Recruitment privacy notice

Last revised: December 2023

1. An overview of data protection

The Luxembourg Institute of Science and Technology (hereafter “LIST”, “We”) is committed to ensure the highest standards of data protection in compliance with the applicable legislation, notably with reference to the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereafter “GDPR”).

The present document aims at illustrating what personal data we collect about you in the course of the recruitment process, the reason why LIST uses your data and, as the case may be, share your data and the applicable retention periods. Additionally, the notice also provides you with information regarding your rights, how to exercise them and whom you can contact in case of any query.

2. Scope of the notice

The present notice is directed to individuals that submit their job application at LIST (hereafter “Candidate”, “you”).

Please note that we have in place a separate Staff Privacy Notice that applies to the processing of personal data of current and former collaborators.

3. Identity of the data controller

The data controller is LIST, having its registered office at 5, Avenue des Hauts-Fourneaux L-4362 Esch-sur-Alzette, Luxembourg.

LIST is responsible for collecting and processing your personal data in relation to your job application at LIST and the related recruitment process. However, please note that for the performance of personality/competency tests in the framework of a recruitment, we are using the AssessFirst tool belonging to the French company AssessFirst SAS which acts as an independent data controller. For more information on their privacy policy, please have a look at the following page: https://www.assessfirst.com/en/privacy-policy/.

Our contact details are set out in Section 11 (“Your rights and how to exercise them”) below.

4. Categories of personal data we collect

We collect personal data about you in the course of our recruitment activities.

Please find here below a detailed list of personal data we may collect and process. This may include but is not limited to:

Identification data: your name, surname, date and place of birth, address, e-mail address, telephone number, nationality, gender.
Job application data: your CV, cover letter, additional information regarding your professional qualifications, skills or abilities.
Employment history: your current company/organisation, your current role, your past work experiences.
Education history: your university degrees, academic records, professional licenses and certifications, memberships, awards.
Documents required under immigration laws (such as citizenship, passport or national ID, residency or work permit.
Professional preferences: your salary expectations, job roles preferences, willingness to relocate and other information you decide to share with LIST in the course of the recruitment or placement process.
Results of personality and/or competences assessment: such results will be always ultimately reviewed by our HR Department.
Technical data: your IP address; your browser type and language; access logs.
Your image as registered on our CCTV system upon attendance of an interview at our premises.
Extract of criminal records: that may be requested for certain roles and explicitly specified in the job opening. The document will be destroyed in accordance with the terms set by the Law of July 23 2016 modifying the Law of March 29 2013 on Organising Criminal Record Certificates, the Code of Criminal Procedure and the Criminal Code.
Any additional information you voluntary and unilaterally decide to share with LIST in the course of the recruitment or placement process (such as your picture, your hobbies, how you first learned about our job opening, reference letters).

As part of your job application documentation, LIST will not ask you to provide any special category of data (such as race or ethnicity, religious or philosophical belief, political opinions, trade union membership, sexual orientation, genetic data, health data). Please do not disclose this information with us.

In case of successful outcome of the recruitment process, the above-mentioned categories of personal data will form part of your employment file with LIST. You will receive more information about how LIST collects and process the personal data of its Collaborators through our Staff Privacy Notice.

5. Why and how your personal data is collected

LIST may collect your personal data either directly from you, when you submit your job application, or from third parties, such as a recruiter acting on your behalf in the context of the recruitment process or from a LIST’s employee referring you.

Further information about you may also be obtained in the course of the recruitment process (for instance, during job interviews). LIST may also collect information about you from publicly accessible sources (such as LinkedIn).

Please note that in case you provide us with the personal data of another person (such as referees), you are responsible for ensuring that this person is made aware of the content of this privacy notice and that the person has given you his/her consent for sharing his/her personal data with LIST and for getting contacted by LIST in the framework and for the purposes of the recruitment process.

Please find here below a list of the purposes for which LIST collects and processes your personal data:

Purpose	Details
To communicate with you	We will process your identification data to communicate with you regarding your application; to carry out and manage our recruitment and selection activities (such as inviting you to the job interview, exchange of a potential job offer, discussion about pre-contractual measures prior to your employment); or to inform you about other vacancies.
To manage your job application	T This includes: processing of applications and interview management, including any subsequent stages of a recruitment process; to use professional software to ensure communication between you and the selection committee.
To identify and evaluate candidates for potential job offers	This includes processing of your identification data, job application data, employment history, education history, professional preferences, results of personality and/or competences assessment to assess your suitability for a position you applied for at LIST.
To document the recruitment process for record-keeping purposes	This includes the collection of your identification data, job application data and recruitment notes taken during your interview.
To perform data analytics	We will process your personal data for statistical purposes for HR recruitment activities. In particular, the objective is for LIST to be able to identify the best sourcing channels for finding candidates, to identify or ensure gender treatment equity of applications within our processes.
To populate LIST’s recruitment pool database	This includes the collection of your identification data, job application data, employment history, education history, professional preferences and assessment results.
To ensure the security of our premises and facilities	This includes processing of your identification data, your image and your technical data to provide you with an access card or a badge, give you access to the job application platform, give you access to LIST’s guest wif network and to locate you in case of an emergency incident taking place at LIST’s premises during your visiting.
To draw up your employment contract	This includes the collection and monitoring of your identification data, job application data, employment history, education history, professional preferences and criminal record.
To establish and/or defend our legal rights	This includes processing of your identification data and job application data in case of claims against our recruitment procedure or in case we need to defend our rights.
To perform reporting activity	Your personal data can be used to prepare internal reports. These reports help LIST to identify recruitment results in terms of timeline, attractivity of the advertisement etc. All personal data are anonymized before they are entered in the reports.

6. Legal basis

Below you can find the list of legal bases on whose grounds LIST collects and processes your personal data:

Purpose	Legal basis
To communicate with you	LIST will process your personal data: - to perform a contract or of pre-contractual measures in order to move forward in the recruitment process; - based on your consent, when explicitly requested. For instance, we shall require your consent after twenty-four (24) months from the date of your last contact with us, to allow you to choose between requesting the deletion of your data or authorizing LIST to keep them for an additional period of twelve (12) months
To manage your job application	To perform a contract or of pre-contractual measures order to move forward in the recruitment process.
To identify and evaluate candidates for potential job offers	LIST has a legitimate interest in finding a candidate that best matches its needs for a specific job opening and therefore keeping the candidates data for two years. In the case of data imported from LinkedIn, the job applicant is informed at the time of collection and has the right to opt-out. The CV might be kept for longer with the consent of the job applicant.
To document the recruitment process for record-keeping purposes	Performance of a contract or of pre-contractual measures in order to move forward in the recruitment process.
To perform data analytics	LIST has a legitimate interest to export statistics in order to improve its recruitment process as well as to have a tool in place to make decisions for HR recruitment activities.
To populate LIST’s recruitment pool database	Your consent provided during the recruitment process. For instance, we shall require your consent after twenty four (24) twelve from the date of your last contact with us, to allow you to choose between requesting the deletion of your data or authorizing LIST to keep them for an additional period of twelve (12) months.
To ensure the security of our premises and facilities	LIST has a legitimate interest to process your personal data in order to ensure the physical security of people and items on its premises.
To draw up your employment contract	To perform a contract or of pre-contractual measures
To establish and/or defend our legal rights	LIST has a legitimate interest to ensure it has enough evidence to defend itself against any legal claims before all Courts or any competent authority regarding an application made.
To perform reporting activity	LIST has a legitimate interest to process your personal data in order to prepare internal reports which help LIST to improve its recruitment process.

7. Share of your personal data with third parties

In order to fulfil the purposes mentioned in Section 5 (“Why and how your personal data is collected”), your personal data may be disclosed internally o a need-to-know basis to members of our Human Resources Department as well as to other staff members of LIST who are involved in the recruitment process (such as interviewers or managers).

Additionally, LIST may transfer your personal data to:

External service providers that perform services on LIST behalf (such as recruitment agencies, online recruitment portals, IT consultants),
Government or other public bodies, upon request and to the extent permitted by law,
Certain regulated professionals such as auditors, accountants or lawyers.

In case of disclosure of your personal data to the subjects mentioned in section 7, LIST shall engage to take appropriate steps to ensure that third parties will apply adequate protection to this data as required by the applicable data protection legislation.

Some of the mentioned recipients of your personal data may be located in countries outside the European Union or the European Economic Area (EU/EEA):

Skeeled HR s.à.r.l.: LIST has implemented a recruitment software provided by Skeeled, a private limited liability company established in Luxembourg, to manage our online job opening and the related applications. Skeeled uses third party processors to process and store personal data some of which may be in the USA. LIST has performed an in-depth due diligence on such provider to ensure that it meets our standards of security and compliance and has signed all the necessary contractual arrangements with it. To learn more about Skeeled’s privacy policy, we invite you to consult the following webpage: https://www.skeeled.com/privacy.
Microsoft Ireland Operations Limited: This processor is based in Ireland and is the provider of MS Teams, a videoconferencing application. Microsoft may transfer, store and process personal data in the United States or any other country in which Microsoft or its contractors maintain facilities. Transfers out of the European Union and European Economic Area, are governed by Standard Contractual Clauses. For further details, please have a look at the following page: https://learn.microsoft.com/en-us/microsoftteams/teams-privacy.

8. Use of algorithms

The recruitment software provided by Skeeled allows LIST to perform reviews of Candidates’ CV with the help of algorithms. These algorithms help us to prioritize the applications that best match the requirements included in the job opening.

However, we make sure that the results derived from this automated review are always complemented by the review of our HR Department and do not, in any case or situation, exclude such human intervention. The hiring decision belongs exclusively to LIST.

9. Ensuring personal data security and integrity

In compliance with the applicable data protection legislation, LIST has put in place appropriate technical and organisational measures in order to prevent or act upon any unauthorised and unlawful processing or disclosure, accidental loss, modification or destruction of personal data. These measures are implemented based on the current state of art, an evaluation of the risks derived by the processing activity and the need to protect personal data. Such technical and organisation measures are regularly updated and/or adjusted to new technical developments or any organisational change that may affect LIST.

In particular, access on a need-to-know basis has been implemented to ensure only staff with appropriate need for the purpose has access to the personal data of candidates. Additionally, we have data processing agreements in place with our processors.

10. Data retention periods

LIST will only retain your personal data for a period of time that is strictly necessary for the purposes for which we collect your data, without prejudice to LIST to keep them for a longer duration for legal and/or regulatory obligations applying to LIST or due to exceptional situations that would justify them being kept longer (judicial procedure, etc.).

In particular, LIST will retain:

Purpose	Details
To communicate with you	Your personal data will be retained by LIST for an initial period of 24 months from the date of the closing of the recruitment process and then for two additional years following your consent.
To identify and evaluate candidates for potential job offers	Your personal data will be retained by LIST for an initial period of 24 months from the date of the closing of the recruitment process and then for two additional years following your consent.
To document the recruitment process for record-keeping purposes	Your personal data will be retained by LIST for an initial period of 24 months from the date of the closing of the recruitment process and then for two additional years following your consent. In case of successful applications, these data become part of your file as employee of LIST and are retained in accordance with our Staff Privacy Notice.
To perform data analytics	In this case your personal data will be kept for a maximum period of 24 months in our database.
To populate LIST’s recruitment pool database	Your personal data will be retained by LIST for an initial period of 24 months from the date of the closing of the recruitment process and then for two additional years following your consent.
To ensure the security of our premises and facilities	LIST will retain: - your identification and technical data for a period of 2 years after cancellation of the access; - your image for a period of 30 days after the moment it is captured by the CCTV systems on LIST premises.
To draw up your employment contract	Your personal data will be retained according to our internal Staff Privacy Notice
To establish and/or defend our legal rights	LIST will keep your personal data for a maximum of 30 years in accordance with art. 2262. Code Civil
To perform reporting activity	Your personal data will be retained by LIST for an initial period of 24 months from the date of the closing of the recruitment process and then for one additional year following your consent

11. Your rights and how to exercise them

With regards to your personal data collected and processed by LIST, you may exercise at any time the following rights:

Right to access: You have the right to receive confirmation about whether or not your personal data is being processed by LIST. If that is the case, you have the right to know what data is being collected and processed and to obtain of copy of it;
Right to rectification: If the personal data we hold about you is inaccurate or incomplete, you have the right to request to have it rectified;
Right to erasure: Subject to certain conditions specified in art. 17 of the GDPR, you have the right to have your personal data deleted by LIST;
Right to restriction of processing: Subject to certain conditions specified in art. 18 of the GDPR, you have the right to obtain restriction of the processing of your personal data performed by LIST;
Right to data portability: Subject to certain conditions specified in art. 20 of the GDPR, you have the right to obtain a copy of the personal data you provided to LIST in a structured, commonly used and machine-readable format and to request the transfer of these data to another data controller;
Right to object: you have the right to object the processing of your personal data when the conditions set out in art. 21 of the GDPR apply;
Right to withdraw consent: If LIST is processing your personal data based on your consent, you have the right to withdraw that consent at any time. The withdrawal of such consent shall not affect the lawfulness of processing based on consent before its withdrawal.
Right to lodge a complaint with a supervisory authority: You have the right to lodge a complaint with the Commission Nationale pour la Protection des Données (CNPD). More information on how to lodge a complaint are available on CNPD’s website: https://cnpd.public.lu.

You may exercise any of these rights by contacting our Data Protection Officer (DPO) by filling our online form at: https://www.list.lu/en/support/dpo-contact-form/

12. Changes to this notice

LIST may make changes to this privacy notice from time to time, to reflect our current privacy practices or to comply with changes in the applicable data protection legislation. LIST encourages you to regularly visit this page in order to remain informed on how LIST collects and processes personal data.