guarantee their identity.
Whichever department receives the request, it must be forwarded to the DPO at dpo@365talents.com. All requests are logged in an ad hoc register, and the tracking of these requests is stored for a period of no more than three years from receipt of the request. Once a year, the register must be purged to remove items that are more than three years old.
Right to Access
Scope of the right
Article 15 of the GDPR allows any individual to obtain information as to whether or not their personal data is being processed.
In the case that they are processed, the natural person may claim access to their data as well as the following information:
- the purposes of the processing ;
- the categories of personal data concerned;
- the recipients or categories of recipient to whom the data has been or will be disclosed;
- where possible, the period for which the personal data will be kept or, where this is not possible, the criteria used to determine this period (in order to be able to inform the customer on this point, reference should be made to the data retention policy);
- the existence of the right to ask the controller to rectify or erase personal data, or to restrict the processing of personal data relating to the data subject, or the right to object to such processing;
- the existence of the right to lodge a complaint with a supervisory authority;
- where personal data is not collected from the data subject, any available information as to its source.
Processing the request
When an access request is received by the DPO, it must be processed within a maximum of 30 days from receipt.
To this end, an initial response e-mail is sent to the user, inviting them to log on to their user account in order to consult the data accessible there. If the user wishes to obtain a detailed report containing log-type technical data in addition to the data directly accessible online, they are invited to confirm their request by sending a second e-mail.
Upon receipt, a reply is sent with a copy of the data concerned to the e-mail address registered on the platform:
- Technical log of actions (30-day history kept);
- Activities (no date limit).
Rectification rights
Scope of the right
In addition to the right of access, Article 16 of the GDPR allows any person to obtain rectification of personal data concerning them.
This right allows any person to correct inaccurate data (surname, first name, etc.) or to complete data in connection with the purpose of the processing.
Processing the request
When a request for rectification is received by the DPO, it must be processed within a maximum of 30 days from receipt.
As long as the request does not appear disproportionate or abusive, we cannot oppose the rectification.
On receipt of this request, the user is invited, by return e-mail, to log on to their account in order to rectify the data concerned themselves. If the desired change cannot be made by the user themselves, the DPO forwards the change request to the "Product & Engineering" department on behalf of the user. Once the modification has been carried out, the DPO informs the requester by return e-mail.
The DPO then informs the Customer of the correction made, so that it can be taken into account in the Customer's HRIS.
Erasure rights / Right to be forgotten
Scope of the right
Article 17 of the GDPR allows any natural person to assert their right to be forgotten. We are obliged to comply with the customer's request if one of the following situations corresponds to his case:
- Their data is not or is no longer necessary with regard to the purposes for which it was initially collected or processed. Example: an employee who has left the 365Talents' client company.
- Withdrawal of consent to use data if the legal basis for processing was consent. Example: an employee no longer wishes his Linkedin profile data to be accessible on the platform.
- The data is processed unlawfully. Example: data collected without any legal basis
- The data must be deleted to comply with a legal obligation.
Processing the request
When a request for deletion is received by the DPO, it must be processed within a maximum of 30 days from receipt.
The DPO analyzes the merits of the request and indicates :
- agreement
- disagreement
- conditional approval
If the deletion is approved, the DPO sends the deletion order to the Product & Engineering department, so that the deletion operations can be carried out in the databases.
The DPO informs the requester, by return e-mail, of the deletion once it has been carried out.
If deletion is refused, the DPO sends an e-mail to the requesting party indicating the refusal to delete the data and the justification for this refusal.
In the event of conditional approval, the DPO must specify which elements, if any, are to be retained, and then sends the deletion order to the Product & Engineering department so that the deletion operations can be carried out in the databases.
Once the deletion has been carried out, the DPO informs the requester by return e-mail.
Right to restrict processing
Scope of the right
Article 18 of the GDPR supplements individuals' rights of rectification and opposition.
Indeed, in the manner of a summary proceedings action, any natural person has the right to obtain the limitation of the processing of their data (except retention) when one of the following applies:
- The individual disputes the accuracy of the data
- The processing is unlawful, but the data subject objects to the deletion of the data
- The data controller no longer needs the data, but the requester objects to its deletion (in order to take legal action, etc.).
Processing the request
When a request for restriction is received by the DPO, it is analyzed. If the request is granted, we are obliged to confirm this to the requester and also to inform them before the restriction is lifted.
This information will be sent by e-mail.
No notice period is imposed by the GDPR, so we will respect a one-month notice period.
Right to data portability
Scope of the right
Article 20 of the GDPR creates a new right, namely the right to data portability. Any natural person can now ask the data controller to retrieve the personal data they have provided, for personal use or to pass it on to a third party. The regulation stipulates that the data controller must provide a copy of the data in a structured format (excluding PDF) that is commonly used and readable.
The right to data portability concerns personal data provided by the individual and collected on the basis of consent or the performance of a contract and processed using automated processes.
Processing the request
When a request for portability is received by the DPO, the latter replies to the applicant by e-mail that this right is not available within the framework of the 365Talents service.
Nevertheless, the requestor is informed that they can freely extract their data via the dedicated function accessible on their personal account.
Right to object to processing
Scope of the right
Pursuant to Article 21 of the GDPR, any person has the right to object, on legitimate grounds, ("reasons relating to their particular situation") to their data being used for data processing.
In the case of prospecting, particularly commercial prospecting, this right can be exercised without having to justify a legitimate reason.
Processing the request
Upon receipt of such a request, it is analyzed by the DPO. A reply is sent to the requester by return e-mail.