Version 1.1 – 01/11/2019
The protection of your privacy is important to Tobania. We undertake to protect and process your personal data in strict compliance with the law, and to make sure you have the latest information.
The purpose of this privacy statement is to fully inform you and to explain how we collect, use and store your personal data. The contractual provisions we agreed with you remain unchanged. We invite you to take the time to read this privacy statement to become aware of how we handle this subject. You may object to the processing of your data, as explained in Chapter 6 of this notice.
1. What is this privacy statement about?
A. What does "processing your data" mean, and who is the controller?
"Processing" means any operation or set of operations which is performed upon personal data such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by means of transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction of personal data.
Tobania NV, with its registered office at 1853 Strombeek-Bever, Romeinsesteenweg 564 box 4, is responsible for processing the personal data it deems necessary to process.
We are therefore the party whom you, as well as the supervisory authorities (for example the Data Protection Authority), should contact for any questions you may have relating to the way Tobania uses your data.
The “controller” in the sense of the applicable data protection legislation means the natural or legal person, public authority, agency or other body which, alone or jointly with others, that determines the purposes and means of the processing of personal data as described above. Tobania will be the controller with regard to the processing of your personal data.
B. To whom is this privacy statement addressed?
Those affected by this privacy statement are:
- Customers, sub-contractors, candidates, prospects, website visitors etc. of Tobania who are identified or identifiable natural persons;
- All other identified or identifiable natural persons who are involved in any transaction with Tobania as representatives of our customers, sub-contractors, prospects, candidates etc. whether private individuals or legal entities (for example company directors, agents, legal representatives or other contact persons).
C. Which data are covered by this privacy statement?
The data covered by this privacy statement are personal data, i.e. any information in relation to an identified or identifiable natural person. We may collect personal data from you directly, or from other sources.
We may collect various personal data about you from you when you interact with Tobania:
- identification data: your name, address, date and place of birth, picture, account number, phone number, e-mail address, IP address, household composition, educational history, employment history, references, your qualifications skills…;
- data relating to your behaviour and habits when using our affiliates’ or our own internet websites.
We may also collect personal data about you from other sources (e.g. information about your professional qualifications as posted on LinkedIn or on other resources). If we do so, we will inform you within a reasonable time of the categories of personal data involved and the source thereof, as well as the other information contained in this privacy statement.
2. For which purposes are your personal data processed?
Your personal data may be processed for any of the following purposes:
- To improve our websites and our services;
- To fulfil legal and contractual obligations (customers, supplier, …)
- To market our services (including sending you promotional messages about our products and services);
- To maintain our business relationship, where you are a user of our website, a client or a candidate;
- For recruitment, in case you participate in a recruitment process;
- To retain candidate details and notify about future job opportunities;
- To comply with legal, regulatory and judicial requirements and reasonable requests.
- To defend ourselves in the event of a legal claim.
3. What is our legal basis for processing your personal data?
A. General information about legal basis
We process your personal data for different purposes. For each processing, only the data that are relevant to the intended purpose will be processed.
Generally, we will use your personal data either:
- as part of performing a contract or taking pre-contractual steps;
- to comply with all the legal and regulatory provisions that govern us;
- for reasons relating to the legitimate interests of Tobania, i.e. the freedom to do business, information security, fraud detection and prevention as well as direct marketing. When we carry out this type of processing, we always seek to maintain the balance between this legitimate interest and the protection of your privacy. We do not use personal data where our interest is overridden by the impact on you (unless you consent to this or are otherwise required for legal and regulatory compliance); or
- whenever we have obtained your (explicit) consent.
B. Legal basis when processing personal data for recruitment purposes
You may provide us with personal data about you when participating in a recruitment process (e.g. when applying on our jobsite, either for a specific job opportunity or as a general, ‘open’ application). In this case, we process your personal data as part of taking pre-contractual steps. If we do not enter into a contract with you after you have applied for a specific job, we intend to retain your personal data for other job opportunities. In this case, retaining your personal data is necessary for our legitimate interest as an IT consultancy company whose core business consists of assessing and matching candidates with potential job opportunities. You have a right to object to the fact that we retain your personal data in this way, in which case we will remove your data as soon as possible and in any event within one month.
We may also collect personal data about you from other sources (e.g. information about your professional qualifications as posted on LinkedIn or on other resources). Doing so is necessary for our legitimate interest as an IT consultancy company whose core business consists of assessing and matching candidates with potential job opportunities. You have a right to object to such processing.
C. Legal basis when processing personal data for marketing purposes
We may use your personal data to send you direct marketing materials, including invitations to events that we organise. In this case, processing your personal data is necessary for our legitimate interest as a commercial company, since we need to promote ourselves both as a provider of products and services and as an employer. You have a right to opt out of such direct marketing or to adjust your preferences.
4. How do we protect your data?
We have set up an adequate standard of security when it comes to safeguarding and protecting personal data in accordance with our legal obligations. By doing so, we want to prevent any unauthorized person from gaining access to, processing, altering or deleting personal data.
We would like to draw your attention to the fact that no security measures can guarantee 100% security.
You also have an important role to play in safeguarding your personal data. E.g. you should choose sufficiently strong passwords and never share your account credentials (log-in and passwords).
