Version 1.2 – 01/12/2020
The protection of your privacy is important to Tobania. We undertake to protect and process your personal data in strict compliance with the law, and to make sure you have the latest information.
The purpose of this privacy statement is to fully inform you and to explain how we collect, use and store your personal data. The contractual provisions we agreed with you remain unchanged. We invite you to take the time to read this privacy statement to become aware of how we handle this subject. You may object to the processing of your data, as explained in Chapter 6 of this notice.
1. What is this privacy statement about?
A. What does "processing your data" mean, and who is the controller?
"Processing" means any operation or set of operations which is performed upon personal data such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by means of transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction of personal data.
Tobania NV, with its registered office at 1853 Strombeek-Bever, Romeinsesteenweg 564 box 4, is responsible for processing the personal data it deems necessary to process.
We are therefore the party whom you, as well as the supervisory authorities (for example the Data Protection Authority), should contact for any questions you may have relating to the way Tobania uses your data.
The “controller” in the sense of the applicable data protection legislation means the natural or legal person, public authority, agency or other body which, alone or jointly with others, that determines the purposes and means of the processing of personal data as described above. Tobania will be the controller with regard to the processing of your personal data.
B. To whom is this privacy statement addressed?
Those affected by this privacy statement are:
- Customers, sub-contractors, candidates, prospects, website visitors etc. of Tobania who are identified or identifiable natural persons;
- All other identified or identifiable natural persons who are involved in any transaction with Tobania as representatives of our customers, sub-contractors, prospects, candidates etc. whether private individuals or legal entities (for example company directors, agents, legal representatives or other contact persons).
C. Which data are covered by this privacy statement?
The data covered by this privacy statement are personal data, i.e. any information in relation to an identified or identifiable natural person. We may collect personal data from you directly, or from other sources.
We may collect various personal data about you from you when you interact with Tobania:
- identification data: your name, address, date and place of birth, picture, account number, phone number, e-mail address, IP address, household composition, educational history, employment history, references, your qualifications skills…;
- data relating to your behaviour and habits when using our affiliates’ or our own internet websites.
We may also collect personal data about you from other sources (e.g. information about your professional qualifications as posted on LinkedIn or on other resources). If we do so, we will inform you within a reasonable time of the categories of personal data involved and the source thereof, as well as the other information contained in this privacy statement.
2. For which purposes are your personal data processed?
Your personal data may be processed for any of the following purposes:
- To improve our websites and our services;
- To fulfil legal and contractual obligations (customers, supplier, …)
- To market our services (including sending you promotional messages about our products and services);
- To maintain our business relationship, where you are a user of our website, a client or a candidate;
- For recruitment purposes;
- To retain candidate details and notify about future job opportunities;
- To comply with legal, regulatory and judicial requirements and reasonable requests; and
- To defend ourselves in the event of a legal claim.
3. What is our legal basis for processing your personal data?
A. General information about legal basis
We process your personal data for different purposes. For each processing, only the data that are relevant to the intended purpose will be processed.
Generally, we will use your personal data either:
- as part of performing a contract or taking pre-contractual steps;
- to comply with all the legal and regulatory provisions that govern us;
- for reasons relating to the legitimate interests of Tobania, i.e. the freedom to do business, information security, fraud detection and prevention as well as direct marketing. When we carry out this type of processing, we always seek to maintain the balance between this legitimate interest and the protection of your privacy. We do not use personal data where our interest is overridden by the impact on you (unless you consent to this or are otherwise required for legal and regulatory compliance); or
- whenever we have obtained your (explicit) consent.
B. Legal basis when processing personal data for recruitment purposes
You may provide us with personal data about you when participating in a recruitment process (e.g. when applying on our jobsite). In this case, we process your personal data as part of taking pre-contractual steps.
If you apply with us and we do not immediately have a job opportunity for you, we intend to retain your personal data for other job opportunities that you may be interested in. If we contact you for other job opportunities, you may give us additional relevant information about yourself (e.g. your preferences about the type of work you are interested in or your most recent work experience or qualifications). We will retain this additional input in order to keep the information that we have about you accurate and up to date, so that we can present you with job opportunities that match as closely as possible with your skills and preferences at any time. For the same reason, we may also retain information that you provide publicly (e.g. through updates of your LinkedIn profile). We will never store any sensitive information about you. In this case, processing your personal data is necessary for our legitimate interest as an IT consultancy company whose core business consists of assessing and matching each candidate with the most interesting job opportunities. You have the right to object to the fact that we process your personal data in this way, by sending an e-mail to email@example.com.
We may also collect personal data about you from other sources (e.g. information about your professional qualifications as posted on LinkedIn or on other resources). In this case as well, processing your personal data is necessary for our legitimate interest as an IT consultancy company and you have the right to object to the processing by sending an e-mail to firstname.lastname@example.org.
C. Legal basis when processing personal data for marketing purposes
We may use your personal data to send you direct marketing materials, including invitations to events that we organise. In this case, processing your personal data is necessary for our legitimate interest as a commercial company, since we need to promote ourselves both as a provider of products and services and as an employer. You have a right to opt out of such direct marketing or to adjust your preferences.
4. How do we protect your data?
We have set up an adequate standard of security when it comes to safeguarding and protecting personal data in accordance with our legal obligations. By doing so, we want to prevent any unauthorized person from gaining access to, processing, altering or deleting personal data.
We would like to draw your attention to the fact that no security measures can guarantee 100% security.
You also have an important role to play in safeguarding your personal data. E.g. you should choose sufficiently strong passwords and never share your account credentials (log-in and passwords).
5. Who has access to your data and to whom are they transferred?
A. General information about access to and transfer of your data
The people who are authorized to access your data are specifically defined depending on their role.
We may transfer your personal data to any of the following third parties if necessary for the purpose:
We enter into data processing agreements with companies that process your data on our behalf in order to ensure the same level of security and confidentiality of your data. We remain responsible for these processing operations. If these processors are based the in USA, we will check if they are a member of the EU/US privacy shield and if they have the required level of security and confidentiality measures or, alternatively, implement another data transfer mechanism, such as standard contractual clauses or binding corporate rules.
B. Access to and transfer of your data when we process these data for recruitment purposes
If we are considering you for a job that does not involve working directly for our customers, we will only disclose your personal data to dedicated members of our HR team and to managers or team members of our relevant departments.
If we are considering you for a job that does involve working directly for our customers, we may in addition also disclose your personal data to such customer but (i) we will only disclose personal data that are relevant for the customer’s assessment of your application and (ii) we will do so only with your consent.
C. Access to your data when we process these data for marketing purposes
When we process your personal data for marketing purposes, we will only disclose these data to dedicated members of our marketing team and, if applicable, to external parties that provide services related to marketing. In the latter case, we will enter into data processing agreements with such service providers.
6. How long do we retain your personal data?
A. General information about retention periods
We will not keep your personal data for longer than necessary for the processing purposes for which your data were collected. We will appropriately and securely dispose of your personal data when we no longer need them. We take into account the sensitivity of your personal data, the purpose and the legal requirements in order to use the appropriate retention period.
We keep basic information about our customers and suppliers for up to 10 years for liability, legal, tax and compliance purposes after the end of the contract. In specific cases, we may be required to retain these data for a longer period of time, for example in the event of a legal dispute.
For more information about our data retention policy, please contact email@example.com.
B. Retention period when processing personal data for recruitment purposes
If you start working for us, we will retain your personal data for as long as you have a contract with us and for a reasonable time afterwards as needed to comply with any legal obligations.
If we process personal data about you for recruitment purposes while you do not work for us, we try to keep the information that we have about you accurate and up to date, so that we can present you with job opportunities that match as closely as possible with your skills and preferences at any time. We will not retain personal data about you that has become irrelevant and/or outdated. If we have not updated our information about you for three years, we will contact you to ask whether we can still retain your information. You have the right at any time to object to the fact that we process your personal data in this way, by sending an e-mail to firstname.lastname@example.org. In this case, we will remove your data as soon as possible and in any event within one month. After you have objected, we will not process your data nor contact you again for recruitment purposes until you change your preferences or until you apply with us again.
Do note that if you apply for a job with us and we do not hire you, we may need to retain certain details about your application for a reasonable time afterwards to deal with any potential issues related to your application.
C. Retention period when processing personal data for marketing purposes
We only keep your data for the period required for our marketing purposes or until you ask us to delete your data.
7. What are your rights and how can you exercise them?
Under the applicable data protection legislation, we will use reasonable efforts to ensure that your personal data is accurate and up to date. Therefore, please advise us of any changes to your information.
You are entitled to request access to the details of personal data we hold about you and to have it rectified or erased as allowed by applicable data protection legislation. You may object to or restrict the processing of your personal data in accordance with the applicable data protection legislation. In case of direct marketing, you may opt out of our processing for direct marketing purposes at any time. If the processing of personal data is based on your explicit consent you may withdraw your consent at any time without affecting the lawfulness of processing such data prior to such withdrawal.
You have the right to access the personal data you have provided us, in a structured, commonly used and machine-readable format and you have the right to transmit this data to another controller without consent from us (data portability). This right is however subject to restrictions and conditions.
In relation to exercising your rights, you can send us your signed and dated request. Please be as accurate as possible when formulating requests:
- By ordinary mail to:
Romeinsesteenweg 564 box 4, 1853 Brussels
- By e-mail to email@example.com
Where we have doubt about your identity, we may ask you to adduce evidence of your identity. We will respond to your request as soon as possible and in any event within four weeks after receipt of your request.
In case of disagreement relating to the processing of your personal data, you have the right to contact the competent data protection authority. However, we encourage you to contact us first in order to try to seek a speedy solution regarding the disagreement.
The contact details of the Belgian Data Protection Authority:
Data Protection Authority
Rue de la Presse 35, B-1000 Brussels
Tel.: +32 2 274 48 00
9. Contact details
- to customers in the context of recruitment or temporary employment;
- to companies which perform business support functions as a processor for Tobania (for example: the provider of our applicant tracking system, our external payroll service provider);
- where relevant, to your employer;
- to regulatory and supervisory authorities;
- to legal and professional advisors;
- to other companies in the Tobania group.
- By ordinary mail to:
Romeinsesteenweg 564 box 4, 1853 Brussels
- By e-mail to firstname.lastname@example.org
- By ordinary mail to: