recruitment privacy policy (https://www.iubenda.com/privacy-policy/96274994)
---
team.blue HR Screening Policy
THIS HR SCREENING POLICY (hereinafter the “Policy”) has been developed by team.blue NV on behalf of itself and its group companies (hereinafter collectively, or as applicable, individually, the “Company” or “team.blue”), to provide guidance to the relevant stakeholders on the processing of candidate personal data in connection with pre-employment screening and verification activities (hereinafter the “Screening Activities”).
1 SCOPE
This Policy applies to the Company and its directors, officers and employees, so as any other person acting for or on behalf of the Company, to the extent they are involved in pre-employment activities.
Please refer to Annex 2 of this Policy for information on national regulatory requirements that may have an impact on the Screening Activities.
2 PURPOSE
The purpose of this Policy is to guide the Authorized Persons in conducting Screening Activities in a lawful, fair, and transparent manner, with due regard for candidates' privacy, rights, and freedoms.
This Policy outlines the specific activities, legal basis, and processes for conducting various Screening Activities necessary for employment-related decisions and supports compliance with European Legislation and National Legislation.
3 REFERENCES, DEFINITION AND APPLICABLE LEGISLATION
Authority: means the local competent Data Protection Authority.
Authorized Person(s): refers to collaborators authorized to process Personal Data under the direct authority of the Company, in its role of Controller, under Arts. 4 (10) and 29 GDPR. Under the definition given by the Article 29 Working Party in its Opinion 2/2017, this includes: employees and former employees, managers, auditors, collaborators and VAT-registered workers, on-call, part-time workers, job-sharing, fixed-term contracts, internships, without distinction of role, function and/or level, as well as consultants and suppliers and, more generally, all those who use or have used corporate tools or personal tools to operate on the Company network or are aware of relevant corporate information such as, by way of example but not limited to: (a) the Personal Data of customers, employees, applicants and suppliers, including e-mail addresses; (b) all information relating to confidential information of a commercial, financial or business strategy nature; as well as (c) data and information relating to business processes, including the creation of trademarks, patents and industrial property rights, the protection of which is independent of the prejudicial effects that could result from its disclosure.
Data Controller or Controller: means the natural or legal person, public authority, agency or organization which, individually or jointly with others, determines the purposes and means of data processing activities; where the purposes and means of such processing are determined by European Union or
Member State law, the Controller or the specific criteria applicable to its designation may be established by Union or Member State law.
Data Processor or Processor: means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
Data Subject: means refers to an identified or identifiable natural person. By way of example but not limited to, partnerships, sole proprietorships, professionals and agents of joint stock companies may be considered as Data Subjects.
DPO or Data Protection Officer: a natural or legal person represented by a natural person, whose appointment by the Data Controller or Data Processor is mandatory under art. 37.1 of the GDPR, and who must have specialist knowledge of the European and National Legislation, security best practices and the Processing Activities conducted by the Data Controller or Data Processor, in order to assist them in matters concerning privacy compliance.
European Legislation: means the applicable European Union law.
GDPR: means the General Data Protection Regulation (EU) n. 679/2016.
Joint Controllers: two or more controllers who jointly determine the purposes and means of processing, are considered as joint controllers.
Judicial Data: Personal Data relating to criminal convictions and offences or related to security measures.
National Legislation: means, within the European Union/European Economic Area, the Member State applicable legislation; outside of the European Union/European Economic Area, means the applicable national legislation.
Personal Data: means any information concerning an identified or identifiable Data Subject. A Data Subject considered identifiable is one who can be identified, directly or indirectly, by an identifier such as a name, an identification number, location data, an online identifier or by one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.
Privacy Policy for Candidates: means the information notice for candidates written according to the Arts. 13 and 14 GDPR by the relevant Company of team.blue group.
Processing Activities: means a wide range of operations performed on Personal Data, including by manual or automated means. It includes the collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of Personal Data.
Special Categories of Personal Data: means Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or membership of a trade union, as well as Genetic Data, Biometric Data for the univocal identification of a Data subject, and Data concerning their health, sexual activity or sexual orientation.
This Policy is written in accordance with the GDPR, whereas specific requirements may be set by the National Legislation or Authority. Please refer to Annex 2 of this Policy for detailed information on the exact provisions that should be considered under the National Legislation.
Unless otherwise specified, all capitalized terms shall have the meaning given in this section “References, Definition and Applicable Legislation”.
4 DATA PROTECTION ROLES
The Company acts as the Data Controller, responsible for determining the purposes and means of processing candidate personal data.
