Privacy Notice to Job Applicants and Employees
Version 1/2018 (only for EU based members of Mirantis Group)
This Privacy Notice to Job Applicants and Employees („Privacy Notice“) describes how personal data of job applicants and employees are handled when they are processed by a member of Mirantis Group residing in the territory of European Union to ensure the compliance with EU data protection legislation. Mirantis Group in this document refers to Mirantis, Inc., a Delaware corporation, with offices at 900 E. Hamilton Avenue, Suite 650, Campbell, CA 95008, USA and any entity that is (directly or indirectly) owned or controlled by Mirantis, Inc.
A. Processing of Personal Data in Recruitment Process
The personal data and documents that a member of Mirantis Group receives or otherwise collects in context of recruitment process shall be processed as follows:
1. Data Controller. The primary data controller of your personal data shall be always the EU based legal entity from Mirantis Group identified in the description of the job position to which you replied or which is otherwise identified as your potential future employer (the legal name and contact details are usually contained in such description). The primary data controller is hereinafter referred to as “Mirantis” or “we”. Furthermore, by submitting your personal data to Mirantis, you agree that also other members of Mirantis Group might become secondary data controllers based on their engagement in the recruitment process. More information about sharing the personal data within Mirantis Group and processing by other members of Mirantis Group is contained in the Chapter C. Further Information about Processing of this Privacy Notice.
2. Categories of Personal Data. We usually process the following categories of personal data about our job applicants:
- Full name, contact details, location;
- All personal data contained in your CV, such as information about your education, employment history, date of birth, photo, skills and anything else mentioned in your CV;
- All personal data contained in further documents that you send us for purpose of recruitment process such as resume, cover letter or other similar documents;
- Further personal data that you provide about yourself within the interview process either orally or in written (such as employment references, compensation information etc.) or that we subsequently collect to verify your background.
3. Purposes of Processing. We use the data obtained in the recruitment process for purpose of communication with you, evaluation of your eligibility for employment with Mirantis and selection of the best candidate, including reasonable evaluation of provided information and background check. We might also use your personal data to offer you a different position than for which you applied if we think that you could be the best candidate for such position.
4. Basis for processing. Whenever we process the personal data collected from you, our legal basis for this is your consent provided either directly or indirectly expressed by submission of your personal data. You can always withdraw from this consent by delivery of your written withdrawal to us but after this withdrawal we will not be able to consider you further as a potential candidate for employment with Mirantis. For other data that we can collect about you, our legal basis is our legitimate interest such as verification of the information provided by you.
5. Storage of Personal Data. We will store your personal data for the whole period of recruitment process for the position in connection with we received your personal data. If you are not selected, the personal data about you will be deleted from our systems within a reasonable period of time necessary to protect our legitimate interests, unless you expressly agree with processing for longer period of time.
6. Consequences of Not Providing the Data. The provision of personal data within the recruitment process is not required by statutory or contractual requirement. However, we need this information to find the best candidate and therefore refusal to provide us with these data or documents will negatively affect our ability to consider you as our potential employee.
B. Processing of Personal Data of Employees
When you become an employee of a member of Mirantis Group, we will process your data in accordance with the following principles:
7. Data Controller. The primary data controller of your personal data shall be always the EU based legal entity from Mirantis Group with which you have entered into the employment relationship (for legal name and contact details, see your employment contract). The primary data controller is hereinafter referred to as “Mirantis” or “we”. Your personal data might be shared further within Mirantis Group as stated in this Privacy Notice and also other members of Mirantis Group might become secondary data controllers based on their legitimate interest (or your consent, if applicable). More information about sharing the personal data within Mirantis Group and processing by other members of Mirantis Group is contained in the Chapter C. Further Information about Processing of this Privacy Notice.
8. Categories of Processed Personal Data. We usually process the following categories of personal data about our employees (may vary in different locations):
- Full name, permanent and temporary address, birth date, gender, nationality;
- Contact and emergency contact details;
- Information about your ID card or passport;
- Information needed for payroll, benefits and expenses purposes (such as salary, bank account number), entitlement for annual or other leave, sickness and other absence;
- Marital status and dependants;
- National Insurance number, information about insurance company;
- Information about other employment relationship;
- Your employment contract, any information specified therein and any amendments to it (such as full name, address, date of birth, citizenship);
- All personal data from correspondence with or about you, for example documents provided within the recruitment process, letters to you about a pay rise or, at your request, a letter to your mortgage company confirming your salary;
- Information about your position such as job title, employee number;
- Records relating to your career history with Mirantis, such as training records, appraisals, other performance measures and, where appropriate, disciplinary and grievance records;
- Your photo, scan of your documents or other personal data about you if you provide them to us
- other personal data as might be required based on local laws.
9. Personal Data of Foreign Employees. If we employed you as a foreign employee, we are usually required by law to process additional categories of personal data about you (again may vary for each state) such as information about work permit and residence permit or other documents required by law related to your status of foreign employee.
10. Processing of Information Related to Health. Where necessary, we may keep information relating to your health, which could include reasons for absence. This information will be used in order to comply with our health and safety and occupational health obligations – to consider how your health affects your ability to do your job and whether any adjustments to your job might be appropriate. We will also need this data to administer and manage statutory and company sick pay.
