TMF Group Privacy Statement for processing of Candidate Employee Personal Data

TMF Group Privacy Statement for Processing of Candidate Employee Personal Data (the “Privacy Statement”) describes how TMF Group (“we”, “us”, and “our”) process candidate employee’ (“candidate”, “you”, “your”) personal data and confirms our commitment to protecting your privacy.

TMF Group uses global recruitment SaaS (cloud) IT-system from PageUp to perform online recruitment activities. TMF Group refers to TMF Group B.V., having its registered office in Amsterdam, the Netherlands, and its affiliates (“TMF Group entities”) directly or indirectly controlled by it. We understand how important your privacy is to you and are fully committed to protecting your personal data worldwide in accordance with all applicable data protection laws and regulations.

Please read this Privacy Statement carefully to understand your rights before submitting your personal data to us. 

By applying for a vacancy and submitting your job application, you acknowledge that you have read and understood the content of this Privacy Statement and the terms and conditions under which we will be processing your personal data.

1. Why we use your personal data

During the recruitment process, we collect and use your personal data only for the purposes indicated here:

• to manage and process your application including evaluating your skills and suitability for the role you may have applied for;
• for the administration of the contract we are entering with you;
• to conduct reference checks to validate your qualifications, experience, and suitability for a role; for certain roles, we may also conduct background checks (as permitted by applicable law);
• for making decisions about employment with us; 
• for complying with applicable laws and regulations, such as taxation rules, compliance with requests from governmental agencies or judicial services (including the provision of your data to
• governmental agencies for statistical purposes where required by law), other employment laws and regulations applicable to us;
• dealing with a legal dispute and to establish, exercise and defend (potential) legal claims because of your recruitment process;
• for the management of your data within IT systems and operational processes within the company (e.g. our recruitment and HR systems);
• when visiting our offices to register you as a visitor and temporary record your access to office areas in CCTV for security purposes;
• providing you with more suitable career opportunities at TMF Group;
• identifying for future positions that may become available.

2. What personal data we collect and from where

To participate in recruitment directly, i.e. without involvement of recruitment agencies or other external recruiters, you will need to create account profile in TMF Group recruitment and hiring system. When you do, we will ask for account information, such as your name, email address and telephone number. The data you give us directly includes all data provided in your CV or resume and other personal data that we collect for the purpose of recruitment. This other data can include: your address, nationality, gender, age or a birth date, prior work experience, skills, qualifications, certificates, academic degree, professional titles, and other information as required for a specific vacancy. 

Absence of the above mentioned personal data could significantly hinder our possibility to assess your fitness for a given role and as a consequence impact results of your recruitment process. Providing your age or birth date may be required in order for us to verify if we can lawfully hire you and we will ask for it only if permitted by law.

If you participate in a recruitment that is carried out with involvement of a recruitment agency or other external recruiters, we will obtain your personal data of those categories from them.

We also obtain personal data from other sources about your performance or conduct from references, persons who refer you, or former employers; background check data obtained from employment screening agencies (as permitted by applicable law), academic institutions and/or professional organizations, immigration / work permit status. 

If you visit our office, your name, email, and telephone number are required to register you as a visitor, your entry and exit from reception and other areas of our facilities are monitored and temporarily recording your access to these areas by closed circuit TV cameras (CCTV).

Special Types of Personal Data

Only for the reasons indicated here below, we may also collect and use special types of personal data, which include personal information relating to your sexual orientation, religious of philosophical convictions, political opinion, race, ethnicity, health status, or whether you are a trade union member, or have criminal convictions and history.

Where such personal data is required, we will only process this:

• where we have your explicit consent;
• where it is necessary for carrying out our obligations and exercising our rights in the field of employment, social security or social protection law;
• where it is necessary for the assessment of your working capacity;
• where required under a specific legal obligation; or
• where you have manifestly made this information available to us.