Where the Company outsources the Screening Activities (see section “Screening Activities”) to third party service provider(s) (Authorized Agent, please refer to Annex 1 of this Policy for more information), the Authorized Agent typically acts as a Data Processor and processes data strictly on the Company’s instructions in compliance with a Data Processing Agreement (DPA), pursuant to Article 28 GDPR, and applicable legislations.
5 SCREENING ACTIVITIES
The Human Resource (HR) Department, which is responsible for recruitment activities, is tasked by team.blue group with the management of Screening Activities. All references to the “Screening Function” in this document refer to the Authorized Persons and/or third parties, including any Authorized Agents, required or contracted by the Company to carry out the requisite Screening Activities on behalf of the latter.
The Screening Function may request the support of the managing role of the HR Department, the privacy office (or the Data Protection Officer) at any time in case of doubts about the Processing of Personal Data.
5.1. DETERMINATION OF SCREENING ACTIVITIES
The Screening Function may undertake any or all of the defined activities in respect of candidates as deemed appropriate. The Screening Function is required to assess and determine the necessary activities on a case-by-case basis, and must ensure that it is proportionate, role-specific, and compliant with European Legislation and/or National Legislation.
1. Verification of Identity Document: team.blue may be required to verify a candidate’s identity in accordance with applicable national laws. For this purpose, the personal data provided by the candidate may be verified against a valid identity document, which the candidate will be requested to submit to the Authorized Agent.
Legal Basis: Performance of a contract to which the data subject is party or taking steps at the data subject's request prior to entering into a contract
2. Education: team.blue may need to verify a candidate’s educational background to confirm credentials relevant to the job role and to ensure compliance with job-specific competency requirements. For this purpose, the educational details provided by the candidate may be verified with the relevant institutions in each applicable jurisdiction.
Legal Basis: This processing is carried out on the basis of the Company’s legitimate interests (Article 6(1)(f) GDPR), specifically the interest in ensuring that candidates meet the required qualifications for the role and in maintaining the integrity of the recruitment process.
3. Work Experience: team.blue may need to verify a candidate’s previous work experience to confirm the accuracy of the employment history provided and to assess suitability for the role. For this purpose, the candidate’s employment details may be verified with the references identified by the candidate.
Legal Basis: This processing is carried out on the basis of the Company’s legitimate interests (Article 6(1)(f) GDPR), namely the interest in ensuring the accuracy of a candidate’s employment history, assessing their suitability for the role and the Company, and in maintaining the integrity of the recruitment and selection process.
4. Work Permit Check (Right to Work): team.blue may be required to confirm that a candidate has the legal right to work in the country where the role is based, in accordance with applicable immigration and employment laws. For this purpose, the personal data provided by the candidate may be verified against relevant official documentation.
Legal Basis: This processing is carried out to comply with the Company’s legal obligations under applicable employment and immigration laws to confirm that a candidate has a valid right to work. The lawful basis for this activity is therefore Article 6(1)(c) GDPR (compliance with a legal obligation). Where required, documentation of the specific jurisdictional requirements will be maintained to demonstrate compliance.
5. Criminal Background Check: team.blue may need to verify a candidate’s criminal background where permitted by applicable laws and necessary for the position applied for. For this purpose, relevant
personal data may be checked with the appropriate authorities in the relevant jurisdictions to ensure suitability and maintain a safe working environment.
Legal Basis: This processing is carried out on the basis of the Company’s legitimate interests (Article 6(1)(f) GDPR), specifically the interest in protecting its systems, data, and customers by verifying the integrity and trustworthiness of candidates for security-sensitive roles. Where this legal basis is confirmed, a Legitimate Interests Assessment (LIA) will be documented in compliance with GDPR and applicable national laws governing criminal record checks.
Where relevant, a Legitimate Interest Assessment (LIA), pursuant to Article 6(1)(f) GDPR and/or Data Protection Impact Assessment (DPIA), pursuant to Article 35 GDPR, have been conducted and documented, aimed at identifying the risks and balancing the rights and freedoms of the data subjects with the legitimate interests of the Company, which have yielded a positive outcome for the Company.
5.2. PROCESS FOR SCREENING ACTIVITIES
Once the Screening Function has determined the appropriate activities for a candidate, it will carry out the Screening Activities or, as applicable, it will task the Authorized Agent with carrying out the Screening Activities, together with the necessary candidate personal data and adequate instructions. The Screening Function is responsible for ensuring that instructions provided to the Authorized Agent are in compliance with this Policy, European Legislation and/or National Legislation.
The Screening Function, or as applicable, the Authorized Agent will contact the candidate to initiate the screening and verification activities upon receiving instructions from the Screening Function. To facilitate this process, the Company may share certain common personal data collected during the recruitment process with the Authorized Agent to initiate the relevant activities.
