Information notice on candidate data protection
Sopra Steria Group S.A., with a capital of € 20,547,701, registered with the Annecy Company Register under n° 326 820 065, with headquarters located at PAE Les Glaisins, 3 rue du Pré Faucon, Annecy Le Vieux, 74940 Annecy, France, (hereinafter referred to as "Sopra Steria" or "we" or "us") attaches great importance to the protection of personal data of its Candidates (hereinafter referred to as "Candidates" or "You").
The purpose of this Notice is to provide Candidates (responding to job offers published by Sopra Steria or spontaneous candidates) with information on the processing of their personal data during the recruitment process, which may take place through any available channel (website, e-mail, recruitment tools, professional social media such as LinkedIn, etc.).
Please note that this Notice may be updated from time to time by Sopra Steria. The date of the most recent update will appear on this page. We therefore invite You to consult it regularly.
1. What kind of personal data do we process about You?
We only process personal data that is strictly necessary for the purposes of assessing Your suitability for the proposed job and evaluating Your professional skills. As a result, we may process the following categories of personal data:
- Candidate identification data (last name, first name, contact data);
- Data relating to Your educational and professional background such as degrees and certifications, professional experience, references, awards;
- Data on Your salary expectations (remuneration paid in Your previous positions and your current salary);
- Data resulting from interviews and assessments (in particular, Your written and oral answers to tests or interviews, interview reports written by Sopra Steria and reproducing Your answers, assessments of Your foreign language skills);
- Data about You collected from third parties (including information obtained from professional social networks, information collected from a former employer or colleague etc.).
The personal data we process may be provided directly by You when You send us Your application (cover letter and curriculum vitae in electronic or in paper format), or indirectly when You apply for our vacancies for example through an agency or recruitment firm.
Failure to provide the data necessary to assess Your suitability for the post and Your professional skills will make it impossible for You to participate in the recruitment process.
In the event that Your application is accepted for the conclusion of an employment contract, we will ask You for the information and evidence necessary to comply with mandatory formalities. In addition, the communication of certain categories of information and supporting documents is mandatory by law for successful candidates. Consequently, failure to provide this data will make it impossible to conclude the employment contract with You.
2. What are the purposes of the processing of Your personal data?
Personal data is collected for the purposes described below. Alongside the purposes, we have also specified the legal bases for the processing:
| Purposes of the processing | Legal basis |
|---|---|
| Searching for relevant profiles including via a platform available to candidates for submitting applications (spontaneous or in response to a job offer). | Sopra Steria's legitimate interest. |
| Reception of applications and pre-selection of candidates: sorting, registration and classification of CVs and cover letters. | Performance of a contract (pre-contractual arrangements). |
| Contacting the candidate to assess his/her suitability for the position for which he/she has applied, or for another position if a similar one becomes vacant, and to evaluate his/her professional skills: processing of information collected during telephone interviews, face-to-face interviews, etc. | Performance of a contract (pre-contractual arrangements). |
| If candidate’s application is successful, conclude the recruitment process and manage the relevant employment contract. | Performance of the employment contract. |
| Compilation of statistics relating to Sopra Steria job offers. | Sopra Steria’s legitimate interest. |
| Ensuring the security of the premises (e.g. creation of temporary name badges to manage access to our premises in case of on-site job interviews). | Sopra Steria's legitimate interest in ensuring the security of its premises. |
| Propose other job offers that may correspond to the candidates' searches via the creation of a "candidate pool" or CV library. | Candidate’s explicit consent provided by a positive and clear act. |
| Enforce our rights against possible legal actions. | Sopra Steria has a legitimate interest in processing personal data to defend its rights and interests in the event of legal actions. |
3. Who are the recipients of Your personal data?
Your personal data is accessible only to those who need to know it in the context of the recruitment process.Access by authorised persons is limited to the performance of their duties and functions and is subject to an obligation of confidentiality.
In particular, the categories of recipients of personal data processed by Sopra Steria are the following:
Internally :
- Members of Sopra Steria's HR and Recruitment Department;
- The IT department for maintenance and technical support needs;
- Members of the specific BU or Department in which the post is to be filled.
