Candidates’ Privacy Notice

Zelestra Corporación, S.A.U. and the companies that are part of the Zelestra Group (together, “Zelestra” or the “Zelestra Group”) are committed to protecting your privacy and complying with applicable personal data protection laws, in particular Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”) and the applicable national data protection legislation.

This privacy notice applies to the processing of personal data of candidates who apply for and/or are offered a job or internship position in a Zelestra Group company.

1. Data controller

The data controllers are the Zelestra Group companies responsible for each selection process. Their identification and contact details, including their data protection contact points (and, where appointed, their Data Protection Officer), are set out in Annex I.

2. Categories of personal data subject to processing

We will process the data necessary for registration on our employment portal (such as your email address and login details) and the data and documentation you provide when applying for a job or internship offer, generally: first and last name, date of birth, telephone number, country, address, CV, education, professional experience, certifications, and languages.

We will also process the results of tests carried out during selection or pre-selection processes.

If you participate in and pass a selection process, we may request and process, depending on the country where the vacancy exists, additional data such as: identity document and/or social security number and/or passport, banking details, and health and family data, if applicable.

3. Purposes of processing your personal data

1. Register as a user on our employment portal, manage your account, and communicate with you regarding your account, based on the need to take steps at your request prior to entering into a contract (Article 6(1)(b) GDPR).
2. Allow you to participate in the selection processes to which you apply, including assessing your suitability for the job or internship offered, on the same legal basis (Article 6(1)(b) GDPR).
3. If you pass the selection process, carry out the administrative procedures prior to entering into an employment or internship contract, based on the need to take steps prior to entering into a contract (Article 6(1)(b) GDPR) and on compliance with the employer’s legal obligations in labour, tax and social security matters (Article 6(1)(c) GDPR). Health data, where applicable, will be processed to comply with obligations in the field of employment, occupational health and safety and social security (Article 9(2)(b) GDPR).
4. With your prior consent (Article 6(1)(a) GDPR), include your data in a common candidate database of the Zelestra Group, so that you may be considered for future job or internship vacancies in other Group companies.
5. Send you job and/or internship alerts, if you activate them on our employment portal, based on your consent (Article 6(1)(a) GDPR).

4. Retention period of your data

Your data will be retained in accordance with the following circumstances:

1. If you are not hired: Your data will be retained for the duration of the selection process in which you participate. Once it ends, they will remain blocked for three years, solely at the disposal of the courts and the competent public authorities to address any liabilities arising from the process, in accordance with Article 32 LOPDGDD, and will then be deleted. In Germany, your data will be deleted six months after the end of the selection process, without subsequent blocking.
2. If you are hired: The data and documentation provided during the selection process that are necessary for the employment relationship will be added to your employee file and processed in accordance with the applicable employee privacy notice. The remaining documentation from the selection process will be deleted.
3. If you have consented to the inclusion of your data in the common candidate database, they will be retained for two years from their last update, unless you withdraw your consent earlier. In Germany, data in the common candidate database will be deleted six months after their last update.
4. Your employment portal will be retained while the account remains active. Accounts not accessed for two years will be deleted after prior notice.

5. Recipients of your data

Your data may be shared with other Zelestra Group companies where necessary for the purposes described in this privacy notice, particularly for managing selection processes and, with your consent, for the common candidate database.

Your data will also be accessible to service providers acting on our behalf as data processors, such as the employment portal provider and recruitment agencies, under the corresponding data processing agreements (Article 28 GDPR).

Your data may also be disclosed to courts, public authorities and other third parties where required by law.

6. Transfer of personal data to a third country

Any international transfers of personal data to countries outside the European Economic Area (EEA) that may arise from your participation in our selection processes will take place, as applicable, (i) on the basis of an adequacy decision of the European Commission, pursuant to Article 45 of GDPR; or (ii) subject to appropriate safeguards pursuant to Article 46 of the GDPR, consisting of the Standard Contractual Clauses adopted by the European Commission by Implementing Decision (EU) 2021/914 of 4 June 2021. You may obtain a copy of those safeguards, as well as further information, by contacting the contact persons at the entity responsible for the recruitment process (see Annex I).

7. Automated decisions about your data

We do not use automated decision-making, including profiling, in selection processes.

8. Rights of data subjects in relation to their personal data

You have the right to access and rectify your personal data, to erase them where, among other cases, they are no longer necessary, and to request restriction of processing and data portability. Where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of prior processing.

You may exercise these rights free of charge by writing to the addresses listed in Annex I. You may also keep your data up to date through your account on the employment portal.

You have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es), the Italian Garante per la protezione dei dati personali (www.garanteprivacy.it), the Hamburg Commissioner for Data Protection and Freedom of Information (www.datenschutz-hamburg.de) or with the competent supervisory authority in your country.

****

Annex I