The Screening Function, or as applicable, the Authorized Agent shall collect the requisite documentation and additional personal data necessary to perform the requested activities directly from the candidate. The Authorized Agent may also require the candidate to sign a Screening Declaration Form in order to proceed with the checks.
Upon completion of the screening process, the Authorized Agent shall upload the relevant documentation (“Screening Outcome”) to the designated platform. Based on Screening Outcome, the Screening Function may notify the appropriate stakeholders within the HR Department involved in the recruitment process for the next steps to be taken as per the established procedure.
5.3. INTERNAL DISCLOSURE OF CANDIDATE SCREENING OUTCOME
The Screening Function may share the Screening Outcome of any candidate, to the extent necessary, with other departments or Companies of the team.blue group.
5.4. DATA TRANSFERS BY AUTHORIZED AGENT
The Authorized Agent may be authorized to transfer the candidate's personal data to third parties based in countries outside the EEA/EU for the purposes of conducting the requisitioned Screening Activities, particularly, where necessary for the candidate to enter into employment contracts with the Company, pursuant to Article 49(1)(b) GDPR.
Please refer to Annex 2 of this Policy for detailed information on the exact provisions that should be considered under the National Legislation.
5.5. REQUESTS BY CANDIDATES UNDERGOING SCREENING ACTIVITIES
Candidates who are subject to Screening Activities at the instruction of the Company may exercise any of the entitled rights under European Legislation and/or National Legislation, including GDPR rights such as right of access, erasure, and correction.
Where a candidate exercises their GDPR right of erasure and has shared their information (including any documentation) directly to the Company or through the Authorized Agent, the Company shall delete the relevant records from its corporate applications, to the extent permitted by Article 17 GDPR. Please refer to the Company Procedure on Data Subject Requests Management for more information.
5.6. RETENTION OF PERSONAL DATA
The Company will retain personal data only for as long as necessary to fulfill the purposes outlined in the "Screening Activities" section and to comply with legal obligations. The relevant retention periods will be as defined in the Privacy Policy of Candidates of the Company.
If the candidate is subsequently hired, that is where the Screening Outcome returned a positive outcome, the processing of their Personal Data will be regulated by the relevant information notice for employees or such other notices provided by the Company based on the role of the employee.
5.7. SECURITY OF DATA
The Company has implemented, where applicable also via the Authorized Agents, appropriate technical and organizational measures to ensure the security and integrity of personal data.
6 NON-COMPLIANCE NOTIFICATIONS AND DISCIPLINARY MEASURES
All legal and natural persons identified in this Policy are expected to fully comply with the Policy and other data protection documentation notified from time to time.
The Legal Department, in collaboration with the Privacy Office (and with the Group Data Protection Officer), shall evaluate any exemptions from adherence to particular provisions of this document and other data protection documentation released from time to time. Exemptions are to be considered if special circumstances do not allow for the practical implementation of a requirement, if a National Legislation supports a requested exemption, and/or if there are compensating controls in place to mitigate the risk of non-compliance.
7 REVIEW AND UPDATES
The maintenance and periodic review of this Policy shall be carried out by the team.blue group, in particular by the Privacy Office and the HR Department, with the support of the Group Data Protection Officer (DPO), as applicable.
8 ANNEX 1: LIST OF AUTHORIZED AGENTS
team.blue has engaged the following third-party service providers as Authorized Agents to conduct Screening Activities on its behalf.
The Authorized Agents will be subject to this Screening Policy in addition to the relevant service agreements entered into with the Company.
NAME OF AUTHORIZED AGENT
Validata Group BV, trading as DISA Global Solutions (“Validata”)
RELEVANT INFORMATION
DISA Global Solutions
Apollolaan 151, 1077 AR Amsterdam.
Privacy Notice of Validata can be accessed at the following address: https://disa.com/emea/privacy-website/.
9 ANNEX 2-A: NATIONAL REQUIREMENTS AND RECOMMENDATIONS
Criminal record checks may only be carried out in jurisdictions where such processing is expressly permitted under applicable national law and where the Company has established a lawful basis in accordance with Article 6(1)(f) GDPR and Article 10 GDPR.
At present, criminal record checks may be conducted for relevant roles in the following jurisdictions:
· Denmark
· The Netherlands
· United Kingdom
· Ireland
· Germany
· Türkiye
The Company has received clear legal recommendations not to perform criminal record checks in the following jurisdictions at this time:
· Spain
· Portugal
· France
These recommendations are binding for operational purposes and must be followed until this policy is formally updated to permit such checks based on verified legal authority.
