Information notice on candidate protection
Sopra Steria Group S.A., whose registered office is located at Pae des Glaisins, 3 rue du Pré Faucon, BP 238, 74940 Annecy (hereinafter “Sopra Steria” or “we”), attaches great importance to protecting the privacy of its candidates (hereinafter “you”). Sopra Steria acts as Data Controller for the processing of personal data described in this Candidate Data Protection Notice (hereinafter the “Notice”).
This Notice is intended to provide candidates with information regarding the processing of their personal data during the recruitment process, which may take place through any available means (website, email, recruitment tools, professional social media such as LinkedIn, etc.).
For any data processing carried out via our website in your capacity as a user, please refer to our Personal Data Protection Charter available here.
1. What types of personal data do we process about you?
We only process personal data that is strictly necessary to assess your suitability for the position and evaluate your professional qualifications.
Accordingly, we may process the following categories of personal data:
- Candidate identification data (last name, first name, contact data);
- Data relating to your educational and professional background such as degrees and certifications, professional experience, references, awards;
- Data on your salary expectations (including the salary received in previous positions as well as your current salary);
- Data resulting from interviews and assessments (in particular your written and oral responses to tests or interviews, interview reports prepared by Sopra Steria reflecting your responses, and evaluations of your foreign language skills);
- Data about you collected from third parties (in particular information obtained from professional social networks, information collected from a former employer or colleague, etc.);
- Data relating to disability status, provided on a strictly voluntary basis.
We also collect the personal data you choose to provide when you submit your application (cover letter and CV in electronic or paper format), or when you apply for our vacancies indirectly, for example through an agency or a recruitment firm. Failure to provide the data necessary to assess your ability to perform the role and evaluate your professional skills will make it impossible for you to participate in the recruitment process.
If your application is successful and leads to the conclusion of a contract, we will request the information and supporting documents required to complete mandatory formalities. Providing this information is a condition for the conclusion of the employment contract for selected candidates. In addition, the provision of certain categories of information and supporting documents (such as civil status details, address, social security number, and confirmation of the right to reside and work) is required by law for successful applicants. Consequently, failure to provide this data will make it impossible to conclude the employment contract.
2. What are the purposes for processing your personal data?
Personal data collected as part of the review of your application is processed by Sopra Steria’s Human Resources department for the purposes described below. For each purpose, we have also specified the legal basis on which the processing of your personal data relies.
| Purposes of the processing | Legal basis |
|---|---|
| Identification of relevant candidates, including through a platform enabling candidates to submit applications (whether spontaneous or in response to a job posting). | Sopra Steria's legitimate interest. |
| Reception of applications and pre-selection of candidates: sorting, registration and classification of CVs and cover letters. | Performance of a contract (pre-contractual arrangements). |
| Implementation of tailored support measures to facilitate the participation of candidates with disabilities in the recruitment process. | Explicit consent. |
| Contacting the candidate to assess their suitability for the role they have applied for, or for another position should a similar opportunity arise, and to evaluate their professional skills, including through the processing of information collected during telephone or in-person interviews. | Performance of a contract (pre-contractual arrangements). |
| If the candidate’s application is successful, the recruitment process is finalised and the corresponding employment contract is concluded. | Performance of the employment contract. |
| Compilation of statistics relating to Sopra Steria job offers. | Sopra Steria’s legitimate interest in evaluating the effectiveness of the measures implemented to ensure the efficiency of its recruitment processes. |
| Ensuring the security of premises, for example by issuing temporary badges to manage access during on-site interviews. | Sopra Steria's legitimate interest in ensuring the security of its premises. |
| Proposing other job opportunities that may match candidates’ interests through the creation of a “talent pool” or CV database. | Legitimate interest of Sopra Steria. In the case of spontaneous applications or requests to join the candidate pool not linked to an active job offer: the candidate’s consent. |
| Identify and add a potential candidate’s profile to Sopra Steria’s “talent pool” or CV database for recruitment purposes. | Your explicit consent provided through a clear and affirmative action. |
3. Who are the recipients of Your personal data?
Your personal data is accessible only to those who need to know it in the context of the recruitment process. Access by authorised persons is limited to the performance of their duties and functions and is subject to an obligation of confidentiality.
In particular, the categories of recipients of personal data processed by Sopra Steria are as follows:
Internally:
- Members of Sopra Steria's HR and Recruitment teams;
- The IT Department for maintenance and technical support needs;
- Members of the relevant Business Unit or department responsible for the vacancy.
Externally :
- The HR departments of Sopra Steria Group subsidiaries, depending on the nature of the position (in the event that your application is shared with another entity that may be interested in your profile); an
- Sopra Steria’s service providers assisting it in the management of Human Resources, such as, for example:
- recruitment software platforms;
- external service providers working alongside Sopra Steria teams;
- recruitment agencies.
