Information on the processing and protection of personal data for job applicants in the VINCI Construction CS Group

Dear job seeker,

In connection with the personal data we have obtained from you in relation to the job position you have applied for at VINCI Construction CS Group, we provide you with the following information in accordance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as the "Regulation" or also as the "GDPR"):

1.a) Identity and contact details of the controller and its representative, if any:

The controller of your personal data for the purposes of recruitment as well as for other purposes under point 1.b) below is the company: VINCI Construction CS a.s., registration number: 140 80 672, registered office: U Michelského lesa 1581/2, Michle, 140 00 Prague, file number: B 27244, registered at the Municipal Court in Prague (hereinafter referred to as "VINCI Construction CS a.s.").

1.b) The purposes for which the personal data are processed and the legal basis for the processing:

The purpose of the processing of your personal data is:
i) the implementation, organization and evaluation of the selection procedure (recruitment of employee(s) according to the requirements and criteria set by the potential employer) for the requested position in the VINCI Construction CS Group, i.e. at VINCI Construction CS a.s, or one of its subsidiaries, and further,
ii) the performance of the rights and obligations related to the procedure prior to the possible establishment of an employment relationship with the employer, and
iii) the use for the purposes of any further selection procedures for other suitable positions for the applicant, and
iv) the maintenance of a database of job applicants,
v) the inclusion and maintenance in the records of the Applicant/Candidate Management System (ATS),
(vi) ensuring the operational activities of the controller,
(vii) protecting persons, property and health, including through the operation of CCTV recording systems,
(viii) checking the accuracy of data and checking public registers,
(ix) dealing with requests for information,
(x) complying with a public authority's request,
(xi) protecting the legitimate interests of the controller or a third party, and
(xii) carrying out measures taken prior to the conclusion of the contract/agreement at your request. 

The legal basis for the processing of the personal data provided by you is:
i) the implementation of the measures to be taken before the possible conclusion of an employment relationship on the basis of your request (job offer or inquiry) pursuant to Article 6(1)(b) of the Regulation, and
ii) the fulfilment of the legal obligation to which the controller is subject pursuant to Article 6(1)(c) of the Regulation, in particular Act No. 262/2006 Coll, Labour Code, as amended, and Act No 435/2004 Coll., Employment Act, as amended, and
(iii) the legitimate interest of the relevant controller pursuant to Article 6(1)(f) of the Regulation.

1.c) Legitimate interests of the controller or of a third party where the processing is based on Article 6(1)(f) of the Regulation:

The legitimate interest of the controller for processing for the purposes of points 1.b) (iii), (iv) and (v) is primarily to select the required skilled workforce, to remain competitive and save administrative costs, to protect the rights and other legitimate interests of the controller and for the administrative purposes of the controller.

1.d) Recipient or categories of recipients, if any, of the personal data:

The potential recipient of the personal data provided by you may be VINCI Construction CS a.s. or any of its subsidiaries within the VINCI Construction CS Group, which has access to the ATS system within the scope of the advertised positions. The potential recipient may also be any of the companies within the VINCI Group, of which the VINCI Construction CS Group is a part, as well as the relevant personal data processors. The potential recipients of personal data may also be the relevant employees of the above-mentioned companies in the HR department. The potential recipient of your personal data may also be public authorities (e.g. state authorities, e.g. ministries, courts, bailiffs, notaries, police, administrative authorities including, but not limited to, social security administration, labour authorities and labour inspectorate), contractors of the Administrator, such as providers of occupational health services, health insurance companies, insurance companies, etc... Public authorities that may obtain personal data in the context of a special investigation in accordance with Czech law are not considered recipients.

1.e) The categories of personal data concerned and the source from which the personal data originate:

The categories of personal data concerned include primarily those that we have obtained directly from you. In addition, the categories of personal data concerned also include data that we have obtained, for example, from employment or recruitment intermediaries, or from your previous employer, and, where appropriate, from social networks, public authorities or other publicly available sources. In addition, in the event that we have not obtained personal data directly from you, personal data comes in particular from the following sources:
i) public authorities,
ii) banks,
iii) insurance companies,
iv) publicly available sources, including public registers regulated by Act No. 304/2013 Coll., on public registers of legal and natural persons and on registration of trust funds, as amended,
v) e-mail and electronic communication,
vi) data messages, Internet network.

The category of personal data concerned includes, depending on the nature of the personal data obtained, in particular: name, surname, date of birth, permanent residence address, or correspondence address, signature, nationality, gender, e-mail, telephone number, ID card number, and possibly other personal data provided in your CV or cover letter.

