Here you will find information on how we handle personal data relating to your application. Below we explain what data we collect about you, what this is necessary for, who receives this data, how long it is stored and what rights you have with regard to your data.
1. Who is responsible for data processing and who can I contact?
The Responsible Party for applications to Expleo South Africa is:
Expleo South Africa
Block B, Morningside Corner |Cnr 3rd Avenue & Rivonia Road |Rivonia 2128 Johannesburg |South Africa
Represented by the Information Officer, Martin Knox
2. Which data do we process?
We only process personal data that we receive from you as part of your application. These are in particular:
- Personal data (first and last name, date of birth, address, school certificate)
- Communication data (telephone, mobile phone, fax number, e-mail address)
- Data on assessment and evaluation in the application process
- Data on education (school, vocational training, civil/military service, studies, doctorate)
- Data on previous professional career, training and work references, information on other qualifications (e.g., language skills, PC skills)
- Application photo
- Application history
- Other data provided to us voluntarily during the application process (e.g., voluntary activities, hobbies, etc.)
- Employment References
- Criminal, qualification and credit verification reports
3. Data processing purposes and conditions for lawful processing
We process personal data in accordance with the provisions of the Protection of Personal Information Act 4 of 2013
The purpose of the data processing is the management of applications, such as the application documents handling, qualification assessment, the conduct of interviews and the hiring decision.
The conditions for lawful processing results from(Chapter 2, Section 4 and Chapter 3, Part A, Protection of Personal Information Act 4 of 2013 and are:
- Accountability – Processing is conducted lawfully, fairly, and transparently
- Processing limitation – Only as necessary. Processing must be adequate, relevant, and limited to the purpose and data must be minimised
- For a purpose that is specified, explicit and legitimate and not for any other purpose
- No longer than necessary – Further processing to be compatible with the purpose of collection
- Quality of information – data must be complete, accurate, not misleading and up to date, if not it must be rectified or erased
- Openness – Notification to data subject when collecting personal information
- Securely – ensure that there is integrity and confidentiality of personal data by taking appropriate organisational and technical measures to secure personal data
- Data subject participation – right to access, correction and manner of access
Processing is understood to mean all activities of recording, storage, use and modification. The ability to view data is also classed as processing.
4. Who receives my data (categories of recipients)?
a) Internal offices
Your data will only be received by the internal bodies involved in the decision (responsible personnel or specialist departments).
b) External service providers
The following external service providers have access to personal data who work for the data controller and receive personal data of the data subject in this context:
- Service provider for telecommunications
- Service providers for file and data destruction
- Service providers for system hosting
Transborder Information Flows to other countries only occur within the scope of communication required for the fulfilment of the contract and other exceptions expressly provided for in POPIA (Chapter 9, Protection of Personal Information Act 4 of 2013). Otherwise, there is no transfer to other countries.
Other data recipients may be those entities for which you have given us your consent to transfer data.
5 How long will your personal data be stored?
We store your personal data for six months, taking into account Chapter 2, Section 4 and Chapter 3, Part A, Protection of Personal Information Act 4 of 2013. The start of the term is the receipt of the rejection letter.
This does not apply if you give us your consent to store your data for a longer period (e.g., inclusion in an application pool). In the case of inclusion in the applicant pool, deletion takes place after two years.
6. What data protection rights do you have?
Here you will find your rights in relation to your personal data.
According to Chapter 2, Section 5 of the Protection of Personal Information Act 4 of 2013, you have the right to have your personal information processed under the Conditions of lawful processing (see paragraph 3.1) including the rights in the points below.
Please note that were “Section” referred to below it refers to a section in the Protection of Personal Information Act 4 of 2013
- Notification – To be notified that:
- Personal information about him, her or it is being collected as provided for in terms of Section 18
- his, her or its personal information has been accessed or acquired by an unauthorised person as provided for in terms of Section 22
- To establish whether a responsible party holds personal information of that data subject and to request access to his, her or its personal information as provided for in terms of Section 23
- To request, where necessary, the correction, destruction, or deletion of his, her or its personal information as provided for in terms of Section 24
- To object, on reasonable grounds relating to his, her or its particular situation to the processing of his, her or its personal information as provided for in terms of Section 11(3)(a)
- To object to the processing of his, her or its personal information at any time for purposes of direct marketing in terms of section 11(3)(b)
- Not to be subject, under certain circumstances, to a decision which is based solely on the basis of the automated processing of his, her or its personal information intended to provide a profile of such person as provided for in terms of section 71
- To submit a complaint to the Regulator regarding the alleged interference with the protection of the personal information of any data subject or to submit a complaint to the Regulator in respect of a determination of an adjudicator as provided for in terms of section 74
- To institute civil proceedings regarding the alleged interference with the protection of his, her or its personal information as provided for in section 99