This notice will inform you and individuals who apply to work for GÉANT (hereinafter referred to in singular: “you” and in plural: “candidates”) of what personal data GÉANT collects, uses, shares and transfers for recruitment purposes, including how information gathered using our online recruitment software (Teamtailor). It also explains how you may view and amend such information.

This Privacy Notice does not address the processing of personal data of employees of GÉANT.

The “Data Controller” is GÉANT Vereniging (referred to as throughout “GÉANT” or “we”) whose registered business address is Hoekenrode 3, 1102 BR Amsterdam, The Netherlands. GÉANT also has a registered UK Establishment located at City House, 126-130 Hills Road, Cambridge, CB3 1PQ.

GÉANT has designated the Data Protection Officer, who can be contacted at GDPR@geant.org

GÉANT has certain obligations under the General Data Protection Regulation (EU) 2016/679) including its national implementation legislation (“GDPR), to notify candidates (or “you”) as to how it will process any personal information it collects about them during recruitment and selection processes.

WHY DO WE COLLECT INFORMATION ABOUT YOU?

GÉANT needs to collect and process information about candidates to consider their suitability for employment or as a worker. We use your information so that we may provide recruitment services and carry out statistical analysis on GÉANT’s recruitment activity.

“Personal data” is any information that relates to an identifiable, living person. Examples of personal data include your name, address, contact details, and information on your CV such as your work history.

The term “process” means any activity relating to personal data, including (for example) collection, storage, use, consultation and transmission.

WHAT INFORMATION DO WE COLLECT ABOUT YOU?

We will only collect and process personal data that we need to process your application and make a hiring decision. For example, information you provide whilst registering a candidate account or profile on our recruitment system, in your CV, covering letter and application form, through Teamtailor Connect, and share with us during interview.

The types of personal data we collect and process in relation to candidates ("candidate information") may include the following:

· Name, address, email, telephone number, date of birth

· Applicant registration/account details, including your chosen password/log-in information

· Answers to questions around your recruitment preferences

· Any other information you wish to provide in support of building up your candidate account

· Answers to application questions

· Application reference number

· Details of the position you have applied for

· If you are currently employed by, or on behalf of GÉANT, as an employee or other worker

· Employment history information

· Education and qualifications information and other skills and any other relevant professional memberships or qualifications

· Compensation and salary information

· Information that you make publicly available on job seekers sites and social media sites

· Nationality / visa / right to work permit information

· National identifying numbers e.g. passport, driving licence, NI or BSN numbers

· Copies of any correspondence or other documents created by GÉANT when considering your application, including interview notes and feedback of the interviewers

· Claims for expenses relating to recruitment e.g. your bank details

· Equalities information, including information as to your gender, to the extent that we are allowed to pursuant to local applicable law

· Information relating to your skills and experience, if you are unsuccessful in your application, to inform you if any other relevant vacancies arise

· How you heard about the vacancy

· Whether you require any additional adjustments due to any medical condition

· Your availability for interviews and agreed interview times and dates

· Any other information that you volunteer during the application or recruitment process

If you accept a job offer with us we will process the following information about you:

· Name

· Address

· Contact telephone numbers

· E-mail address

· Date of birth

· Former or recent residential addresses

· Evidence of entitlement to work in the UK and/or NL such as passport and visa documentation

· Equalities information, including information as to your marital status and gender

· Results of any verification checks we deem necessary for the role you have applied for e.g. checks to verify your identity, address, qualifications, financial background, credit history, criminal records and the Dutch certificate of conduct (VOG or verklaring omtrent gedrag)

· Previous employer feedback and references information

· Information about criminal convictions and offences (only when this required for the role and permitted by local applicable law)

· Information needed to create or prepare your new hire record in G√âANT's people systems, including Humaans, where applicable

We may collect your feedback (e.g. surveys) for business purposes, such as improving recruitment processes. There is no obligation to respond to these and they have no impact on your application.

HOW DO WE COLLECT YOUR INFORMATION?

If you wish to apply for one of our vacancies, you will be directed to our recruitment system, where you can register a candidate account with us. Once you have a candidate account you are then able to submit a job application to us. All the data you submit using Teamtailor is stored in the region selected by GÉANT for its Teamtailor account. GÉANT currently uses Teamtailor’s Europe region, where personal data is mainly stored with AWS Ireland and processed mainly inside the EU/EEA.

We may also collect limited information about potential candidates from public professional sources, such as LinkedIn or professional websites, or receive information about you from employees, partners, recruitment agencies, search providers, professional contacts or other individuals who refer you to us, where we believe your profile may be relevant for a current or future vacancy.

We may also hold your personal data securely in paper files, other computerised files and other electronic databases.

GÉANT may use external service providers to collect, process and/or validate candidate information. For example, we may use recruitment agencies, test providers, video interview providers, background checking agencies etc. GÉANT requires that any such service provider ensures adequate data protection for candidate information and that it complies with local legal requirements.

HOW WILL COLLECTED INFORMATION BE USED?

Your personal data will only be processed in relation to your application for a role with GÉANT, recruitment and selection activity, candidate management, and future recruitment opportunities where you have given consent or permission, as described in this notice.

We are required by law to have a “lawful basis” (i.e. a reason) for processing your personal data. Personal data of candidates is only processed when it is:

• Necessary for us to comply with a legal obligation

• Necessary for the purpose of the legitimate interests of GÉANT (such as ensuring compliance with legal obligations other than those related to employment or social security, the protection of GÉANT assets, reputation and GÉANT employees and contractors) except where such interests are overridden by the interests or fundamental rights and freedoms of the candidates

• Necessary for the purposes of substantial public interests

• Necessary for us to take steps, at your request, to potentially enter into an employment contract with you, or to perform it based on your consent or permission, where this is required, for example where you have asked us to retain your profile for future opportunities or where consent is required for interview recording

If you choose not to provide your personal data to us, we may not be able to proceed with your job application, enter into or continue our contract of employment / engagement with you, or provide any additional benefit or services to you that you have applied for.

We may use your information in the following ways:

BACKGROUND CHECKS

We may decide to perform background checks (e.g. verification of identity, address and qualifications). These checks will be proportionate to the role that the candidate has applied for and as permitted by local law. These checks are only performed in relation to candidates who have been offered a role. Your consent will be requested before any such background screening checks are performed. You have the right to withdraw such consent at any time, this will not affect the validity of the processing prior to the withdrawal of consent.

CRIMINAL RECORD CHECKS

For any roles that carry specific risks (e.g. roles with significant responsibility for assets/finances or sensitive personal data), we may conduct either a Dutch certificate of conduct (verklaring omtrent gedrag or VOG) for candidates based in NL, or appropriate criminal records check for candidates based in the UK. These checks are only performed in relation to candidates who have been offered a role. Your consent will be requested before any background checks of this nature are performed. You have the right to withdraw such consent at any time, this will not affect the validity of the processing prior to the withdrawal of consent.

TRANSFERRING PERSONAL DATA WITHIN GÉANT AND ABROAD

As a European business with legal establishments in both Amsterdam NL and Cambridge UK, we may transfer your information outside your country of residence, and specifically to other countries within the EU. Processing and/or transfer of candidate information and the release of information within GÉANT and/or to third parties outside your country of residence is subject to local law and, where required, will be subject to your consent.

WHO DO WE SHARE YOUR INFORMATION WITH?

We may ask third parties service providers to carry out certain business functions for us, such as the administration of background checks, our payroll, our benefits providers and our IT service providers. These third parties will process your personal data on our behalf (as our processor). We will disclose your personal data to these parties, only where necessary, so that they can perform those functions.

Before we disclose your personal data to other people, we will make sure that they have appropriate security standards in place to make sure your personal data is protected, and we will enter into a written contract imposing appropriate security and data protection standards on them.

GÉANT may be obliged to release candidate information to external parties as required by legislation or by legal process, such as Government Authorities, as well as to parties you authorise GÉANT to release your personal data to.

We will disclose your personal data to third parties:

• In the event that we sell or buy any business or assets, in which case we will disclose your personal data to the prospective seller or buyer of such business or assets.

• Our service providers supplying services on GÉANT’s behalf, which require the use and/or creation of candidate information.

If we are under a duty to disclose or share your personal data in order to comply with any legal obligation; or to protect the rights, property, or safety of GÉANT, its customers, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction (only as permitted under local applicable law).

We have set out below a list of the categories of recipients with whom we may share your personal data, where it is necessary to do so:

• Government bodies, including HMRC, DWP and UKBA; in NL these include UWV, SVB, Belastingdienst and IND

• Organisations providing goods and/or services on our behalf, including third party contractors e.g. occupational test providers, background checking agencies, pension providers, organisations providing back-up storage services and other IT services, medical practitioners (including occupational health advisors and company doctors)

• Our Auditors

• The Disclosure and Barring Service for Criminal Records Checks

• Any contractors providing services required in relation to your application, including our legal advisors

• Regulatory bodies,

• Your former employer(s) and/or referees

• Consultants and other professional advisors (e.g., solicitors)

• Any other third parties, where authorised or directed by you to do so

At all times we will comply with our obligations under local data protection laws.

Automated decision-making means making a decision about you using no human involvement.

Within the process of your application to GÉANT no decision will be made about you solely on the basis of automated decision making (where a decision is taken about you using an electronic system without human involvement) which has a significant impact on you.

GÉANT may use recruitment technology, including functionality within Teamtailor, Microsoft 365 or other approved systems, to support the recruitment process. This may include support with recruitment administration, preparing job descriptions, creating interview questions or interview kits, organising recruitment information, summarising notes where notes have been taken, or helping the recruitment team and hiring managers manage recruitment workflows.

Where AI-supported tools are used, they are used to assist with administrative, drafting, organisational or summarising tasks. They are not used to make final recruitment decisions, and they They are not used to make final recruitment decisions, or to evaluate, rank or compare candidates without human review.

Recruitment decisions at GÉANT are made by the recruitment team and/or hiring team. Any information produced by AI-supported tools is reviewed by a person before it is relied upon as part of the recruitment process.

Where GÉANT uses interview recordings, transcripts or summaries, these will only be used where appropriate for the recruitment process and where the required notice or consent has been provided.

HOW DO WE PROTECT YOUR INFORMATION?

The transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk. When you register a candidate account with us, you must choose a password which enables you to access certain parts of the system. You are responsible for keeping this password confidential.

Once we have received your information, it is protected with physical, technical, organisational and procedural safeguards that are proportionate to the sensitivity of the personal data which we store. These safeguards are designed to protect your personal data from loss and unauthorised access, copying, use, modification or disclosure.

GÉANT will ensure that third parties who process your personal data on our behalf also have equivalent or greater safeguards in place.

HOW LONG DO WE KEEP YOUR INFORMATION FOR?

Personal data relating to candidates who are unsuccessful will be retained for a maximum of 12 months after a hiring decision has been made (unless you have given your consent for us to retain your details for longer to allow us to notify you of vacancies in the future). After this time, it will be securely destroyed and permanently deleted.

Where you have given consent or permission for GÉANT to retain your details for future vacancies, that permission will normally remain valid for 12 months. We may ask you to renew or extend your permission before or when it expires.

Where GÉANT has sourced your professional profile or received your details through a referral, we will ask for permission to retain your information. If permission is not provided within the configured period, your profile may be marked as missing permission and deleted in line with our retention settings.

If you ask us to remove your recruitment data, we will process that request in line with applicable data protection law and our configured deletion process.

If you start work with us, any personal data processed as part of your employment records will normally be held for a period of 7 years from the end of your employment with us, except where we are:

• Legally required to retain the information for longer

• Legally required to delete the information within a specified period

• Where the personal data is required in relation to any legal or other type of dispute, either with you or with a third party

Any personal data contained in any work-related correspondence may be retained for longer, dependant on the relevant retention period for that work or matter.

YOUR RIGHTS AND ACCESSING YOUR INFORMATION

Under your local law you may have the right to access, review, amend, withdraw and delete the personal data that GÉANT holds about you (subject to certain legal limitations).

You have the right to request the following, in respect of the processing of your personal data:

• Access to your personal data;

• Have any incorrect personal data corrected or erased;

• The restriction of the processing of your personal data whilst any request to have incorrect personal data corrected or erased is being considered;

• To object to any processing of your personal data undertaken on either public interest or legitimate interest grounds;

• To object to being subject to any decision based solely on automated processing;

• A review to any decision made based solely on automated processing, to be undertaken by a human, and provide additional evidence or submissions to support any review

• A copy, provided in a structured, commonly used and machine-readable format, of any personal data that you have provided us, where the information is processed on the basis of your consent or in the course of a contract between you and us.

You can use your Teamtailor candidate account, where applicable, or the data privacy options available through the GÉANT careers site, to request access to, correction of, withdrawal of permission for, or deletion of your recruitment data.

Where we process your personal data solely on the basis of your consent, you are entitled to withdraw your consent at any point. If you chose to do this, this means that we will be unable to further process your personal data for that purpose, but any processing undertaken prior to the withdrawal of your consent would still be deemed lawful.

However, we may not be able to comply with your requests, where the information falling within the scope of your request is exempt, due to the circumstances and/or purposes to which we are processing this information. If this is the case, we will respond to your request explaining the reasons why we are unable to comply with your request.

Where you exercise your right to object or withdraw your consent we may process your personal data without your knowledge or consent where we are permitted or required by law or regulatory requirements to do so. In such a case, we will not process more personal data than is required under the circumstances.

INFORMATION ON GENDER DATA PROCESSING IN RELATION TO THE GÉANT GENDER EQUALITY PLAN

GÉANT is an equal opportunities employer and has a Gender Equality Plan (GEP) in place. In line with our GEP we ask job candidates a gender related question when they apply for a role with us. Each candidate is free to decide whether they wish to provide such information or choose the ‘prefer not to say’ option. Whichever option the individual chooses, it will not have any impact on their application for the role.

The data collected in respect of responses to the gender related question supports decision making by GÉANT in ensuring its recruitment practices promote gender equality. If gender related data is provided by a candidate such data will be used only for this purpose.

The legal basis for processing this information is GÉANT’s legitimate interest which consists in monitoring numbers in relation to gender as part of our recruitment process so as to take further steps to ensure Gender Equality if appropriate. Such processing does not harm the risks and rights of candidates and additionally a data protection impact assessment has been undertaken.

FURTHER ASSISTANCE AND COMPLAINTS