Candidate Privacy Policy

When does this Privacy Notice apply?

 

This Privacy Notice describes our practices with respect to the collection, use, storage, disclosure and erasure (“Processing”) of personal data about you (your “Personal Data”) in connection with your job application with Potloc Inc. or its worldwide affiliates or subsidiaries, including SAS Potloc France and Potloc USA, Inc. (collectively, “Potloc” or “we”). 

 

This Privacy Notice applies whenever you submit a job application to Potloc, whether it is a direct application for one of our openings, including through our Careers page at https://jobs.lever.co/Potloc, or if our talent acquisition team contacts you.

 

Which categories of Personal Data does Potloc Process?

We process certain non-sensitive Personal Data and certain sensitive or special categories of Personal Data:

 

Category	Types of Personal Data
Identification Data	First name, middle name, last name, Home postal address,  Personal email address, Personal telephone number, Personal cellular, mobile or wireless number, Hobbies, interests and preferences (if included in your application package), Photographs (if included in your application package), Your information from publicly available sources, including online, that we believe is relevant to your application or a potential future application (e.g. your LinkedIn profile).
Professional Data	Occupation,  Work title, team, department, division, position level, Place of work, Business email address, Employment history, Education history Other information provided as part of your application package, such as resumes or references.
Immigration Data	Immigration status and willingness to relocate.
Salary Data	Salary expectations.
Sensitive Data	Background check results (to the extent permitted by law), Psychological and behavioral characteristics, personality types and traits.
Performance Data	Technical test results and performance.

 

You should only include information required for your job application in your application package, as we may not be legally permitted to process any additional Personal Data, and such information will not be considered in our hiring process. As part of our commitment to equal opportunity employment, we may process information to support our diversity and inclusion efforts, which could include anonymized and/or aggregated sensitive and/or demographic information.

 

Please note that failure to provide accurate information may impede the conclusion of an employment contract with Potloc.

For Which Purposes does Potloc Process your Personal Data?

We process your Personal Data to the extent permitted or required under applicable law, for the following purposes:

 

• Candidate Search and Acquisition: Searching and identifying relevant profiles to attract applications, including the pre-selection of the candidates,
• Recruitment Process: Assessment of the candidate's suitability for the job and measurement of their professional skills.
• Compliance and Regulatory: Compliance with laws and regulations, Potloc’s policies and procedures, and corporate responsibilities and audit requirements, such as employment and immigration laws.
• Analytics: Conducting analysis of your personal data to support our business practices such as promoting equal opportunity employment.

 

On Which Legal Bases does Potloc Process Your Personal Data?

Generally, Processing of your Personal Data is necessary for the conclusion and/or performance of your potential employment contract with Potloc. In general, you are required to provide your Personal Data, except in limited instances when we indicate that certain data is voluntary (e.g., in connection with your racial or ethnic origin, gender or hobbies and preferences). Providing these details is essential for concluding the employment contract for selected candidates. Additionally, certain categories of information and documentation (such as personal details, address, residency status, etc.) are required by regulation for selected candidates. 

 

We rely on the following legal bases for the processing of your Personal Data. Note that in Canada, personal information may only be processed with your consent or where authorised by law.

 

Purpose	Personal Data Categories	Lawful Bases
Candidate Search and Acquisition	Identification Data Professional Data	Legitimate Interest
Recruitment Process	Identification Data Professional Data Immigration Data Performance Data Salary Data	Performance of a contract with you Compliance with a legal obligation
Compliance and Regulatory	Identification Data Professional Data Immigration Data Salary Data Sensitive Data	Compliance with a legal obligation Legitimate Interest
Analytics	Professional Data Salary Data Sensitive Data	Legitimate Interest Your Consent

 

Where does Potloc Transfer Your Personal Data?

 

1. Categories of Recipients of Your Personal Data

• Other Potloc entities: Potloc may transfer your Personal Data to other companies within Potloc entities, as permitted under applicable laws. Where applicable, we do so to pursue legitimate interests as other companies within our corporate group may act as a data controller for the purposes set forth herein. 
• Third parties: Potloc may transfer your Personal Data to government agencies and regulators (e.g., tax authorities), social insurance carriers, courts, and government authorities, all in accordance with applicable law and to external advisors acting as controllers (e.g., lawyers, accountants, auditors, etc.).
• Service providers (within and outside the group): As part of our normal operations, Potloc contracts with third-party service providers or other group companies to carry out certain global human resource management activities (i.e., background checks, global directory, global benefits, global recruitment and cross-charging for salary and other compensation expenses among group companies benefiting from contributions by Potloc employees) or IT related tasks (i.e., for maintenance of secure global systems and networks).
• Business Partners: We may disclose your Personal Data in connection with, or during negotiations of, any merger, sale of assets, financing or acquisition of all or a portion of our business by another entity or investors.

 

Your information will only be transferred as permitted by applicable law.

