Candidate Privacy Notice

General

Starion Group SA, hereinafter referred to as ‘Starion’ or ‘the Company’, including its affiliates, ensures processing of Personal Data in accordance with, but not limited to, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 – General Data Protection Regulation (‘GDPR’).

The terms ‘Personal Data’, ‘Data Subject’, ‘Data Controller’, ‘Data Processor’, ‘Joint Data Controller’, ‘Independent Data Controller’ and ‘Data Protection Officer’ hereinafter used have the meaning defined in article 4 of GDPR.

Candidates are students or professionals searching for a job within Starion and they may be attained from the following sources:

  • Application form for a job position or open application
  • Recruitment agencies – for example, when a recruitment agency with Candidate details contacts Starion to suggest the person as a potential Candidate
  • Publicly available sources online – for example, a Candidate’s current employer’s website or on a professional networking site, such as LinkedIn or Job Boards such as Stepstone
  • By reference – for example, through a reference from a former employee or employer, or from a referral by a Starion employee.

This Candidate Privacy Notice (hereinafter referred to as ‘Candidate Notice’) applies in relevant countries throughout the Company’s international network. Different countries throughout Starion’s international network may approach data privacy in slightly different ways; any country-specific terms can be found in the last part of this Candidate Notice.

Starion Group SA is the Data Controller of Personal Data and the Global Data Protection Officer can be contacted at privacy@stariongroup.eu.

Applicability

This Candidate Notice applies to the processing of Candidates’ Personal Data by the Company through recruiting activities, job applications and job vacancy advertisements in accordance with Regulation (EU) 2016/679 (GDPR).

This Candidate Notice does not apply to the processing of applicants’ data after they are hired and during their employment.

This Candidate Notice applies to any and all forms of use of Personal Data for a current, former or prospective Candidate of any of the Company employing entities.

Categories of Personal Data and purposes for processing

In order to manage Candidates, the following categories of Personal Data are processed:

TypePersonal DataPurpose
Identification dataName, first name, date of birth, sex/gender, copy of ID or passport, nationality
Name and surname of referred person for professional checks
Subscribe to Careers newsletter
Process open application
Verify claimed identity
Prepare for and enter into a contractual employment relationship
Get a reference check on a Candidate’s past job roles
Contact dataPersonal phone number, personal email, personal mailing address

Email and phone number of referred person for professional checks
Subscribe to Careers newsletter.
Process open application
Determine the suitability of a Candidate’s qualifications
Prepare for and enter into a contractual employment relationship
Get anonymous feedback on recruitment process
Get reference check on a Candidate’s past job roles
Communicate in the future with the Candidate about any potential job vacancy
Professional dataEmployer, job title, professional phone number, professional email, performance at work, notice period, need of relocation, contact details of referees providedProcess open application
Determine the suitability of a Candidate’s qualifications
Prepare for and enter into a contractual employment relationship
Education dataTraining, certifications, degreesDetermine the suitability of a Candidate’s qualifications
Comply with any legal or regulatory obligations imposed to recruitment practices
Financial dataCurrent and expected renumeration package, other advantagesDetermine the suitability of a Candidate’s qualifications
Comply with any legal or regulatory obligations imposed in relation to recruitment practices
Security dataSecurity clearances in possession, self-declarations on good conduct, criminal recordsDetermine the suitability of a Candidate’s qualifications
As permitted by law, to establish whether an applicant has committed an unlawful act or been involved in dishonesty, malpractice or other seriously improper conduct
Comply with government and public sector security clearance requirements
Comply with any legal or regulatory obligations imposed in relation to its recruitment practices
Family dataFamily members’ description, declaration of family members working at the end client or at StarionDetermine the suitability of a Candidate’s eligibility
Prepare for and enter into a contractual employment relationship
Determine the relocation package
Comply with any legal or regulatory obligations imposed on Starion in relation to its recruitment practices.

The Company will not require you to provide sensitive Personal Data, except to the extent that the collection of such information is required under applicable law. Sensitive Personal Data, also known as special categories of data (article 9 of GDPR), means “Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation”.

When processing an application, the Company does not use automated decisions based on Personal Data. When the Company verifies a Candidate’s professional data by contacting the Candidate’s references or other third parties, the Candidate is responsible for making sure that before providing Personal Data about other individuals to the Company, they let them know that they will be sharing their identification and contact data with the Company.

Legal basis for processing

The legal grounds for processing the collected Personal Data applicable to Candidates are:

PurposeLegal basis
Legitimate interestVerify claimed identity
Determine the suitability of a Candidate’s qualifications
Get anonymous feedback on Starion’s recruitment process
Get a reference check on a Candidate’s past job roles
Legal obligationAs permitted by law, to establish whether an applicant has committed an unlawful act or been involved in dishonesty, malpractice or other seriously improper conduct
Comply with government and public sector security clearance requirements
Prepare for and enter into a contractual employment relationship
Comply with any legal or regulatory obligations imposed on Starion in relation to its recruitment practices
ConsentSubscribe to Starion’s Careers newsletter
Process an open application
Communicate in the future with the Candidate about any potential job vacancy

Recipients and transfers of Personal Data

Personal Data collected is processed internally only by duly authorised and informed persons, within the scope of the recruitment process.

The Company will not pass on or sell Personal Data to third parties for their own marketing purposes.

The Company shares Personal Data externally only in the following cases:

Depending on the situation, these recipients sign a written contract with Starion distinguishing between different types of roles:

  • Data (sub-)Processor: this is the person/entity who processes the data on behalf of Starion and according to Starion’s documented instructions
  • Joint Data Controllers: Starion jointly determines with a client/provider the purposes and means of processing; they determine their respective responsibilities for compliance in specific privacy clauses
  • Independent Data Controllers: each party is acting as a separate Data Controller, respecting the duties and responsibilities of a Data Controller according to GDPR.

On the basis of specific agreements, the Company ensures compliance with the instructions and measures put in place for data processing.

If an international transfer of information involving Personal Data is needed, the Company ensures that there are appropriate safeguards in place to ensure the safety and integrity of Personal Data through the following measures:

  • Binding corporate agreements which give Personal Data the same protection it has in the European Economic Area (EEA)
  • Standard contractual clauses approved by the European Commission for international transfer of Personal Data outside the EEA into contracts with those third parties, or the country in which personal information will be processed has been deemed ‘adequate’ by the European Commission
  • European Data Protection Board opinions on the European Commission Implementing Decision on the adequate protection of Personal Data under the EU-US Data Privacy Framework.

Storage of Personal Data

When a Candidate submits an application via the Company’s website, the data is processed by Krystal, one of Starion’s Data Processors.

The Personal Data of Candidates is stored and kept in the Starion servers located in Belgium within the Recruitment private SharePoint site with proper access restrictions. The Personal Data of Candidates is also stored and kept in a database provided by Bullhorn, another Company Data Processor.

Personal Data retention period

If the application is successful, the Company retains each Candidate’s Personal Data as part of its employee records.

If the application is unsuccessful, the Company retains each Candidate’s Personal Data until withdrawal of consent or for a reasonable period of time to deal with any matter which may arise in connection with the application, for purposes of contacting the Candidate regarding future employment opportunities (in both Starion and its sister company Nexova Group) and for our legitimate business purposes (for example to make sure we do not contact an individual about a role they have already applied for).

Personal Data submitted for subscription to the Company’s Careers newsletter is held up to the time that a person unsubscribes, i.e. when they withdraw consent to receive weekly updates on open positions.

Personal Data submitted for an open application is held until consent is withdrawn.

Consent of Candidates

The consent to process Personal Data according to this Candidate Notice is collected and recorded either by signing this notice digitally/in paper or by clicking the checkbox of consent in the online job/open application form, declaring to have read and accepted it.

Candidates are made aware of this Candidate Notice on the Company’s website when they directly send their Personal Data to the Recruitment Team without completing the website job/open application form.

The Company employees make Candidates aware of this Candidate Notice when they provide the Recruitment Team with a Candidate’s data via the referral form.

Protection of Personal Data

The Company ensures security of processing (Article 32 of GDPR) by implementing appropriate technical and organisational measures to ensure an appropriate level of security. When assessing the appropriate level of security, the Company will take into consideration:

  • Risks presented by processing: accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored or otherwise processed (data breach)
  • State of the art of security measures, costs of implementation of new security measures
  • Nature, scope, context and purposes of processing
  • Risk of varying likelihood and severity for the rights and freedoms of individual people.

Details of specific technical measures are available by sending an email to privacy@stariongroup.eu.

Rights of Data Subjects

Website users have the following Data Subjects’ rights with regard to their Personal Data:

  • Right of access (Article 15): request access to all Personal Data processed
  • Right of rectification (Article 16): ask that any Personal Data that is inaccurate is corrected free of charge
  • Right to withdraw consent (Article 7): withdraw earlier given consent for processing Personal Data
  • Right of deletion (Article 17): request deletion of Personal Data if it is no longer required in light of the purposes outlined in this policy or if the consent to process them is withdrawn
  • Right of limitation (Article 18): ask to limit the processing of Personal Data if and when: a) the Data Subject contests the accuracy of that data; b) the processing is illegitimate; or c) the data is no longer needed for the purposes listed but the Data Subject needs it to defend themselves in judicial proceedings
  • Right of portability (Article 20): receive the Personal Data in a structured, commonly used and machine-readable format and, where technically feasible, directly transmit that data to another organisation
  • Right to object to automated processing, including profiling (Article 21): object to be subject to the legal effects of automated processing or profiling.

To exercise one or more of the rights listed above, Data Subjects should send an email to privacy@stariongroup.eu.

The Data Protection Officer will promptly inform the Data Subject of having received this request. If the request proves valid, Starion will process it within 30 days of having received the request. If Data Subjects are unsatisfied with the response, they are free to file a complaint with the competent data protection authority.

Changes to the Candidate Notice

We reserve the right to change our Candidate Notice at any time. On this page you will always find the most recent version. If the new Candidate Notice affects the way in which we process data relating to you that has already been collected, we will notify you by email.

This Candidate Notice was last reviewed and updated in April 2024.

Country-specific variations to the Candidate Notice

Jurisdiction: Belgium

Country-specific legal requirement:

The Company is entitled to rely on ‘soft opt-in’ consent in respect of certain marketing messages that Starion wishes to send to website users. In all other e-marketing circumstances, active ‘opt-in’ consent is required by law and the Company is required to keep records of each specific consent provided by users.

Note: this section will be updated when local implementing law shall be finalised.