Grupo Norconsulting SL, (whose registered office is at, C/Donantes de Sangre 2,1B, 15004, La Coruña, Spain) („Norconsulting“, „we, us, our“) is a leader in the recruitment industry. Norconsulting acts as the data controller of personal information obtained about:

personnel of clients with a need for recruitment services;

candidates who are interested in job postings; and

other users of our website.

Norconsulting has a Data Protection Officer („DPO“), Mrs Haydee Soto, who can be contacted on dpo@gnorcon.com or in writing at C/Donantes de Sangre 2,1B, 15004, La Coruña, Spain. If you have any concerns or questions regarding the processing of your personal information please contact the DPO.

This Privacy Policy sets out how we use personal information about these individuals („you, your“). It explains:

What personal data is collected and processed?

How will your personal data be used?;

Who will have access to your personal data?;

Transferring your personal information;

Hyperlinks;

Data quality;

Data retention;

Security measures;

Your rights;

Contact details; and

Changes to this Policy.

What personal data is collected and processed?

Our main aim is to provide recruitment services to you and to facilitate a recruitment process. In order to do so, we collect the personal information mentioned in this section.

For users of “Catsone”, which may include personnel of clients with a need for recruitment services and candidates who are interested in job postings, the personal data (which means any information about a living individual whose identity is apparent or can be reasonably ascertained from such information, including when in combination with our sources of information) we collect may include the following:

Identity information – name, address, gender, personal contact details, and if provided by you, photographs, images and video;

Employment details – information you supply to us on your CV, job title, description of job role, work contact details, details of technical skills and work history, i.e. previous roles; and

Background information – professional membership details and interests and preferences in a professional/personal sense, which may be deduced from information provided by you.

If the provision of certain personal information is mandatory in order to process your requests and for us to provide a service to you, we shall mark such fields with an asterisk or an equivalent. Failure to provide such mandatory data may prevent us from providing all or part of the requested service.

We also collect information about how you browse our website using cookies and similar technologies. See our Cookie Policy for further information about how this works.

How will your personal data be used?

To be able to provide our products and services to you, your personal information may be retained, processed and disclosed by us for the following purposes:

Service Provision and Internal Processing Basis for Lawful Processing
To provide a service to you (e.g. to facilitate the recruitment process, by matching candidates‘ details to job opportunities), and to provide information on such services, including notifying you about changes to such services. Necessary for us to carry out our contract with you and Norconsulting‘ Legitimate Interests.
To allow details of candidates‘ skills and experience to be viewed by our clients whom we feel may be interested in engaging their services. Necessary for us to carry out our contract with you and Norconsulting‘ Legitimate Interests.
To carry out our obligations arising from any contracts entered into between you and us. Necessary for us to carry out our contract with you.
To confirm, update and improve our customer records to maintain an accurate and rich database. Norconsulting‘ Legitimate Interests.
To respond to any queries or complaints that you raise. Necessary for us to carry out our contract with you and Norconsulting‘ Legitimate Interests.
Management of Relationship Basis for Lawful Processing
To manage, analyse, understand and develop your relationship with us. Necessary to perform a contract and

Norconsulting‘ Legitimate Interests.

To keep you informed of any of our other/new services in connection with our existing relationship. Norconsulting‘ Legitimate Interests.
Where you have subscribed to receive job matches, your skills and interview request notifications. You will be able to unsubscribe from such notifications at any time. Necessary to perform a contract.
Direct Marketing Basis for Lawful Processing
To keep you informed of any of our other services and identify services that may be of interest to you, where these fall outside of our existing relationship and you have chosen to be made aware of this (see further section on Marketing below). This could include information about recently registered candidates / consultants, client workshops we are arranging, market updates, new software or training courses that may be of interest. Norconsulting‘ Legitimate Interests and your Consent.
To keep you updated about services provided by our third party business partners which are relevant to you. Your Consent.
Analytics and Statistics Basis for Lawful Processing
To review the service we provide or have provided to you and carry out analytics and report on engagement. Norconsulting‘ Legitimate Interests
Legal Obligations Basis for Lawful Processing
If we are obliged to disclose information by reason of any law, regulation or court order. Necessary for Compliance with a Legal Obligation.
Taking steps to enforce or defend any legal claims made by, against or otherwise involving you. This includes any associated investigations or discovery exercises. Necessary for Compliance with a Legal Obligation and Norconsulting‘ Legitimate Interests.
Other Basis for Lawful Processing
For any other purpose to which will be communicated to you.