If your application is successful, some of your personal data may be shared with the relevant bodies involved in your employment (such as unemployment insurance, health insurance, pension schemes, mutual insurance providers, etc.) in order to finalise the recruitment process.
In addition, please note that Sopra Steria may disclose information where required by law, including pursuant to a court order, or to protect its rights where such disclosure is necessary to prevent fraud or cybercrime, or to ensure the safety of Sopra Steria or any other individual, as permitted or required under applicable legal provisions.
Given the international scope of the Sopra Steria Group, your personal data may be transferred outside the European Union and the European Economic Area (EEA — EU Member States, Iceland, Liechtenstein, and Norway), including to subsidiaries located in countries that do not provide a level of personal data protection equivalent to that of the EEA (i.e. third countries that have not received an adequacy decision from the European Commission).
Such international data transfers may be necessary for the performance of Sopra Steria’s business activities and its internal administrative operations. Sopra Steria ensures that transfers of personal data outside the EEA are carried out lawfully, by implementing the transfer mechanisms provided for under data protection laws and by putting in place appropriate safeguards and protective measures.
You may obtain a copy of these safeguards by sending an email to the following address: acces-cnil@soprasteria.com.
4. What is the retention period
for your personal data?
4. What is the retention period for your personal data?
At the end of the recruitment process, if your application is successful, your data will be included in your administrative file and retained in accordance with applicable legal retention periods.
If your application is unsuccessful, your data will be retained for a maximum period of 24 months from the date the rejection email is sent. This retention period allows us, firstly, to provide you with feedback on the reasons for the decision, and secondly, to reassess your profile should a similar position become available and Sopra Steria considers that it may be of interest to you.
The same retention period of 24 months applies to profiles identified by Sopra Steria and added to the candidate pool with your consent, as well as to spontaneous applications or requests to join the talent pool not linked to an active job offer.
Certain data may also be retained in an intermediate archive for evidential purposes, in order to protect and enforce our rights in the event of potential legal claims. This retention period will not exceed 5 years from the date of the decision regarding your application.
Once personal data is no longer necessary for these purposes or for archiving, we ensure that it is either completely deleted or anonymised.
5. Application via the careers portal accessible from Sopra Steria’s website
If you apply for a job through the careers portal accessible via our website, please note that this portal is based on a recruitment solution provided by our service provider SmartRecruiters Inc., which acts on behalf of Sopra Steria as a data processor within the meaning of the GDPR. For further information on SmartRecruiters’ data protection policies, please refer to their privacy notice, available at the following address: Candidate Privacy Policy | SmartRecruiters.
The solution used incorporates several features based on artificial intelligence technologies. Sopra Steria has chosen to deploy two of these features:
- a conversational tool designed to support candidates throughout the recruitment process;
- a matching tool that compares candidates’ profiles with available positions in a contextual manner (beyond simple keyword matching), to assist recruiters in identifying the most relevant applications in light of the requirements expressed.
For further information on the processing of your personal data carried out in this context, as well as on the functioning of these AI-based tools, please refer to the AI Annex – Processing of Candidates’ Personal Data via Artificial Intelligence Tools.
6. What rights
are granted to you?
Sopra Steria recognises the importance of data subjects’ rights and enables individuals to exercise them in the simplest and most effective way. Accordingly, we are open to any questions you may have regarding the processing of your personal data and to requests to exercise the following rights:
- to access your data and obtain a copy, as well as information on how your personal data is processed and the legal basis for such processing;
- to rectify your personal data where it is inaccurate, and to complete it where it is incomplete;
- to erase your personal data where it is no longer necessary for the purposes for which it was collected or processed;
- to object to the processing of your personal data where such processing is based on Sopra Steria’s legitimate interest, unless Sopra Steria demonstrates compelling legitimate grounds overriding your interests, rights and freedoms, or where the data is necessary for the establishment, exercise or defence of legal claims;
- to restrict the processing of your personal data where you have exercised your right to object or your right to rectification, for the duration of Sopra Steria’s response period;
- to request the portability of your personal data in a structured, commonly used, and machine-readable format where the processing is carried out by automated means and is based on your consent or on the performance of a contract concluded with us;
- to withdraw your consent at any time where the processing of your personal data is based on your consent.
When applying through our careers portal, you also have the possibility to exercise certain rights directly, including to:
- check the status of your application;
- update your CV or your responses to pre-screening questions;
- add or remove attachments;
- delete or anonymise your application(s) or profile at any time.
6. Who to contact to exercise your rights or if you have any questions?
If you have any questions regarding this Notice, or if you wish to exercise one of your rights that cannot be exercised directly via the careers portal, you may contact our Data Protection Officer (DPO) at the following email address: acces-cnil@soprasteria.com.
If you encounter any difficulties, you may lodge a complaint with the French Data Protection Authority (CNIL).
Last modified: 04/06/2026