Data processing

Customer Data used by the Service

Table of Customer Data used by the Service

Processing of personal data

How is personal data produced or stored on the Service processed? What information should be submitted to the CNIL or the Correspondant Informatique et Libertés?

# Have you nominated a DPO?

Yes: Santiago Valls, DPO, dpo@365talents.com

# Does the processing involved comply with any specific regulations?

GDPR.

# Which categories of people are affected by the processing?

Customer employees

# Does the Service collect sensitive data such as racial or ethnic origins, political or religious opinions, health-related data?

No

# Where does the data come from?

Data is collected via the personal profile of each Service User. At the User's initiative and by explicit consent, certain data may come from additional sources.

# Is data collected via "notepad" areas (free comment fields)?

Yes

# Is the Service interconnected with another Service with a different purpose?

No

# Who can have communication of the personal data processed by the Service? Who has access to the data processed by the Service?

Customer employees have access to their own data. HR, Planning and Management teams of the customer have access to the data of the employees for whom they are responsible.

# Is the Service operated by a subcontractor?

Other than 365Talents: No.

# How long is the data processed by the Service kept? How long is the data retention?

The data of an employee concerned by the Service is kept for the duration of their presence with the Customer. When the employee leaves the scope of the Service or leaves the Customer, the data is deleted.

# What security and confidentiality measures have been put in place?

- A user authentication procedure has been implemented
- Connection logging
- Data is encrypted in transit and at rest
For further details, please refer to the "Security" section.

# What are the rights of information, rectification and opposition of persons concerned by data processing?

Customer employees concerned by the Service are informed by a communication prior to use of the Service.

Each employee has access to his or her personal profile, and can thus exercise their right to rectification or opposition.

365Talents has procedures dedicated to the exercise of users' rights which include the definition of roles and responsibilities, both at 365Talents and its customers, and the actions to be taken in each case (information, rectification, opposition, etc.).

# Can Users exercise their right to be forgotten?

Yes.

# Is data processed or sent outside the European Union (EU)?

No

# Where is the data processed?

365Talents hosts the Service data in the European Union, notably in France.

The location of the various components of the 365Talents infrastructure is :

• France for databases and servers (Microsoft Azure subcontractor)
• Germany and Belgium for the e-mail service (subcontractor Mailjet)
• European Union for the integration aggregator (subcontractor Kombo), if used.

365Talents undertakes to obtain the prior agreement of its customers when it plans to transfer data outside the European Union or the European Economic Area, or to relocate an infrastructure element outside these areas.

# Are Users informed of the purpose of the data processing? If so, how?

Yes, automatically through the display and validation of a User Charter when the Service is first used. This data (list of users who have validated the User Charter and time-stamp of actions) can be exported on request. The User Charter can then be displayed on demand directly on the platform. It is not possible to use 365Talents without validating the User Charter.

# Does the platform use cookies?

The platform does not use session cookies, but a cryptographically signed token mechanism (see detailed Security Questionnaire).

The only cookies used are essential to the operation of 365Talents and are used to display guides and FAQs to users when they use the platform. These cookies are strictly necessary for the operation of the platform, are anonymous and are kept for a maximum of one year.

Data isolation and partitioning

# Is data isolated between customers?

Yes: the Supplier offers shared hosting of its Service to all its Customers, while guaranteeing data isolation.

# What measures have been put in place to guarantee data isolation and watertightness?

Measures put in place to isolate customer data: database isolation, logical isolation.

# Is data in the pre-production environment anonymous?

Yes, data in the pre-production environment is anonymized whenever possible, and otherwise pseudonymized through an automated, mandatory process:

• One-way hashing with salt of directly identifying user data (last name/first name/email address/id);
   
• Deleting profile photos ;

# Is data passed on to third parties anonymous?

When transmitting data to third parties:

• Mandatory use of a data anonymization brick that successively applies a blacklist of properties never to be transmitted (including last name, first name, personnel number, etc.), then, process by process, a whitelist of necessary properties.

# Is the data used by our algorithms anonymous?

Within the framework of our algorithms :

• Minimization: use of a separate database containing no personal data
• No Correlation: User actions (such as adding a skill or giving feedback on a suggestion) are anonymized with different hash keys for each type of action, to prevent the aggregation of all the actions of a specific User; anonymized data does not retain the dates of experiences, to prevent the identification of a User by the succession of his experiences.

Possible data leakage

# What is 365Talents' procedure in the event of a customer data leak?

In the event of a data leak, the Customer's pre-identified Security contact is immediately informed by email or telephone.
Data leakage incidents are given priority, and all ongoing developments and deployments are interrupted until they have been resolved.
In the event of non-use of SSO: mandatory reset of the passwords of the users of the Service.

# What are the Supplier's response time commitments in the event of a Customer Data leak?

365Talents commits to, as soon as any Data Leak affecting the Service's data comes to light:
- make available to the Customer, within one (1) working day of its discovery, an impact analysis and associated corrective plan, in agreement with the Customer;
- make available to the Customer within three (3) working days of its discovery, any workaround or workaround solution that does not alter the price or functionality of the products and services supplied under the Contract;
- to provide the Customer with a definitive solution to the problem within seven (7) working days of its identification.

Data retention and reversibility

# How long are Customer Data stored?

Customer Data and backups are stored for the duration of the Contract.
Please refer to the Security section for more information on the content of backups.

# Is there a data reversibility plan?

On expiry of the Contract for any reason whatsoever, 365Talents shall return to the Customer or destroy, within the period communicated by the Customer, all Customer Data in its possession.

In particular, 365Talents shall make available to the Customer, at its request sent within thirty (30) days of the date of termination or expiry of the Agreement and at no cost to the latter: The Customer Data organized in a structured database in a standard and widespread format which is readable and exploitable by the Customer and defined by mutual agreement between the Parties, including all data used for the performance of the Agreement Services.

365Talents shall provide the Customer with all the assistance required to handle the Customer Data. This assistance may not exceed one (1) month from the date of notification by the Customer of its request to implement the Reversibility Plan.

365Talents will maintain the level of service quality and security until the end of the service, and will suspend all access and authorizations for its personnel.

365Talents undertakes, upon expiry of the Contract for any reason whatsoever, to destroy all Customer Data in its possession within the time period communicated by the Customer. A certificate of destruction will be provided by 365Talents.

Throughout the duration of the contract, 365Talents undertakes to purge, at the Customer's request, all or part of the data linked to the service within the deadlines defined by the Customer, and undertakes to provide a copy of the data if the Customer so requests.

# Can Data be exported?

Yes: Users with the appropriate rights can export Service Data in Excel format at any time.

Commitments of subcontractors

# What are MailJet's commitments regarding Data confidentiality?

Excerpts from the Agreement on the Processing of Personal Data which binds the subcontractor to the Supplier:

> For the purposes of this DPA, the Customer is the controller of the Customer's Personal Data and Sinch Email is the processor of such data, except when the Customer acts as a processor of the Customer's Personal Data, in which case Sinch Email is a sub-processor.

> Under the Principal Agreement, Sinch Email provides certain email and sms services to the Customer which involves the processing of personal data. Such processing activities include (a) providing the Services; (b) the detection, prevention and resolution of security and technical issues; and (c) responding to Customer's support requests.

> Sinch Email shall only process the Customer's Personal Data (i) for the purposes of fulfilling its obligations under the Principal Agreement and (i) in accordance with the documented instructions described in this DPA or as otherwise instructed by the Customer from time to time. Such Customer's instructions shall be documented in the applicable order, services description, support ticket, other written communication or as directed by Customer using the Services (such as through an API or control panel).

> Sinch Email shall ensure that each of its, and sub-processors', personnel that is authorized to process the Customer's Personal Data is subject to confidentiality undertakings or professional or statutory obligations of confidentiality and are trained with the relevant security and Data Protection requirements.

Available in full online: https://fr.mailjet.com/dpa/

# What are Microsoft Azure's commitments regarding Data confidentiality?

Extracts from the terms and conditions that bind Microsoft Ireland to the Supplier:

> Customer and Microsoft agree that Customer is the controller of Personal Data and Microsoft is the processor of such data, except (a) when Customer acts as a processor of Personal Data, in which case Microsoft is a subprocessor; or (b) as stated otherwise in the Online Service Specific terms or this DPA. When Microsoft acts as the processor or subprocessor of Personal Data, it will process Personal Data only on documented instructions from Customer.

> Microsoft will implement and maintain appropriate technical and organizational measures to protect Customer Data and Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed.

> Customer Data (including any Personal Data therein) in transit over public networks between Customer and Microsoft, or between Microsoft data centers, is encrypted by default.

Available in full online: https://www.microsoft.com/licensing/docs/customeragreement

Internal organization and procedures

# What safety awareness program does the service provider set up for its employees?

> Training program content
The awareness program includes elements of monitoring and common information on news concerning Data security, a detailed presentation of CNIL and GDPR issues, and for certain profiles with responsibility (DPO) the consultation of lawyers/experts specializing in these subjects.

> How it's done\
Awareness-raising is carried out when each employee is hired and repeated at least once (1) a year.
Consultation with lawyers/experts is set up on a case-by-case basis, depending on current events and the new issues at stake.