Personal data protection policy under the European Data Protection Regulation (GDPR) concerning the employment relationship

The subsidiaries of the ABLE GROUP (listed in Annex 1) attach great importance to privacy and the protection of personal data. They undertake to implement adequate measures to ensure the protection of personal data and to process and use such data in compliance with the applicable provisions and in particular European Regulation 2016/679 of 27 April 2016 (hereinafter the “GDPR”) and the French Data Protection Act (“Loi informatique et libertés”) no. 78-17 of 6 January 1978 in force in France.

1. Who is responsible for data processing and who can I contact?

Your personal data is collected by the company FERCHAU France SAS at 4 rue Farman, Bâtiment D, 31700 Blagnac, France, (RCS Toulouse 484 083 456) acting on its behalf and account but also on behalf and for the account of the company FERCHAU France Labs SAS at 4 rue Farman, Bâtiment D, 31700 Blagnac, France, (RCS Toulouse 817 693 617)

Your data is transmitted, stored, and processed by our parent company and subsidiary of the ABLE GROUP acting in the capacity and performing the functions of the Data Protection Officer (DPO):

ABLE Management Services GmbH
Steinmüllerallee 2
D-51643 Gummersbach, Germany
Tel.: +49 2261 5011-0
privacy@ferchau.com

2. What sources and data do we use?

We directly or indirectly collect and process personal data of the following categories: 

• Basic data (e.g., surname, first name, place of birth, date of birth, contact details, address, bank details, social security information, civil and marital status) 
• Information about your education and professional background (e.g., school education, additional qualifications such as apprenticeship, internships and/or studies, including relevant diplomas), certificates from previous employers 
• Information that you have made public on the Internet, e.g., in job-related networks (e.g.  LinkedIn) or for which you have authorised access and processing and which is publicly accessible. 
• Information about your work with us (e.g., current and previous positions, reporting lines, use of the company’s IT and infrastructure and systems, performance data).   
• Information which is necessary for the establishment, performance, and termination of an employment contract or which we are legally required to process (e.g., tax and social security information, attendance and absence data). This may also include information about your health (e.g., periods of incapacity for work, degree of disability).

Generally, we receive the above information from you. Some information may also be provided to us by external third parties (e.g., financial or social security authorities or recruitment agencies.) 

3. For what purpose do we process data (purpose of the processing) and on what legal basis?

We collect and process your data for the purposes of personnel management, work organisation and social action, and in particular, to establish, execute and terminate your employment contract. We may transmit your personal data to customers in the context of the execution of an assignment in progress or to be carried out or in the context of the issue of a commercial offer for which you may be entrusted with the execution of the assignment.

In addition, we process your data to fulfil our legal obligations and if we have a legitimate interest in processing it. 

The legal basis for this processing includes in particular Article 5 of the French Data Protection Act (“Loi informatique et libertés”) and Article 6(1) GDPR, as well as your consent if you have granted it to us. 

4. Who will receive my data? 

We may pass on your data to the following third parties: 

• The company ABLE Management Services, a subsidiary of the ABLE GROUP which provides us with “support function” services in relation to the management of the employment relationship (e.g., centralised personnel management, accounting, salary processing, legal advice) and for the safeguarding of our legitimate interest in the efficient management of human resources throughout the ABLE GROUP
• Public bodies such as financial and social security authorities or any “authorised third parties” as defined by the French National Commission for Information Technology and Civil Liberties (CNIL)
• Private bodies to which we have to transfer certain data (e.g., health insurance funds, pension funds, providence funds, etc.) 
• Our customers, if and insofar as they need to contact you or if an assignment with them is planned or actually carried out. 
• Other ABLE GROUP companies, to the extent necessary for the proper performance of your employment contract, if we have a legitimate interest in such transmission or if you have granted us your consent. You can consult an updated list of these companies on the Intranet. 

Private bodies which work for us as service providers (e.g., in the field of the provision and administration of our IT systems, for the assumption of administrative tasks in the field of personnel and administration or for legal advice).

5. Is the data transferred to a third country or an international organisation?

Your personal data will be stored within the European Union. We may transfer data to Switzerland. Concerning Switzerland, the European Commission has determined an adequate level of protection for the data transferred there from the EU (“adequacy decision”). This decision can be consulted via the following link:  
https://eur-lex.europa.eu/legal-content/FR/TXT/?uri=OJ:L:2000:215:TOC

In this case, the ABLE GROUP and the data controller undertake to make the necessary arrangements with its subcontractors and partners to ensure that they undertake to comply with the same data security standards and to act in accordance with the principles applicable under the strict European legislation on personal data protection. The contracts concluded with these subcontractors and partners will be based on the standard contractual clauses approved by the European Commission.

6. How long will my data be kept?

We will keep your personal data for as long as is necessary to fulfil our contractual and legal obligations.  
If the data is no longer required for the fulfilment of contractual or legal obligations, it will be deleted on a regular basis, unless its temporary processing is required for legal and/or regulatory reasons. 

7. What are my data protection rights?

Every data subject has the right of access (Article 15 GDPR), the right to rectification (Article 16 GDPR), the right to erasure (Article 17 GDPR), the right to restriction of processing (Article 18 GDPR), the right to object (Article 21 GDPR) as well as the right to data portability (Article 20 GDPR).  With regard to the right of access and the right to erasure, the restrictions provided set out in Articles 38 et seqq. French Data Protection Act (“Loi informatique et libertés) apply. In addition, there is a right to lodge a complaint with a data protection authority (Article 77 GDPR and Article 11 of the French Data Protection Act (“Loi informatique et libertés”).

In France, data subjects have the right to lodge a complaint with the French National Commission for Information Technology and Civil Liberties (CNIL). In addition, people who so wish have the possibility of organising what happens to their data after their death. For more information on this subject see: https://www.cnil.fr/.  

You can revoke your consent to the processing of your data at any time with the competent authorities. This also applies to the revocation of declarations of consent given before the entry into force of the GDPR, i.e., before 25 May 2018. Please note that the revocation only takes effect in the future. Thus, data processing carried out before the date of revocation is not affected by this revocation of consent.

8. Am I obliged to provide data?

Providing the above-mentioned data is in principle necessary for the performance of your employment contract. If, in breach of a legal or contractual obligation, you cannot provide the required data, we may not be able to continue the employment contract.   

9. To what extent is there automated decision-making (including profiling)? 

We do not engage in any profiling. 

10. How do we ensure the security of your personal data that we may have collected? 

We apply technical security measures to protect your personal data and make every effort to control it and prevent any accidental or intentional manipulation, alteration, destruction, or loss, as well as access to it by unauthorised persons. We make every effort to regularly improve these procedures.

11. Changes

We will update this privacy policy regularly. Any changes will be posted on this page with an updated revision date. If we make material changes, we will notify you by any means available to us. 

This document is sent to you by E-mail, and will be always available on our website. It will be considered as accepted by you upon receipt of your agreement by E-mail sent to our departments. This document authorises ABLE Management Services GmbH, as the controller of all personal data, to process the data mentioned above (Article 2) for the purpose of the monitoring and proper development of the contractual employment relationship. 

ANNEX 1 :

ABLE GROUP subsidiaries (not exhaustive):

• The company ABLE Management Services GmbH
• The company FERCHAU GmbH
• The company FERCHAU France SAS
• The company FERCHAU France Labs SAS

Information on your rights to object under Article 21 of the EU General Data Protection Regulation (GDPR) 

1. You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on Article 6(1)(e) or (f) GDPR, on grounds relating to your specific situation (data processing in the public interest) and Article 6(1)(f) GDPR (data processing based on a weighing of interests).

If you object to the processing, we will no longer process your personal data, unless we demonstrate legitimate and compelling grounds for the processing which override your interests, rights, and freedoms, or for the establishment, exercise, or defence of legal claims.

2. In some cases, we will process your personal data for the purpose of the direct advertising to our customers or prospects.

You have the right to object at any time to the processing or your personal data for this purpose. In this case, your personal data will not be processed for this purpose. 

The objection may be made without any formality.