Externally :
- HR departments of Sopra Steria Group subsidiaries depending on the nature of the position; and;
- Sopra Steria's service providers specialised in HR recruitment and management such as:
- Software recruitment platforms;
- External service providers integrated into the Sopra Steria staff;
- Recruitment firms.
If your application is successful, in order to finalise the recruitment process, some of your personal data maybe passed on to organisations that need to be informed of your employment (such as health insurance,pensions, etc.).
Sopra Steria may also disclose information if required by law, including pursuant to a court order or to defendits rights, if such measures are necessary to prevent fraud or a cybercrime, or to ensure the security of Sopra Steria or any other person, where required or permitted by applicable legal provisions.
Given the international dimension of the Sopra Steria Group, Your personal data may be transferred to recipients outside the European Union/European Economic Area (EEA: EU Member States and Iceland,Liechtenstein and Norway), to countries that do not offer a level of protection up to the EU standard of essential equivalence. International transfers of personal data may be necessary for the performance of Sopra Steria’s business activities and for its internal administrative management. Sopra Steria ensures that restricted transfers take place lawfully, using the transfer tools provided for by applicable regulations and providing appropriate safeguards and protection measures. You can obtain a copy of these guarantees by sending an email to the following email address: support.privacy@soprasteria.com or acces-cnil@soprasteria.com.
4. How long do we store Your personal data?
4. How long do we store Your personal data?
We will only keep Your personal data for as long as is necessary to complete the recruitment process. If You are successful, Your data will become part of Your administrative file and will be kept for a maximum of five years after the end of the employment relationship as required by applicable law.
At the end of the recruitment process and if Your application is rejected, Your data will be kept in an active database for three months so that You can obtain an explanation of the reasons for this decision. Thereafter,and only with your consent, Sopra Steria may retain Your data for a maximum total duration of 24 months after the last interaction with Sopra Steria. This period allows us to re-evaluate Your profile if a similar position becomes available that we believe may be of interest to You.
Some of Your data may be kept in an intermediate archive with restricted access for evidentiary purposes in order to enforce our rights against possible legal actions. This period will not exceed 5 years from the date of the hiring decision.
Once Your personal data is no longer needed for the said purposes or for archiving purposes, we ensure that it is completely destroyed or anonymised.
5. What rights do you have?
Sopra Steria recognizes the importance of data subject rights and enables individuals to exercise them in the simplest and most effective way. Accordingly, we are open to Your questions on the conditions of processing of Your personal data and to Your requests to exercise the following rights:
- Right to access and obtain a copy of Your personal data and information on how Your personal data is processed and its legal basis;
- Right to rectify Your personal data if it is incorrect and the right to complete it if it is incomplete;
- Right to delete Your personal data when it is no longer required for the purposes for which it was collected or processed;
- Right to object to the further processing of Your personal data on grounds relating to your particular situation, if the processing is based on Sopra Steria's legitimate interest, unless Sopra Steria has compelling legitimate grounds for doing so, or if the data is necessary for the establishment, exercise or defence of legal claims;
- Right to limit the processing of Your personal data when You have exercised Your right to object or rectify Your data pending a response from Sopra Steria;
- Right to request the portability of Your personal data in a machine-readable format if our processing is based on Your consent or the performance of a contract You have entered into with us;
- Right to withdraw Your consent to the processing of Your personal data if such processing is based on Your consent.
When you apply for a position or submit a spontaneous application on our recruitment platforms, you can exercise some of your rights directly on the platform, including the right to:
- Consult the status of your application;
- Edit your CV or answers to pre-selection questions;
- Add or delete attached files;
- Delete or anonymize your profile at any time.
6. Who to contact to exercise your rights or if you have questions?
If you have questions about this Notice or would like to exercise any of your rights, you can contact our Data Protection Officer (DPO) at the following email address: support.privacy@soprasteria.com or acces-cnil@soprasteria.com.
Last modified: 19/06/2023