1.f) The intention, if any, of the controller to transfer the personal data to a third country or an international organisation and the existence or non-existence of a Commission decision on adequate protection or, in cases of transfers referred to in Article 46 of the Regulation or Article 47 or Article 49(1), second subparagraph, of the Regulation, a reference to appropriate safeguards and means to obtain a copy of the data or information on where the data have been disclosed.

It is not the intention of the controller to transfer the personal data provided by you to a third country or an international organisation.

1.g) Method of updating personal data:

Your personal data is updated based on information received from you about changes to your contact details or requests from the controller to confirm the accuracy of your contact details or to correct them. Personal data is also updated as necessary on the basis of verifying the current status of your personal data in matters relating to the fulfilment of the purpose of processing your personal data pursuant to Article 1.c) of this information through public authorities or publicly available sources, etc.

We also provide you with the following information:

2.a) The period for which the personal data will be stored or, if this cannot be determined, the criteria used to determine this period;

The personal data will be stored for the duration of the selection procedure for the position you have applied for or another (suitable) position, for the period necessary for the purposes for which they are processed, or for the period for which you have given your consent to the processing of personal data or until its possible withdrawal, but no longer than 3 years. If an employment relationship is established on the basis of the result of a selection procedure, your personal data will be stored for at least the period of time stipulated by the relevant legislation (e.g. Act No. 582/1991 Coll., on the organisation and implementation of social security, as amended).

2.b) The existence of the right to request from the controller access to, rectification or erasure of, or restriction of processing of, personal data relating to the data subject and to object to processing, as well as the right to data portability;

In particular, as a data subject, you have the following rights:
a) to request access to your personal data from the controller pursuant to Article 15 of the Regulation; and
b) the right to rectification consisting in the correction of inaccurate personal data and/or the completion of incomplete personal data pursuant to Article 16 of the Regulation; and
c) the right to erasure of personal data concerning you as a data subject pursuant to Article 17 of the Regulation; and
d) the right to have the controller restrict processing pursuant to Article 18 of the Regulation.

You also have the right to object to the processing of your personal data under the conditions of Article 21 of the Regulation. You also have the right to the portability of your personal data under the terms of Article 20 of the Regulation.

You can exercise the above rights by writing to VINCI Construction CS a.s. at the address U Michelského lesa 1581, 140 00 Prague 4, or by e-mail to info@vinci-construction.cz.

All the information contained in this information document, as well as all communications and all actions pursuant to Articles 15 to 22 and 34 of the Regulation, as well as the exercise of individual rights and obligations, are provided to you by the controller free of charge. If your requests are manifestly unfounded or excessive, in particular because they are repetitive, the controller may either:
a) impose a reasonable fee taking into account the administrative costs involved in providing the requested information or communication or in carrying out the requested action; or
b) refuse to comply with the request.

The controller shall provide you, upon request pursuant to Articles 15 to 22 of the Regulation, with information on the measures taken, without undue delay and in any event within one month of receipt of the request. This period may be extended by a further two months if necessary and taking into account the complexity and number of requests.

We also inform you that, under the terms of Article 34 of the Regulation, if a breach of security of your personal data is likely to result in a high risk to the rights and freedoms of natural persons, the controller will notify you of the breach without undue delay.

2.c) Where the processing is based on Article 6(1)(a) or Article 9(2)(a) of the Regulation, the existence of the right to withdraw consent at any time, without prejudice to the lawfulness of processing based on consent given before its withdrawal;

The processing of your personal data is not based on Article 6(1)(a) or Article 9(2)(a) (consent to processing) of the Regulation.

2.d) Existence of the right to lodge a complaint with a supervisory authority;

You have the right to lodge a complaint with the supervisory authority, which is the Office for Personal Data Protection, ID No.: 70837627, located at Pplk. Sochor 27, 170 00 Prague 7. Authority website: www.uoou.cz.

2.e) Whether the provision of personal data is a legal or contractual requirement or a requirement to be included in a contract and whether the data subject is under an obligation to provide personal data and the possible consequences of not providing such data;

The personal data you provide is a legal requirement necessary for the exercise of your rights and obligations under the law to your potential employer. It is also necessary to include your personal data in any employment contract (or agreement to perform work, agreement to work) that establishes any employment relationship between you and your employer. If you did not provide your personal data, the purpose for which we process the personal data you provided could not be fulfilled, i.e. in particular you could not participate in the selection procedure as a job applicant and the employment relationship with you could not be established.  

2.f) Whether automated decision-making, including profiling, as referred to in Article 22(1) and (4) of the Regulation, takes place and, at least in these cases, meaningful information concerning the procedure used as well as the significance and foreseeable consequences of such processing for the data subject.

Neither the personal data provided by you nor you as a job applicant are subject to automated decision-making or profiling as referred to in Article 22(1) and (4) of the Regulation.

Prague, 24 June 2024