 

2. Cross-Border Transfers of Your Personal Data

 

Potloc may transfer your Personal Data outside of your region. Some recipients are located in countries for which the European Commission has issued adequacy decisions, namely: Switzerland. Some recipients received a partial adequacy, namely : Canada and the U.S. Finally, some recipients are located in countries for which the European Commission has not issued an adequacy decision in respect of the level of data protection. While such information is outside of your region, it is subject to the laws of the jurisdiction in which it is held, and may be subject to disclosure to the governments, courts, law enforcement, or regulatory agencies of such other jurisdictions pursuant to local laws.

 

By entering into appropriate data transfer agreements based on Standard Contractual Clauses or other means to ensure the protection of your Personal Data, Potloc established that all such recipients will provide an adequate level of data protection and that appropriate physical, technical and organizational security measures are in place to protect Personal Data against accidental or unlawful destruction, loss or alteration, unauthorized use, disclosure or access, and against all other unlawful forms of processing. Any onward transfer (including to our affiliates outside the EEA) is subject to appropriate onward transfer requirements as required by applicable law.

 

You can ask for a copy of such appropriate data transfer agreements by contacting us as set out at the bottom of this notice.

How Long does Potloc retain Your Personal Data?

We will retain your Personal Data as long as required to complete the recruitment process or permitted by applicable law. Personal Data concerning selected candidates will be incorporated into their administrative file and will be retained for the applicable retention period after the end of the employment relationship. We will retain your Personal Data until the statute of limitations on any legal action expires. If a judicial or disciplinary action is initiated, the Personal Data may be stored until the end of such action, including any potential periods for appeal, and will then be deleted or archived as permitted by applicable law. Afterwards, we will remove your Personal Data from our systems and records and/or take steps to properly destroy it or anonymize it so that you can no longer be identified from it.

 

We will retain the data of unsuccessful candidates for the job position solely to build a resume database and to potentially offer them new job opportunities for a period of 3 years, if they have given us their consent.

How does Potloc Keep my Personal Data Safe?

 

We are dedicated to ensuring the security of your personal data, employing reasonable physical, technical, and administrative safeguards to preserve the confidentiality, integrity and security of information under our control. For example, we use cloud data storage partners, namely Google Cloud Platform and Amazon Web Services servers located in the US, who use secure-by-design infrastructure and built-in protections. Your Personal Data is stored behind password-protected systems with encrypted (TLS/SSL) connections. We take steps to ensure that only those who need access to your information to perform their duties have access to it.

 

Please be aware, however, that no method of transmitting information over the Internet or of storing information is completely secure.

What are Your Rights and How Can You Exercise Them?

 

You can send an email to privacy@potloc.com to exercise your data subject rights.

 

We will try to help you with your request free of charge. However, we may request that you pay a reasonable fee if you request a transcript, or a reproduction or for us to send a copy of your personal data, if the law allows us to do so. If we need to charge a fee to process your application, we will contact you before addressing your request.

 

For security reasons and to avoid any fraudulent request, we may be required to ask that you provide a proof of identity with your request. We will not use such personal data for any other purposes.

 

Unless otherwise agreed, and unless a longer response time is permitted by law, we will respond to your request within thirty (30) days. Please remember that rights are not absolute and could be refused. If your request is denied, we will notify you in writing, and provide you with detailed motives and information on how to contest our decision.

1. Quebec

In Quebec, in accordance with Act Respecting the Protection of Personal Information in the Private Sector (“Quebec Private Sector Act”) you may have certain rights such as:

 

• The right to  control the dissemination of your personal information (i.e., the right to de-indexation);
• The right to data portability;
• The right to be informed and submit observation regarding automated decision-making;
• The right to access;
• The right to rectification;
• The right to withdraw consent;
• The right to request information about data processing; and
• The right to lodge a complaint with the Commission d'accès à l’information du Québec.

 

2. European Economic Area and the United Kingdom

If you are located in the European Economic Area or United Kingdom, European Union Regulation 2016/679 of 27 April 2016 (“EU GDPR”) and United Kingdom General Data Protection Regulation (“UK GDPR”), (collectively, “GDPR”), may apply to you. 

 

Under the GDPR, you may have certain rights, such as:

• The right to be informed;
• The right to withdraw consent, where relied upon as a legal basis;
• The right to access;
• The right to rectification;
• The right to erasure;
• The right to restriction of processing;
• The right to data portability;
• The right to object to processing;
• The rights in relation to automated decision making and profiling; and
• The right to submit complaints to the data protection authorities. 
• You can consult a list of EU data protection authorities here. 

 

In the UK, the Information Commissioner’s Office has published the following Guide on these rights.

Who is Potloc’s Privacy Officer / Data Protection Officer and How can I Reach Them?

 

If you have questions regarding how Potloc Processes your Personal Data, or to exercise your rights, please contact us directly at privacy@potloc.com or:

 

Attn: Privacy Officer / Data Protection Officer

5420 Suite 300 Boulevard Saint Laurent, H2T 1S1 QC, Canada

dpo@potloc.com

How will you know this Privacy Notice has changed?

 

From time to time, we may update this Privacy Notice. Subject to applicable laws, we will notify you of any changes. Any updates will be effective upon posting the revised notice. The last update to this notice is indicated by the date listed at the top.