3. The legal bases for processing your personal data

We collect and use your personal data in accordance with the applicable (data protection) laws and regulations. This means that we will only use your personal data if this is adequate, relevant and limited to necessary purposes for which the data was collected (as set out in Chapter 1). TMF Group entities may only process your personal data because of one of the following legal bases:

• in order to take steps prior to entering into an employment contract;
• to comply with a legal obligation to which they are subject;
• where this is necessary for its legitimate (business) interests (or those of a third party) and candidate interests and fundamental personal rights are not overridden by those interests; TMF Group entities legitimate interests are their interests to secure, defend and develop TMF Group business and its people and to make strategic and corporate responsibility decisions that TMF Group entities deem necessary; where required, TMF Group will inform candidates about further legitimate interests where this becomes relevant;
• where a TMF Group entity has sought an explicit consent.

4. Retention of your personal data

We retain your personal data for as long as required to satisfy the purpose for which they were collected and used for the time necessary to complete the recruitment process unless:

• you have been hired, in which case your data may be retained pursuant to other legal ground i.e. employment contract; or
• if you have provided consent to TMF Group to retain your data for a longer period; provided consent shall satisfy the legal requirements for valid consent.

5. How we protect your personal data

We take organizational and technical measures to protect your personal data from unauthorized access, disclosure, use, modification, damage or loss. We will continue improving these measures to protect the security of your personal data. For example, we use AES-256 level encryption or higher, where encryption is applied to ensure data confidentiality; we deploy access control mechanisms to ensure only authorized personnel can access personal data; and we raise awareness among employees about the importance of protecting personal data through security and privacy protection trainings. Read more about this in our GDPR Statement.

6. How we disclose and transfer your personal data 

For the purposes listed under Chapter 1 above, we may share your personal data on a need to know basis with:

• colleagues within TMF Group and TMF Group entities, both in the country where you (are applying to) work and in other countries in which TMF Group operates, as required for the evaluation purposes, including to countries outside the European Economic Area, and/or
• third parties which assist TMF Group for candidate employee selection and evaluation purposes, background check or as indicated under Chapter 2 of the Privacy Statement.

This includes transfers to vendors and suppliers we use to process personal data on our behalf, such as support for payroll and IT, successors in title of our business in case of a corporate transaction and competent regulatory authorities, enforcement authorities and other governmental agencies.

These third parties and purposes for disclosure and transfer of your personal data to them are included in Annex 1 to the Privacy Statement.

We take all reasonably necessary steps to ensure that your personal data is shared and treated securely and in accordance with the Privacy Statement and applicable law. This means that we shall ensure that relevant safeguards as required by the applicable law are in place that allow for lawful transfer of your personal data. For instance:

• we transfer your personal data to TMF Group entities that are bound by the Controller Binding Corporate Rules of TMF Group, the excerpt from which is available here: Binding Corporate Rules;
• we have entered into legally necessary contracts with recipients of personal data, including based on the most recent version of the standard contractual clauses as approved by the European Commission or other supervisory authority where required; or 
• equivalent means with parties outside the European Economic Area that do not provide an adequate level of protection. 

You are entitled to receive a copy of any documentation showing the suitable safeguards that have been taken by making a request to the address as provided under Chapter 9 of the Privacy Statement.

PageUp is provided through and/or includes functionality operated by an independent third party and contains links to sites operated by third parties whose policies regarding the handling of information may differ from ours. These third parties are, however, required to protect your personal data in a substantially similar manner as PageUp.

7. How to exercise your rights 

You have the right to request access to or rectification or erasure of your personal data that you have provided to us or which we received from recruitment agencies or other external recruiters during the pre-employment, and to restrict or object processing of your personal data, as well as the right to data portability. If you would like to exercise any of those rights, you may contact our recruitment representative, or submit your enquiry centrally at the address indicated in Chapter 9 of the Privacy Statement.

Your request should specify which right you would like to exercise, including what personal data needs to be changed, whether the personal data needs to be erased from the database, or otherwise what limitations you would like to put on our use of your personal data.

In the event your personal data is processed based on your consent, you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent. We will ask you to renew your consent each subsequent year following your consent submission.

You can exercise your above-mentioned rights by logging in to your account profile in PageUp or submitting your enquiry centrally at the address indicated in Chapter 9 of the Privacy Statement. You can also exercise your rights via this form: the TMF Group Data Subject Request Form.

You may lodge a complaint with a supervisory authority in the country where you live, if you consider that the collection, use or processing of your personal data infringes this Privacy Statement or applicable law in the country where the processing takes place.