11. Purposes of Processing. We use the above mentioned personal data of our employees in order to perform our obligations under the employment contract with you or under the applicable laws, or for legitimate interest of us or another entity from Mirantis Group such as management, planning of our activities, internal cooperation and collaboration, equality and diversity in the workplace, protection of our property and other legitimate interest that might arise in the future. We will keep and use it to enable us to run the business and manage our relationship with you effectively, lawfully and appropriately, whilst you are working for us, at the time when your employment ends and after you have left.
12. Basis for processing. The most of categories of personal data that we process about our employees are processed to comply with our legal obligations under labor laws or to perform our obligations towards you arising from the employment contract. We may process your personal data also under a different legal basis such as:
- Processing Based on Your Consent. Whenever you decide to upload into internal systems used by Mirantis Group (such as intranet, tools for internal communication etc.) any additional information about your person that are not required by us on mandatory basis (such as your photo, home contact details, copy of passport) or provide us with such information to be uploaded, you express your consent with processing of this personal data in all systems used by Mirantis until you decide to delete such personal data. You expressly agree that such data might be made available and processed by third parties for purpose consistent with the purpose for which you provided such personal data to us.
- Processing necessary for purposes of legitimate interest of us or a Third Party. You will, of course, inevitably be referred to in many company documents and records that are produced by you and your colleagues from Mirantis Group in course of carrying out your duties and the business of the company. The personal data that are necessary to perform your job duties such as name, contact details, information about your position and location of your office might be shared with other members of Mirantis Group and with third parties on our websites or intranet for these purposes. In each such case, we or other member of Mirantis Group will process your personal data in accordance with the legitimate interest such as internal cooperation or communication, presentation or performance of service to customers, coordination of group activities. For these purposes, only limited scope of your personal data will be processed in a manner that is not overridden by your interests or fundamental rights and freedoms.
13. Storage of Personal Data. We will store your personal data for the whole time of your employment contract with Mirantis. After your employment contract is terminated, we will delete your personal data that we cannot process anymore as reasonably possible (usually within 60 days from the end of employment relationship), but please be aware that we will continue processing of your personal data necessary for compliance with our legal obligations under the applicable law or in order to safeguard a legitimate interest of Mirantis as long as this legal obligation or the legitimate interest exist.
C. Further Information about Processing
Whenever we process your personal data for purpose of recruitment process or your employment, you should be informed about the following aspects of the processing:
14. Categories of Recipients of the Personal Data. Even though we act as a data controller, your personal data may disclose also to third parties in compliance with applicable laws.
- Sharing and Processing within Mirantis Group. Mirantis Group has its headquarters in the United States and due to its global activities also employees from other offices might be involved in our recruitment process or the processing of personal data of other employees. Your personal data might be therefore disclosed to other members of Mirantis Group, residing either in EEA countries or outside EEA. The information about countries, where Mirantis Group has its companies is available at www.mirantis.com.
In course of our operations, the following companies from Mirantis Group might become the secondary data controller or a joint controller of your personal data:
- Mirantis, Inc., a Delaware corporation, with offices at 900 E. Hamilton Avenue, Suite 650, Campbell, CA 95008, USA
- Mirantis IT OOO (Russia), a corporation organized under the laws of the Russian Federation D. 9 Str. 9 Komnata 32, Ul.Malaya Semenovskaya Moscow, 107023, Russian Federation, or
- Palomar Systems (Ukraine) a corporation organized under the laws of Ukraine, with its principal place of business at 38 Nauki prospect, apt. 514, Kharkov, 61166, Ukraine.
- Service Providers. For certain limited scope of activities, including payroll services, storage and sharing information within the Mirantis Group in IT systems or internal communication and collaboration, Mirantis uses third party providers with whom your personal data might be shared.
- Other types of recipients. In very specific case, your personal data might be shared with other recipients such as third parties engaged in process of reorganization, merger, sale, joint venture, transfer or other disposition of Mirantis’ business, legal or other advisors or state or government authorities as required by law.
15. Transfer to Third Countries and Information about Adequacy Decision. Where your personal data are transferred during its processing to third countries outside European Economic Area (EEA) that are not subject to adequacy decision made by the EU Commission, we are obliged to ensure the adequate level of protection by other approved legal instruments. These instruments usually comprise either conclusion of the EU Standard Contractual Clauses with the third party, registration of recipient in the EU-U.S. Privacy Shield framework or existence of approved Binding Corporate Rules of the recipient. Further information about these legal instruments be might obtained on the email address listed below.
16. Information About Your Rights. Under the EU General Data Protection Regulation (GDPR) and local law applicable to us you have a number of rights with regard to your personal data. You have the right to request from us access to and rectification or erasure of your personal data, the right to restrict processing, object to processing as well as in certain circumstances the right to data portability. If you have provided consent for the processing of your data you have the right to withdraw that consent at any time which will not affect the lawfulness of the processing before your consent was withdrawn.
17. Right to Lodge Complaint. You have the right to lodge a complaint to the supervisory authority established by the local law if you believe that we have not complied with the requirements of the EU personal data protection legislation with regards to your personal data.