5. Who has access to your data and to whom are they transferred?
A. General information about access to and transfer of your data
The people who are authorized to access your data are specifically defined depending on their role.
We may transfer your personal data to any of the following third parties if necessary for the purpose:
We enter into data processing agreements with companies that process your data on our behalf in order to ensure the same level of security and confidentiality of your data. We remain responsible for these processing operations. If these processors are based the in USA, we will check if they are a member of the EU/US privacy shield and if they have the required level of security and confidentiality measures or, alternatively, implement another data transfer mechanism, such as standard contractual clauses or binding corporate rules.
B. Access to and transfer of your data when we process these data for recruitment purposes
You may provide us with personal data about you when participating in a recruitment process (e.g. when applying for a job on our jobsite). If the job you apply for does not involve working directly for our customers, we will only disclose your personal data to dedicated members of our HR team and to managers or team members of our relevant departments. If the job you apply for does involve working directly for our customers, we may in addition also disclose your personal data to such customers. If we do not enter into a contract with you after you have applied for a specific job and we retain your personal data for other job opportunities, we will not disclose your personal data to our customers without your consent.
We may also collect personal data about you from other sources (e.g. information about your professional qualifications as posted on LinkedIn or on other resources). In this case, we will only disclose your personal data to dedicated members of our HR team and to managers or team members of our relevant departments. We will only disclose your personal data to our customers with your consent.
C. Access to your data when we process these data for marketing purposes
When we process your personal data for marketing purposes, we will only disclose these data to dedicated members of our marketing team and, if applicable, to external parties that provide services related to marketing. In the latter case, we will enter into data processing agreements with such service providers.
6. How long do we retain your personal data?
A. General information about retention periods
We will not keep your personal data for longer than necessary for the processing purposes for which your data were collected. We will appropriately and securely dispose of your personal data when we no longer need them. We take into account the sensitivity of your personal data, the purpose and the legal requirements in order to use the appropriate retention period.
We keep basic information about our customers and suppliers for up to 10 years for liability, legal, tax and compliance purposes after the end of the contract. In specific cases, we may be required to retain these data for a longer period of time, for example in the event of a legal dispute.
For more information about our data retention policy, please contact firstname.lastname@example.org.
B. Retention period when processing personal data for recruitment purposes
When you give us your personal data when applying for a specific job opportunity, we will retain your personal data for one year after having obtained them, unless you object to this. If you object, we will remove your personal data within three months after the application has been closed. After you have objected, we will not contact you again for recruitment purposes until you change your preferences or until you apply with us again.
When you give us your personal data in an open application (i.e. not applying for a specific job opportunity), we will retain your personal data for one year after having obtained them.
When we collect personal data about you from other sources, we will retain your personal data for one year after having obtained them, unless you object to this. If you object, we will remove your personal data within one month after you have objected. After you have objected, we will not contact you again for recruitment purposes until you change your preferences or until you apply with us.
At the end of the aforementioned one-year periods, we will contact you again to give you the opportunity to rectify or erase your data.
C. Retention period when processing personal data for marketing purposes
We only keep your data for the period required for our marketing purposes or until you ask us to delete your data.
7. What are your rights and how can you exercise them?
Under the applicable data protection legislation, we will use reasonable efforts to ensure that your personal data is accurate and up to date. Therefore, please advise us of any changes to your information.
You are entitled to request access to the details of personal data we hold about you and to have it rectified or erased as allowed by applicable data protection legislation. You may object to or restrict the processing of your personal data in accordance with the applicable data protection legislation. In case of direct marketing, you may opt out of our processing for direct marketing purposes at any time. If the processing of personal data is based on your explicit consent you may withdraw your consent at any time without affecting the lawfulness of processing such data prior to such withdrawal.
You have the right to access the personal data you have provided us, in a structured, commonly used and machine-readable format and you have the right to transmit this data to another controller without consent from us (data portability). This right is however subject to restrictions and conditions.
In relation to exercising your rights, you can send us your signed and dated request. Please be as accurate as possible when formulating requests:
- By ordinary mail to:
Romeinsesteenweg 564 box 4, 1853 Brussels
- By e-mail to email@example.com
Where we have doubt about your identity, we may ask you to adduce evidence of your identity. We will respond to your request as soon as possible and in any event within four weeks after receipt of your request.
In case of disagreement relating to the processing of your personal data, you have the right to contact the competent data protection authority. However, we encourage you to contact us first in order to try to seek a speedy solution regarding the disagreement.
The contact details of the Belgian Data Protection Authority:
Data Protection Authority
Rue de la Presse 35, B-1000 Brussels
Tel.: +32 2 274 48 00
9. Contact details
- to customers in the context of recruitment or temporary employment;
- to companies which perform business support functions as a processor for Tobania (for example: the provider of our applicant tracking system, our external payroll service provider);
- where relevant, to your employer;
- to regulatory and supervisory authorities;
- to legal and professional advisors;
- to other companies in the Tobania group.
- By ordinary mail to:
Romeinsesteenweg 564 box 4, 1853 Brussels
- By e-mail to firstname.lastname@example.org
- By ordinary mail to: