CANDIDATES’ PERSONAL DATA PROTECTION POLICY

1. Introduction

   Generix group SAS and its subsidiaries (hereinafter “GENERIX” or “we”) are committed to protecting your personal data as data controller.
   The purpose of this “candidate” personal data protection policy is to inform you in a transparent manner about GENERIX’s management of your personal data or personal information (hereinafter referred to as “personal data” or “PDI”).We ensure that the information you provide to us or that we collect through various channels (including our website, affiliated partner recruitment platforms, recruitment agencies, websites where your CV or profile is available, our correspondence, conversations or interviews with our staff) is only used for the purposes stated in this policy.
   This policy is in line with regulations, in particular :

   • European, on the protection of FADs and more specifically Regulation 2016/679 of the European Parliament and of the Council of April 27, 2016;
   • québécoise, relative à la Loi sur la protection des renseignements personnels dans le secteur privé, modifiée par la Loi modernisant des dispositions législatives en matière de protection des renseignements personnels, dite Loi 25 ;
   • And any other regulations that may apply, such as, for example, Portuguese national law no. 58/2019, of August 8, 2019 on the protection of personal data (hereinafter together the “Applicable Regulations”).

2. Who is concerned by this “candidate” DCP protection policy?

   This policy is aimed at people who apply for one or more job vacancies offered by GENERIX, either directly on our website, or at trade fairs, forums, by post, by e-mail, or indirectly through recruitment agencies, employees (in the context of cooptation), job sites or social networks (such as LinkedIn, Welcome to the jungle, etc.) or any other useful means of finding candidates.
   In the event that we need to take a reference, this will be done within the regulatory framework in force (prior consent of the candidate). Consequently, this policy also applies to candidates’ referees, whose personal data may be collected during the verification process.
   Unless otherwise stated, we refer to the above groups of people collectively as “you”.

3. What are GENERIX’s principles and commitments regarding the protection of personal data?

   GENERIX undertakes to respect the following basic principles:

   • Only collect, use or otherwise process your personal data for the purposes set out in this Privacy Policy or for specific purposes that are shared with you and/or to which you have given your separate consent.
   • Respect for the principle of minimization, i.e. we only collect and store the DCP we need.
   • When your personal data is collected, appropriate measures are taken to keep it as accurate and up-to-date as possible.
   • As a general rule, your personal data will be kept only for as long as is necessary for the purposes of processing or as required by law.
   • Your PHI will not be shared, sold, rented or disclosed other than as described in this Privacy Policy.

4. What security and confidentiality measures has GENERIX put in place?

   We take all appropriate security measures to ensure the security of your personal data, in particular with a view to protecting it against any disclosure, loss, accidental destruction, alteration, unavailability or unauthorized access. For example, we implement the measures recommended by the most stringent security standards. We ensure that access to your personal data is restricted to those GENERIX employees who need it to perform their duties. Please note, however, that when you transmit information to us over the Internet, security can never be 100% guaranteed.
   Safety is essential to our business. When we use subcontractors or service providers, we choose them on the basis of the quality and safety criteria they are able to offer.
   To this end, we impose safety rules on our subcontractors and service providers that meet our own high standards.

5. How is your personal data collected?

   1. Automatically, using cookies
      When you visit our website, GENERIX collects data automatically using cookies. In this respect, please refer to our “privacy policy for the site” directly accessible on the GENERIX website.
   2. Directly from you and generated by GENERIX
      When you apply for a job with GENERIX or a GENERIX entity, from the creation of your candidate profile and the recruitment process to your eventual hiring, we collect personal data about you.
   3. Through a third party
      Personal data may also be transmitted to us by third parties such as recruitment agencies, employees of the GENERIX GROUP group (in the context of cooptation), job boards, or professional social networks (LinkedIn, etc.). In the latter two cases, it is specified that we are not responsible for the processing of your personal data by these third parties (with whom you have an independent relationship), GENERIX GROUP being the recipient in this context.

6. What personal data is processed?

   1. As part of the application review process :
      We may process various types of personal data, including :
      • Identification data (e.g. surname, first name, contact details, etc.);
      • Personal curriculum data (e.g. personal information contained in your Curriculum Vitae (CV));
      • Data relating to your professional life, in particular the information given in your CV (e.g. training, diplomas, career path, skills and qualifications, etc.);
      • Declarative data (e.g. information given in questions prior to sending your application, recruitment interviews by you or third-party sources if relevant to the processing of your application);
      • Information from your responses to the various tools used in the recruitment process (e.g. personality tests);
      • Data from innovative solutions (e.g. video interviews for candidate pre-selection);
      • Data relating to your profile when using your personal space (e.g. your user name and password);
      • Data from video-surveillance devices and electronic communication recording devices in accordance with the applicable rules (e.g. security surveillance cameras on our premises in the event of a physical interview);

      GENERIX may also, in certain situations, request and process additional information if this is necessary to assess compatibility with the specific function. For example, if a position requires you to drive, you may be asked whether or not you have a driving license. Please note that local legislation may require GENERIX to request additional information about you. We indicate in the job description when such data is necessary to evaluate your application or to comply with legal requirements.

      GENERIX also informs you that, depending on your country of residence and applicable law, sensitive data may include data revealing racial or ethnic origin, data concerning health, data relating to criminal or penal convictions and offenses, and government-issued identification numbers (passport number, identification number, social security number, etc.). In principle, GENERIX does not process sensitive data about you, unless the nature of the job requires the processing of such information and only when authorized by applicable regulations. For example, it may be relevant to share information about a disability in order to adapt the workstation. GENERIX may also process your sensitive personal data if required to do so by local law. If this is the case, we will inform you in advance.
      Depending on the location of the position for which you are applying, we may be required to collect such data by virtue of a legal, regulatory or contractual obligation incumbent upon us, and more particularly by virtue of an agreement or undertaking given to regulators or entered into in the context of litigation of any kind.

   2. As part of the hiring process, if your application is accepted :
      Should your application be selected for a contract, we will ask you for the information and supporting documents required to complete the compulsory formalities. The provision of this information is a precondition for the conclusion of an employment contract for successful candidates. In addition, the provision of certain categories of information and supporting documents (address, social security registration number or social insurance number, residency status or right to work in the country in question, etc.) is mandatory for successful applicants. Consequently, failure to provide this information will make it impossible to conclude an employment contract.
      This data can be :
      • Data required to draw up your employment contract (e.g. copy of your ID, copy of diplomas, copy of your health insurance card, etc.);
      • The data you need to declare your employment to public and social bodies;
      • Data required to meet legal, regulatory or compliance obligations to which we may be subject.
   3. As part of the creation of a CV database :
      If GENERIX is interested in your background, it may be added to a CV library with your agreement:
      GENERIX will then be able to send you, depending on your profile, different content:
      • New positions available
      • Content related to life at GENERIX
      • Supply Chain and Software content
      • Invitations to events in which GENERIX will participate.

7. How do we manage the accuracy of your personal data?

   It is your responsibility to ensure that the information you provide is accurate, complete and up-to-date. The transmission of any inaccurate, false or incomplete data may disqualify you for the position or result in the termination of any employment contract between you and a GENERIX GROUP entity. We invite you to inform us of any changes to your personal data during the course of our collaboration.

8. What are the legal bases for the processing carried out by GENERIX?

   If you are located in the European Union (EU) or if European regulations otherwise apply to you, the data collected is subject to processing based on :

   • Our legitimate interest: the processing of your personal data is necessary to manage recruitment processes and to assess and confirm (if applicable) the suitability of candidates for employment;
   • Contract: processing is necessary to prepare your job offer and employment contract, should you be hired;
   • Legal obligation: processing is necessary for us to comply with our legal obligations (excluding contractual obligations);
   • And in certain specific cases, with your consent.

   In the event of an unsuccessful selection and to enable you to apply for another job vacancy with GENERIX or to enable us to contact you in the event of other available positions that we deem suitable for your profile, in accordance with local legislation we ask you to consent to the retention of your personal data for a maximum period that may vary in accordance with local legislation from the date of your application or the creation of your account in accordance with this policy. If you wish to object to such retention at a later date, you may withdraw your consent by following the process set out in this privacy policy.
   If you are not located in the EU, it is possible that the applicable legislation of your country of residence requires your consent to collect and process your personal data. If this is the case, when you apply for a job with GENERIX, we will ask you to consent to the collection and processing of your application in accordance with this policy.

9. What are the purposes of the processing carried out by GENERIX?

   1. From our website
      The data collected will be used to optimize our recruitment operations, in particular by extracting information directly from your CV, or to offer you positions within the Group that may be suitable for you, with your consent.
      They also enable us to keep you informed of job offers, events, actions or publications that may be of interest to you.
   2. As part of the application review process
      The personal data collected may be used for purposes related to the processing of your application, including :
      • Contacting you by telephone or e-mail in addition to reviewing your CV;
      • Organizing tests and interviews if we are interested in your application;
      • Sending job alerts;
      • Innovative solutions;
      • Contact in the event of future job opportunities other than the specific position for which you have contacted us;
      • Managing your information requests ;
      • Monitoring diversity and non-discrimination ;
      • Managing and organizing GENERIX’s compliance with legal, regulatory and contractual obligations;
      • Managing any appeals or complaints.
   3. As part of the hiring process
      The personal data collected are necessary :
      • • When your employment contract is drawn up ;
      • • Preparing your arrival at our premises;
      • • Internal control operations;
      • • Comply with our legal, regulatory and compliance obligations, as well as the commitments made by the Group.

10. How does GENERIX manage automated individual decision-making in the context of pre-selection questions?

    In some cases, we may process your personal data by automated means. This means that a decision may be taken regarding your request solely by automatic means, without any human being being involved in the decision-making process in the context of pre-selection questions. Before any automated processing of your data is carried out, your consent will first be obtained. In such cases, we will provide you with clear information, in the job description, about our decision to use automated processing, the logic involved, and the significance and envisaged consequences of such processing for you. Depending on the applicable laws, you may have certain rights with regard to automated decision-making, in particular where it produces legal effects concerning you. See “How to exercise your rights” for more information on this subject.

11. Who receives personal data?

    We ensure that only authorized persons have access to personal data.
    Recipients can be :

    1. GENERIX departments or entities
       All personal data that you send us in connection with a job application are communicated to the GENERIX GROUP entity that published the job offer.
       When necessary, we may communicate some of your personal data to the various departments concerned (recruitment consultants, HR managers and assistants, etc.) and to managers or administrators within GENERIX entities for organizational, operational, administrative or internal control reasons or to meet our legal, regulatory or contractual obligations, in particular as part of the recruitment process or an interview with your potential manager.
       Your personal data may be processed outside your country of residence, including outside the European Economic Area (EEA) or Quebec in the context of a job application, for example when you decide to share your PDS with recruiters outside your country of residence. Consequently, your personal data may be subject to the laws applicable in the country in question. Consequently, if you provide us with your personal data to apply for a specific position and in particular if you decide to share your personal data with recruiters outside your country of residence, this implies a transfer of your personal data as described herein. In all cases, GENERIX will ensure that such cross-border data processing is protected by adequate safeguards, in accordance with applicable law.
    2. Third parties
       In the course of our business activities, third parties (for example, our subcontractors (in particular for electronic signatures), our IT service providers (in particular for recruitment assistance) or our consulting firms (in particular for external recruitment)) may receive or have access to some of your personal data.
       In such a case, we ensure that the transfers or exchanges are necessary and carried out within the limits of the purposes set out in the section ” What are the purposes of the processing carried out by GENERIX”, providing all the appropriate data protection guarantees.
       By way of exception, some of your personal data may also be sent, in compliance with applicable regulations, to third parties in France or abroad for the purposes of establishing, safeguarding or defending a legal right, as part of administrative or criminal investigations by one or more regulators, to ensure compliance with commitments made to them or as part of legal disputes of any kind.
       Some of your personal data may thus be transmitted not only to regulators or judicial authorities but also to GENERIX GROUP’s counsel and those of the other parties to the proceedings, as well as to these parties themselves. In such cases, GENERIX GROUP ensures that the data transferred or exchanged is relevant and necessary for the purposes mentioned above.

12. In what cases is personal data transferred or accessed outside the European Union, or outside Quebec?

    In view of the international organization and activities of our Group, personal data may be transferred, in accordance with the purposes of the processing, to Group entities, service providers, subcontractors or partners located in a country within or outside the European Union.
    The latter may contact you directly, using the contact details you have provided, to offer you positions within our Group that match your profile.
    In the event of a transfer to a country outside the EU and outside Quebec, rules have been put in place to ensure the protection and security of this information. In particular, to secure this type of transfer, we have put in place appropriate legal protection tools, in compliance with applicable laws.

13. What are the retention periods for Personal Data?

    1. Indirect” application
       If you have not applied directly (for example, your application was triggered by a recommendation process or introduced by a third party), you will have thirty (30) days to accept our privacy policy. If you do not agree within this period, your personal data will be deleted. If you do agree, your PDS will be treated in accordance with this “candidate” privacy policy, and more specifically as a “direct application”.
    2. Direct application
       Where you have applied directly to us, we will only keep your personal data on our systems for as long as is necessary to fulfil the purposes for which we have collected it, as described in this Privacy Policy, including to comply with any legal or accounting requirements.
       Please note that :
       • Your personal data will be retained for the period necessary to complete the recruitment process, and then deleted after the legally applicable retention period if your application is successful;
       • Your personal data will be kept for the legally applicable retention period after you leave GENERIX, in order to compile your administrative file in the event of a successful application;
       • With your consent, and in the event that your application is rejected, your personal data will be kept in order to study the possibility of offering you other positions likely to correspond to your profile, and to offer you content related to your areas of interest, for a maximum period that cannot exceed the legally applicable retention period from the date of your last contact with GENERIX GROUP ;
       • The results of any tests you may be offered during the recruitment process are subject to specific processing and will be kept for the legally applicable retention period after they have been carried out.

14. How to exercise your rights

    In connection with the processing of personal data, you are entitled to certain rights under the applicable regulations.
    Depending on the applicable law, you may have the right to access, rectify, port, erase, withdraw consent or limit the processing of your personal information. In accordance with European regulations, you also have the right to object, on legitimate grounds, to the processing of data concerning you, as well as the right to request the restriction of the processing of DCP concerning you.
    Please note that if you withdraw your consent, you may not be able to receive the job alerts to which you have subscribed. In addition, GENERIX may not be able to assess your compatibility with the position to be filled, which could result in your application being rejected.You also have the right not to be subject to decisions based solely on automated processing, for example when they produce legal effects concerning you or significantly affect you in a similar way. In these situations, you may obtain human intervention in the decision-making process, and we will ensure that measures are in place to enable you to express your point of view, and/or to challenge the automated decision. Your right not to be the subject of an automated decision does not apply where the decision being taken: (a) is necessary to enter into or perform a contract with you; (b) is permitted by applicable regulations and there are appropriate measures to safeguard your rights and freedoms and your legitimate interests; or (c) is based on your explicit consent. However, in these situations, you may still obtain human intervention in the decision-making process, and we will ensure that appropriate measures are in place to allow you to express your point of view, and/or to challenge the automated decision.
    Please bear in mind that these rights are not absolute and that the exercise of each of them is subject to certain conditions in accordance with applicable regulations. In any event, if the PII we collect is no longer required for any purpose and we are not required by applicable law to retain it, we will use our best efforts to delete or anonymize it.
    Only in France, you also have the right to define directives relating to the fate of your DCP after your death (Law for a Digital Republic).Any request to exercise a right will be analyzed by GENERIX and must :

    • In writing,
    • Must be signed by the applicant,
    • Include the address to which the reply should be sent, and
    • Be accompanied by proof of identity.

    For European residents :
    For any information or to exercise your rights concerning the processing of personal data managed by GENERIX, you can contact its Data Protection Officer (DPO): dpo@generixgroup.com, or send a letter to the following address:
    Generix Group
    For the attention of the DPO
    8 rue Simone Iff
    75012 Paris

    For Canadian/Quebec residents :
    For any information or to exercise your rights regarding the processing of information managed by GENERIX, you may contact the Privacy Officer (RPRP) for any request or question relating to the protection of personal information in Quebec or Canada : noram-rens.pers@generixgroup.com., or send a letter to the following address:
    GENERIX GROUP NORTH AMERICA
    1360 Rue Ropery
    #201, Montreal,
    QC H3K 2X3

    Depending on your country of residence, GENERIX entities may have specific local requirements, in particular to adapt to regulatory requirements. These will be explained to you on a case-by-case basis by the recruitment consultants of the entities concerned.
    Finally, you have the right to lodge a complaint with a supervisory authority:

    • For Europe, see: https://edpb.europa.eu/about-edpb/board/members_en
    • For France, see: CNIL – 3 place de Fontenoy – TSA 80715 – 75334 PARIS CEDEX 07 – www.cnil.fr.
    • For Belgium, see: https://www.autoriteprotectiondonnees.be/
    • For Spain, see: http://www.agpd.es
    • For Italy, see: http://www.garanteprivacy.it
    • For Portugal, see: https://www.cnpd.pt
    • For Romania, see: http://www.dataprotection.ro
    • In Quebec, the control authority is available at the following address: Commission d’accès à l’information du Québec (gouv.qc.ca)