This Privacy Policy sets out the rights and obligations of Applicants, Employers and Referees with respect to CVs submitted to and processed via Xablu, operated by Xablu.

By submitting information to Xablu or otherwise using Xablu, the Applicants, Employers and Referees agree to comply with the terms and conditions set out in this Privacy Policy and agree to the processing of their personal data by Xablu as set out in this Privacy Policy. This Privacy Policy constitutes the agreement between Xablu and the Applicant, Employer or Referee.

At Xablu, we think your privacy is important!

Within our organization Xablu, we deal with the personal data collected in a secure and confidential manner. This Privacy Policy describes which personal data we process from you, on which basis we process it and why we process it.

Finally, we inform you about the security measures we take to protect your personal data.

1. DEFINITIONS

In this Privacy Policy, the following terms have the meanings as set out below:

·        Account: an Applicant’s personal account or an Employer’s company account on Xablu;

·        Applicant: a natural person whose CV is submitted to Xablu either by the Applicant himself or by an Employer;

·        Basic CV: the Applicant’s CV, as submitted to Xablu by the Applicant and possibly amended afterwards, and as structured by the Xablu system;

·        Controllers: decide the purpose of processing personal data (e.g. for an open position) and the means to do that. Controllers could be employers or recruitment agencies;

·        CV: the curriculum vitae of an Applicant, as available on the Xablu website. A CV may, inter alia, include the Applicant’s personal information and information relating to the Applicant’s education, work and competencies, as well as any documentation and information supporting the content of the curriculum vitae. A CV can either be a Basic CV or an Enriched CV;

·        Data subjects: would mean candidates in general;

·        Employer: any natural person or legal person which is subscribed to Xablu for the purposes of screening CVs of employees and/or possible future employees. Employers also have an Account on the Xablu website;

·        Enriched CV: a version of the Basic CV that is verified by Xablu (whether or not via Referees), enriched by Xablu with external data, and/or completed pursuant to On Demand Services (as applicable);

·        GDPR: General Data Protection Regulation;

·        Law: Directive 95/46/EC and/or any national laws implementing this Directive, such as the Belgian Data Protection Act of 8 December 1992. The General Data Protection Regulation (GDPR) was adopted in April 2016 to reinforce data protection laws for all citizens within the European Union (EU). Coming into effect on 25th May 2018, the GDPR will impact all businesses working with personal data from the EU;

·        Means of Access: the username and password required for an Applicant to access his Account, or required for an Employer to use Xablu;

·        On Demand Services: services provided by Xablu to an Employer or an Applicant with respect to a specific CV, including (but not limited to) language tests and competency tests;

·        Personal data: The General Data Protection Regulation defines a personal data as follows: all information about an identified or identifiable natural person; an identifiable natural person who can be identified directly or indirectly, in particular by means of an identifier such as a name, an identification number, location data, an online identifier or one or more elements characteristic of the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person. If this Privacy Policy refers to personal data, reference is made to this definition from the Regulation;

·        Processing: would mean any actions performed on personal data, such as collecting, recording, organizing, storing, using, and erasing;

·        Processors: would be applicant tracking systems or any legal bodies that process personal data on behalf of a controller;

·        Recruitment agency: any natural person or legal person which is subscribed to Xablu for the purposes of finding, screening CVs, evaluating, and present the right candidates for their customers. Recruitment agency also have an Account on the Xablu website;

·        Referee: any natural person confirming an Applicant’s claims on his CV, and providing input with respect to the Applicant’s competencies upon Xablu’s request;

·        Xablu:

·        Xablu BV, with registered offices at Industrieplein 2, 7553 LL  Hengelo, The Netherlands, registered with the Dutch Chamber of Commerce under company number 64053407;

·        the CV processing service and system operated by Xablu, available through www.xablu.com.

 

2. DATA COLLECTED BY XABLU

Through Xablu, Xablu collects :

Candidate personal data :

·        Academic Curriculum

·        Personal details

·        Personal identification data

·        Electronic identification data

·        Internal data – Other

·        Internal data – Link / Id

·        Evaluation

·        Professional experience

·        Professional qualifications

·        Recruitment

·        Use of the media

Others non-personal data :

·        Data contained in the Account of the Applicants and Employer in particular the Means of Access;

·        Browser data: standard information that a web browser sends to every website visited (such as the IP address, browser type and language, access times and referring website addresses);

·        The purchase and use of credits;

·        Cookies: small bits of information that are stored by the browser on your computer. These cookies are used to store preferences and various other bits of information about users of the Website. Although you can turn off the use of cookies in your browser, this may make the Website unusable. Please see our “Cookie Policy” for further information on the way we use cookies on the Website.

 

As a data controller, you will need the consent of the applicants to

·        get their personal data (for you as a controller)

·        process this data for recruitment purposes (for the processor acting on your behalf).