If you are a California resident or Brazilian citizen, please see our California Consumer Privacy Act (CCPA) Privacy Notice or Brazilian General Data Protection Law (LGPD) Privacy Notice in Chapter 10 and Chapter 11 of this Privacy Statement, respectively.

8. Updates of this privacy statement

We reserve the right to update or amend the Privacy Statement as required under the applicable laws, changes in organizational and technical measures, or other further insights. Revision history is included in section 12 of this Privacy Statement. 

To notify you of any updates to this Privacy Statement, we will publish the updated Privacy Statement in PageUp. Additionally, we may also choose to notify you with a separate notice per email you provided to us, if your data has been retained beyond the recruitment procedure.

9. How to contact us

If you have questions or concerns regarding our use of your personal data, or would like to exercise any of your rights stated herein, you can log in into your account profile in PageUp, contact the local recruitment representative, contact us via the contact form available here: the TMF Group Data Subject Request Form, or send a letter or email addressed to the following:

TMF Group B.V.
Attn. Chief Privacy Officer
Herikerbergweg 238
1100 DW Amsterdam, Netherlands
email: dataprotection@tmf-group.com

10. California residents' rights under California consumer privacy act (CCPA) notice 

What personal data we process

The categories of personal data we collect, and our use of personal data, may vary depending on the position(s) or location, as well as the associated qualifications and responsibilities. Generally, we may collect the following categories of personal data about you, where appropriate and to the extent permitted under applicable law:

• Name, contact information, and other identifiers;
• Protected classifications;
• Usage data (for example, internet or other electronic network activity information like browsing history, search history,  and information regarding your interaction with an internet website, application, or advertisement);
• Audio, video, and other electronic data;
• Employment history;
• Education information; and
• Profiles and inferences (for example, inferences drawn from any of the information identified throughout this CCPA Notice or the larger Privacy Statement to create a profile about you).

More detailed information about the specific types of data collected under each of the above-listed categories can be found throughout the Privacy Statement. 

Why we process your personal data

Likewise, detailed descriptions of the purposes for which we collect personal data and how we use and disclose it can also be found throughout the Privacy Statement, but for ease of reference, we reiterate the purposes and use in this section as well:

Recruiting, Hiring, Managing, and Evaluating Applicants. To review, assess, recruit, consider, or otherwise manage California candidates and job applications, including:

• Scheduling and conducting interviews;
• Identifying candidates, including by working with external recruiters;
• Reviewing, assessing, and verifying information provided, to conduct criminal and background checks (where relevant and pursuant to applicable law), and to otherwise screen or evaluate your qualifications, suitability, and relevant characteristics;
• Extending offers, negotiating the terms of offers, and assessing salary and compensation matters;
• Satisfying legal and regulatory obligations;
• Communicating with you regarding your application and about other similar position(s) for which you may be interested;
• Maintaining your personal data for future consideration; and
• Supporting our equal employment opportunity policy and practices.

Security and Monitoring. To monitor and secure our resources, network, premises, and assets, including:

• Monitoring for, preventing, investigating, and responding to security and privacy incidents;
• Providing and managing access to physical and technical access controls;
• Monitoring activities, access, and use to ensure the security and functioning of our systems and assets; and
• Securing our offices, premises, and physical assets, including through the use of electronic access systems and video monitoring.

Defending and Protecting Rights. To protect and defend our rights and interests and those of third parties, including to manage and respond to legal claims or disputes, and to otherwise establish, defend, or protect our rights or interests, or the rights, interests, health, or safety of others, including in the context of anticipated or actual litigation with third parties.

Compliance with Applicable Legal Obligations. For purposes relating to compliance with applicable legal obligations (such as hiring eligibility, responding to subpoenas and court orders) as well as assessments, reviews, and reporting relating to such legal obligations, including under employment and labour laws and regulations, social security and tax laws, environmental regulations, workplace safety laws and regulations, and other applicable laws, regulations, opinions, and guidance.

How to contact us in the USA

If you have any questions or concerns regarding our use of personal data as described in this CCPA Notice, please contact us - contact details indicated in Chapter 9 of the Privacy Statement.

11. Brazilian Citizens' rights under Brazilian general data protection law (LGPD) notice

This LGPD Privacy Notice applies to candidate’s citizens of Brazil (“Brazilian candidates”) and supplements the Privacy Statement.

