Recruitment privacy notice

Last revised: March 2021

1. An overview of data protection

The Luxembourg Institute of Science and Technology (hereafter “LIST”, “We”) is committed to ensure the highest standards of data protection in compliance with the applicable legislation, notably with reference to the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereafter “GDPR”).

The present document aims at illustrating what personal data we collect about you in the course of the recruitment process, the reason why LIST uses your data and, as the case may be, share your data and the applicable retention periods. Additionally, the notice also provides you with information regarding your rights, how to exercise them and whom you can contact in case of any query.

2. Scope of the notice

The present notice is directed to individuals that submit their job application at LIST (hereafter “Candidate”, “you”).

Please note that we have in place a separate Staff Privacy Notice that applies to the processing of personal data of current and former collaborators

3. Identity of the data controller

The data controller is LIST, having its registered office at 5, Avenue des Hauts-Fourneaux L-4362 Esch-sur-Alzette, Luxembourg.

LIST is responsible for collecting and processing your personal data in relation to your job application at LIST and the related recruitment process.

Our contact details are set out in Section 12 (“Your rights and how to exercise them”) below.

4. How your personal data is collected

LIST may collect your personal data either directly from you, when you submit your job application, or from third parties, such as a recruiter acting on your behalf in the context of the recruitment process or from a LIST’s employee referring you.

Further information about you may also be obtained in the course of the recruitment process (for instance, during job interviews). LIST may also collect information about you from publicly accessible sources (such as LinkedIn).

Please note that in case you provide us with the personal data of another person (such as referees), you are responsible for ensuring that this person is made aware of the content of this privacy notice and that the person has given you his/her consent for sharing his/her personal data with LIST. We will not contact your referees without your explicit consent.

5. Categories of personal data we collect

We collect personal data about you in the course of our recruitment activities.

Please find here below a detailed list of personal data we may collect and process. This may include but is not limited to:

Identification data (such as name, surname, date and place of birth, address, e-mail address, telephone number, nationality, gender),
Job application data (such as CV, cover letter, additional information regarding your professional qualifications, skills or abilities),
Employment history (such as current company/organisation, current role, past work experiences),
Education history (such as university degrees, academic records, professional licenses and certifications, memberships, awards),
Documents required under immigration laws (such as citizenship, passport or national ID, residency or work permit),
Professional preferences (such as salary expectations, job roles preferences, willingness to relocate and other information you decide to share with LIST in the course of the recruitment or placement process),
Results of personality and/or competences assessment. Such results will be always ultimately reviewed by our HR Department;
Technical data (such as IP address; your browser type and language; access logs),
Your image, as registered on our CCTV system upon attendance of an interview at our premises,
Extract of criminal records, that may be requested for certain roles and explicitly specified in the job opening. The document will be destroyed in accordance with the terms set by the Law of July 23 2016 modifying the Law of March 29 2013 on Organising Criminal Record Certificates, the Code of Criminal Procedure and the Criminal Code,
Any additional information you voluntary and unilaterally decide to share with LIST in the course of the recruitment or placement process (such as your picture, your hobbies, how you first learned about our job opening, reference letters).

As part of your job application documentation, LIST will not ask you to provide any special category of data (such as race or ethnicity, religious or philosophical belief, political opinions, trade union membership, sexual orientation, genetic data, health data). Please do not disclose this information with us.

In case of successful outcome of the recruitment process, the abovementioned categories of personal data will form part of your employment file with LIST. You will receive more information about how LIST collects and process the personal data of its collaborators through our Staff Privacy Notice.

6. Purpose and legal basis for processing

Please find here below a list of the purposes for which LIST collects and processes your personal data:

To communicate with you,
To carry out and manage our recruitment and selection activities (such as organizing the job interview, exchange of a potential job offer, discussion about pre-contractual measures prior to your employment),
To identify and evaluate candidates for potential job offers,
To assess your suitability for a position you applied for at LIST,
To inform you about other vacancies,
To document the recruitment process for record-keeping purposes,
To perform data analytics,
To populate LIST’s recruitment pool database,
To ensure the security of our premises and facilities,
To establish and/or defend our legal rights,
To perform reporting activity.

Please find here below a list of the legal basis on whose grounds LIST collects and processes your personal data:

Your consent, when explicitly requested. For instance, we shall require your consent after twelve (12) months from the date of your last contact with us, to allow you to choose between requesting the deletion of our your data or authorizing LIST to keep them for an additional period of twelve (12) months,
Performance of a contract or of pre-contractual measures in order to move forward in the recruitment process,
LIST’s legitimate interest.

7. Share of your personal data with third parties

In order to fulfil the purposes mentioned in Section 6 (“Purposes and legal basis for processing”), your personal data may be disclosed internally to our Human Resources Department and to other staff members who are involved in the recruitment process (such as interviewers or managers).

Additionally, LIST may transfer your personal data to:

External service providers that perform services on LIST behalf (such as recruitment agencies, online recruitment portals, IT consultants),
Government or other public bodies, upon request and to the extent permitted by law,
Certain regulated professionals such as auditors, accountants or lawyers.

Please be informed that LIST has implemented a recruitment software provided by Skeeled to manage our online job opening and the related applications. LIST has performed an in-depth due diligence on such provider to ensure that it meets our standards of security and compliance and has signed all the necessary contractual arrangements with it. To learn more about Skeeled’s privacy policy, we invite you to consult the following webpage: https://www.skeeled.com/privacy.

8. Use of algorithms

The recruitment software provided by Skeeled allows LIST to perform reviews of Candidates’ CV with the help of algorithms. These algorithms help us to prioritize the applications that best match the requirements included in the job opening.

However, we make sure that the results derived from this automated review are always complemented by the review of our HR Department and do not, in any case or situation, exclude such human intervention.

9. International transfers of personal data

In case of disclosure of your personal data to the subjects mentioned in section 7, LIST shall engage to take appropriate steps to ensure that third parties will apply adequate protection to this data as required by the applicable data protection legislation.

Some of the mentioned recipients of your personal data may be located in countries outside the European Union or the European Economic Area (EU/EEA). In such cases, transfers to a county outside EU/EEA may take place when the European Commission has decided that the third country ensures an adequate level of protection.

In the absence of this adequacy decision, LIST will only proceed to such transfer after having implemented appropriate safeguards to protect your personal data (such as the use of standard contractual clauses adopted by the European Commission) or where a derogation established by art. 49 of the GDPR exists (such as your explicit and informed consent).

Further information about the mentioned transfers and the safeguard measures applied by LIST can be obtained by contacting us at dpo@list.lu

11. Data retention periods

In case of unsuccessful job application, your personal data will be retained by LIST for an initial period of 12 months from the date of the closing of the recruitment process, on the basis of our legitimate interests consisting in the establishment and defence of our legal rights.

At the end of the said 12 months, you will receive an automatic message, giving you the option to ask for your data to be deleted or to confirm your consent for an additional storage of your data for 12 months. After this prolongation, your data will be permanently deleted from our systems.

In case of successful outcome of the recruitment process, your personal data will form part of your employment file with LIST. Therefore, different retention periods will apply. You will receive more information about how LIST collects and process the personal data of its employees through our internal Staff Privacy Notice.

12. Your rights and how to exercise them

With regards to your personal data collected and processed by LIST, you may exercise at any time the following rights:

Right to access: You have the right to receive confirmation about whether or not your personal data is being processed by LIST. If that is the case, you have the right to know what data is being collected and processed and to obtain of copy of it;
Right to rectification: If the personal data we hold about you is inaccurate or incomplete, you have the right to request to have it rectified;
Right to erasure: Subject to certain conditions specified in art. 17 of the GDPR, you have the right to have your personal data deleted by LIST;
Right to restriction of processing: Subject to certain conditions specified in art. 18 of the GDPR, you have the right to obtain restriction of the processing of your personal data performed by LIST;
Right to data portability: Subject to certain conditions specified in art. 20 of the GDPR, you have the right to obtain a copy of the personal data you provided to LIST in in a structured, commonly used and machine-readable format and to request the transfer of these data to another data controller;
Right to object: you have the right to object the processing of your personal data when the conditions set out in art. 21 of the GDPR apply;
Right to withdraw consent: If LIST is processing your personal data based on your consent, you have the right to withdraw that consent at any time. The withdrawal of such consent shall not affect the lawfulness of processing based on consent before its withdrawal.
Right to lodge a complaint with a supervisory authority: You have the right to lodge a complaint with the Commission Nationale pour la Protection des Données (CNPD). More information on how to lodge a complaint are available on CNPD’s website: https://cnpd.public.lu.

You may exercise any of these rights by contacting our Data Protection Officer (DPO):

by email at the following address: dpo@list.lu,
or by post at:
Luxembourg Institute of Science and Technology
Attn. Data Protection Officer
5, Avenue des Hauts-Fourneaux
L-4362 Esch-sur-Alzette, Luxembourg.

13. Links to other websites

Please be aware that our website may contain links to other websites, that are not governed by this privacy notice. We encourage users to review the privacy notice of each website before disclosing any personal data.

14. Changes to this notice

LIST may make changes to this privacy notice from time to time, to reflect our current privacy practices or to comply with changes in the applicable data protection legislation. LIST encourages you to regularly visit this page in order to remain informed on how LIST collects and processes personal data.