3. BASIC CV

CVs are submitted to Xablu by the Applicant, possibly based on a form that was partially pre-filled by the Employer. Following the submission of a CV, Xablu will create an Account for the Applicant, or update Applicant’s existing Account, and create or update the Basic CV.

In case the CV was partially pre-filled by an Employer, Xablu will invite the Applicant to further complete his CV and to upload any relevant supporting documentation (such as certificates), and to confirm the processing of his CV in accordance with this Privacy Policy.

Through his Account, an Applicant may at all times access and update his Basic CV.

Once submitted to Xablu (either by the Applicant or by an Employer), Xablu becomes the “data controller” (as defined by applicable Law) of the CV, and will have the right to process this CV for its own purposes, in accordance with this Privacy Policy, both during and after the license period of the Employer.

4. ENRICHED CV

Upon an Employer’s request, Xablu may enrich Basic CVs via:

·        Referees, which will confirm the Applicant’s claims on his Basic CV and/or provide input with respect to the Applicant’s competencies;

·        On Demand Services, such as language tests, assessments or training sessions. These On Demand Services can also be independently requested by the Applicant; and/or

·        Xablu’s own insights, such as the quality of education or career progression.

·        The Applicant explicitly acknowledges and accepts that Xablu has the right to contact Referees in the Applicant’s name by e-mail or phone, in order to invite them to provide input with respect to the Applicant’s competencies.

For reasons of objectivity, an Applicant will not be able to fully access his Enriched CV via his Account.

The Referee feedback that is used for an Enriched CV shall be made available on a strictly anonymous basis, i.e. the identity of a Referee shall never be disclosed to any Applicant or Employer, although the textual comments made by the Referee may be made visible to Employers Furthermore, the Applicant shall only see partial feedback from the Referees, and always in aggregated form.

The feedback provided by Referees shall be considered final, and cannot be changed by the Applicant for reasons of objectivity.

5. ROLE OF XABLU AND EMPLOYERS

Applicants should be aware that both Xablu and Employers use the CVs for their own purposes and in different contexts, as further described in this section 5.

5.1 Employers

Employers can freely access the full content of CVs from Applicants whom they invited to submit their CV to Xablu. After payment, Employers can also obtain full access to CVs from other Applicants.

Employers may use the CVs via the Xablu platform for various purposes, namely: soliciting their employment, comparing CVs by possible use of filtering and sorting mechanism, conducting online direct marketing campaigns by using the tools offered by Xablu and enriching Basic CVs (as described in section 4).

In this context, Employers act as a “data controller” (as defined by applicable Law) with respect to any CVs they access, use or process in any other way via Xablu. Any such processing is performed for the Employer’s own purposes, and the Employers are solely responsible for complying with applicable Law in this regard (including with respect to its obligation to inform Applicants and to provide Applicants with a right to access and rectification).

In case an Applicant is of the opinion that an Employer incorrectly uses his CV, the Applicant must contact the Employer. Accordingly, any claim relating to an Employer’s use of a CV must be directed to such Employer.

5.2 Xablu

Xablu has different roles in the context of CVs:

·        Xablu acts as a “data processor” (as defined by applicable Law) when it enriches a Basic CV at the request of a particular Employer, or when it filters and sorts CV-related data at the request of an Employer. If an Applicant questions such processing performed by Xablu at the request of a specific Employer, the Applicant must contact the Employer.

·        After and outside this enrichment context, Xablu acts as a “data controller” when it operates the Xablu platform (e.g., to store CVs and to make CVs available to various Employers).

6. PURPOSE OF THE PROCESSING

Xablu may process CVs, Referee feedback and Employer information for the following purposes:

·        ensuring the correct functioning of the Xablu service;

·        ensuring payment for the Xablu service;

·        display of personalised advertisements on the Website;

·        investigating and developing new functionality of the Xablu service;

·        market intelligence (e.g. to calculate average employment durations in certain industries);

The CV of an Applicant who entered Xablu in response to a specific job offer from an Employer using Xablu will, however, be automatically visible to that Employer at any time and as long as the Applicant authorizes it. When the CV of a candidate is no longer visible to an employer, the applicant can no longer receive job offers from the same employer but can still receive offers from other employers for whom the CV is still visible.

The Applicant must be aware that Xablu can not prevent an Employer with access to his CV via Xablu, can also (partially) copy this CV into his own HR system. Xablu has no control over such use of a resume.

While CVs shall not be shared with or disclosed to third parties other than Employers and Referees, Xablu may provide third parties with statistical information about the CVs in its database. As the information will be presented in aggregated, statistical form, these third parties will not be able to deduct any personal information about particular Employers, Applicants or Referees.

Xablu will from time to time use an Applicant’s or an Employer’s email address to send newsletters or other emails with relevant commercial information about Xablu, its affiliates or other parties that may be of interest to an Applicant or an Employer. Xablu shall never share email addresses with any party other than its own affiliates. Information with regard to ensuring payment for the Xablu service may be shared with third party service providers (and their own contractual parties) who will process this data solely to perform payment transaction services; this data could be transferred to countries outside of the European Union to which you consent.

 

Xablu shall process the Means of Access solely for the purposes of enabling Applicants and Employers to use Xablu.

7. WHAT ARE THE RIGHTS OF THE APPLICANT?

No more personal data exchanged in their backs. Candidates will have a say in what happens to their data.

7.1) Right of access and inspection He has the right to receive free access to his personal data at any time, as well as the use we make of his personal data in accordance with the provisions applicable in the sector.

7.2) Right of improvement, deletion and limitation He is free to share his personal information with Xablu and the employers. In addition, he always has the right to correct, supplement or delete his personal data yourself. Thanks to his Xablu account, he has access to his personal data recorded about him. He may modify his personal data himself at any time, for example by making changes to his CV;

7.3) Right of opposition He also has the right to oppose the processing of his personal data for serious and legitimate reasons.

7.4) Data transfer right He has the right to obtain his personal data that he has provided us in a structured, standard and machine readable form and / or to transfer them to other responsible parties in accordance with the provisions in force in the sector.

7.5) Right of withdrawal of consent To the extent that the treatment is based on his prior consent, he has the right to withdraw that authorization.

7.6) Automatic decisions and profiling The processing of his personal data does not include any profiling and he will not be subject to automated decisions on our part either.

7.7) Exercising one’s rights He can exercise his rights by sending an e-mail to hello@xablu.com

7.8) Complaints He has the right to file a complaint with the Belgian Commission for the Protection of Privacy: Commission for the Protection of Privacy.

8. VISIBILITY OF AN ACCOUNT

Through his Account, an Applicant can at any time control whether Employers are able to view the content of the CV.

The Applicant can choose to make his CV visible (hereinafter referred to as “Visible”) to Employers. This means that interested Employers will be able:

·        to see the CV of the Applicant.

·        to add the CV of the Applicant to their recruitment pool.

·        to contact the Applicant.

The CV of a Candidate who has entered Xablu in response to a specific job offer from an Employer using Xablu will however be automatically Visible to that employer at any time and for as long as the Talent has decided.

When the CV of a candidate is no longer visible to an employer, the applicant can no longer receive job offers from the same employer but can still receive offers from other employers for whom the CV is still visible .

The Applicant should be aware that Xablu cannot prevent that an Employer who has access to his/her CV through Xablu, may also (partially) copy this CV in its own HR system. Xablu has no control over such use of a CV.

9. ACCOUNT DELETION

Xablu shall store all account data until the Account is deleted in accordance with this section 9.

Xablu can delete an Account at any time if the CV of an Account is not in accordance with the Applicant Terms of Use.

The Applicant can delete himself his Account from Xablu. The Account will then be instantely and permanently deleted from Xablu and all related employers. However, Xablu cannot prevent Employers that previously gained access to the Applicant’s CV, to have stored a (partial) copy of the CV.

If an account is not used for a period of six months, Xablu will send a reminder every month for 3 months to check if the applicant wishes to keep his account active. If the applicant does not respond after nine months, the applicant’s account will be automatically deactivated.

And finally, at the end of the twelfth month, without the plaintiff’s reaction always, this same account will be permanently and automatically removed from Xablu and all related employers. This means for the related employers that only the data enriched by the CV will still be visible via the activity log, but all the content of the basic CV will be deleted.

If an account is deleted, employers with access to the CV of this account will be notified.

10. SECURITY AND CONFIDENTIALITY

We have developed technical and organizational security measures to prevent the destruction, loss, falsification, alteration, unauthorized access or misrepresentation to third parties of personal data collected as well as any other unauthorized processing of these data.

10.1 Technical measures

·        Using virus scans

·        Controlling traffic through a firewall

·        Access to data via VPN

·        Redundancy of production servers

·        Secure hard drives

·        Secure and multiple backups

10.2 Organizational measures

·        Restricting and controlling access to servers and data

·        Incident Management Procedure

·        Privacy Policy for Employees

·        Employee training in security

·        Confidentiality clauses

·        Incident and data breach management

With regard to the different subcontractors with which Xablu collaborates, they all comply with the GDPR. If you would like to know the different subcontractors with which Xablu works to check compliance with the GDPR, all you have to do is make an explicit request to Xablu.

Finally, the servers on which the data are stored are located within the European borders.

11. CONTACT

Applicant has the right, free of charge, to gain insight into the content and correctness of his CV (and, where relevant, to correct any incorrect personal data). Xablu shall grant such insight upon receipt of a postal letter at Xablu BV, Industrieplein 2, 7553 LL  Hengelo, The Netherlands, mentioning Applicant’s Means of Access.

Referees and Employers also have the right, free of charge, to gain insight into their own personal data being processed by Xablu (and, where relevant, to correct any incorrect personal data). Xablu shall grant such insight upon receipt of a postal letter at Xablu BV, Industrieplein 2, 7553 LL  Hengelo, The Netherlands, mentioning all relevant identification details.