The LGPD offers similar level of personal data protection as GDPR, bringing equal treatment to the Brazilian citizen in terms of protecting their personal data.

The following paragraphs describe the necessity of candidates’ historical research subject to LGPD and is informing you, the candidate, about the purpose of such data processing.

Legal basis for processing

The legal basis for processing of your personal data in the context of background checks is consent. TMF Group will take into account all aspects and carry out any activities under strict confidentiality and always with respect for your rights and freedoms. 

Why we process your personal data

TMF Brazil processes your personal data listed in Chapter 2 of the Privacy Statement for recruitment purpose, for future (potential) employment and can be used for the work-related activities that will be performed by candidates. Your personal data is also used to carry out background checks to establish whether you qualify as a candidate for the vacancy. The candidates’ background check is in accordance with the best recruitment practices and is necessary for the adequate fulfilment of candidate evaluation performed by TMF Brazil. Candidates’ background check require prior communication, and this notice also serves to document the fulfilment of this requirement before acquiring your consent for further processing of your personal data for this purpose. 

Your rights under LGPD

You have the right to:

• obtain confirmation of the existence of processing activities on your personal information;
• access to your personal information;
• have incomplete, inaccurate or outdated personal information rectified;
• obtain the anonymization, blocking or elimination of your unnecessary or excessive personal information, or of information that is not being processed in compliance with the LGPD;
• obtain information on the possibility to provide or deny your consent and the consequences thereof;
• obtain information about the third parties with whom we share your personal information;
• obtain, upon your express request, the portability of your personal information (except for anonymized information) to another service or product provider, provided that our commercial and industrial secrets are safeguarded;
• obtain the deletion of your personal information being processed if the processing was based upon your consent, unless one or more exceptions provided for in art. 16 of the LGPD apply;
• revoke your consent at any time;
• lodge a complaint related to your personal information with the ANPD (the National Data Protection Authority) or with consumer protection bodies;
• oppose a processing activity in cases where the processing is not carried out in compliance with the provisions of the law;
• request clear and adequate information regarding the criteria and procedures used for an automated decision; and
• request the review of decisions made solely on the basis of the automated processing of your personal information, which affect your interests. These include decisions to define your personal, professional, consumer and credit profile, or aspects of your personality.

How and when we will respond to your request

We will strive to promptly respond to your requests but in any case, within 15 days from the time of your request, unless you have requested otherwise.

In the event that you file a rectification, deletion, anonymization or personal information blocking request, we will make sure to promptly communicate your request to other parties with whom we have shared your personal information in order to enable such third parties to also comply with your request – except in cases where such communication is proven impossible or involves disproportionate effort on our side.

Transfer of personal data outside of Brazil permitted by law

We are allowed to transfer your personal information outside of the Brazilian territory in the following cases: 

• when the transfer is necessary for international legal cooperation between public intelligence, investigation and prosecution bodies, according to the legal means provided by the international law;
• when the transfer is necessary to protect your life or physical security or those of a third party;
• when the transfer is authorized by the ANPD (the National Data Protection Authority);
• when the transfer results from a commitment undertaken in an international cooperation agreement;
• when the transfer is necessary for the execution of a public policy or legal attribution of public service;
• when the transfer is necessary for compliance with a legal or regulatory obligation, the carrying out of a contract or preliminary procedures related to a contract, or the regular exercise of rights in judicial, administrative or arbitration procedures.

How to contact us in Brazil

You can file your express request to exercise your rights free from any charge, at any time, by using the contact details provided below of in Chapter 9 in the Privacy Statement, or via your legal representative. For Brazilian candidates, we advise you to directly contact TMF Brazil’s Local HR Department or send e-mail for the Local Data Protection Officer at Dpo.brazil@tmf-group.com.

12. Revision History

Annex 1   List of third parties processing candidate personal data processed on behalf of TMF Group*

Please note that TMF Group entities in your country may have engaged other third parties to fulfil the processing purposes indicated in Chapter 1. Please submit a request at your local recruitment representative to receive the information about these local third parties or else submit your request to the contact person indicated in Chapter 9 of the Privacy Statement.

Download

Employee Candidate Privacy Statement August 2022