Please note that we may carry out new processing activities. If the purpose of such new activities is not incompatible with the above, we may use your personal data for such purpose, but we shall inform you prior to further processing.

Norconsulting Legitimate Interests

The ‚legitimate interests‘ referred to above are:

the processing purposes described in the table above to the extent the processing is not necessary in order to: (i) enter into contracts with you and meet our obligations under such contracts; or (ii) comply with our legal obligations under the laws of the European Union and its Member States;

meeting and complying with our accountability requirements and legal obligations globally; and

exercising our fundamental rights and freedoms, including our freedom to conduct a business and right to property.

We may also process your personal data if this is necessary for the establishment, exercise or defence of legal claims.

Norconsulting does not use your personal information to make solely automated decisions which affect you legally or similarly.

Marketing

From time to time, where we have obtained your prior consent, we may send you information that we perceive may be of interest to you (including in relation to services of our partners, our subsidiaries and our affiliates). You may receive this information by SMS or email. If, at any time, you prefer not to receive further communications from us in any form (except in connection with information or services that you specifically request), you will have the ability to unsubscribe from such communications by means of a link provided in every e-mail or SMS that is sent to you by us or by contacting us dpo@gnorcon.com.

Who will have access to your personal data?

We share personal information with clients who we think may be interested in engaging your services, whether as an employee or otherwise. We do this in the course of providing our services to you.

In addition, from time to time, we may need to share personal data with third parties in order to provide as full a service as possible and support your recruitment needs. These may include:

our subsidiaries or affiliates for the purpose of managing and administering our business and to provide you with information which might be of interest to you;

entities who may or do acquire any rights in us – for the purpose of a business sale or re-organisation;

our advisors, which includes our accountants, auditors, lawyers, other professional advisors and business contacts – for the purpose of assisting us to better manage, support or develop our business and comply with our legal and regulatory obligations;

third party service providers – who need to know the information in order to provide us or you with services (including our third party service providers who process information on our behalf to help run some of our internal business operations, including email distribution, data storage, information technology and marketing services, customer services and data analytics); and

law enforcement and regulatory bodies – in order to comply with any legal obligation or court order.

Transferring your personal information

In some situations your personal information may be sent outside of Europe to countries whose laws do not protect personal information in line with European standards. The countries in question include: USA; Canada; Hong Kong; Singapore; Japan; India, Turkey; Africa and the United Arab Emirates. Different privacy laws may apply in these countries. We only make these arrangements or transfers where we are satisfied that adequate levels of protection are in place to protect any personal data held in that country or that the third party will act at all times in compliance with standards equivalent to applicable privacy laws.

Where personal data is transferred outside of the EEA, unless the recipient country is deemed to provide an adequate level of protection, we will put in place safeguards to ensure such adequacy. The safeguards we rely on in respect of international transfers include the following: data transfer agreements which incorporate the standard contractual clauses or, where appropriate, the EU – U.S. Privacy Shield. You can ask to see a copy of these documents using the contact details below.

Hyperlinks

Our website may contain links to other websites, which are outside of our control and are not covered by this Privacy Policy. If you access other sites using the links provided, the operators of these sites may collect information from you, which will be used by them in accordance with their privacy policy, which may differ from ours.

Data quality

We rely on you to ensure that your personal information is complete, accurate and current. Please do inform us promptly of any changes to or inaccuracies to your personal information using the contact details below. Candidates can also update their CV at any time using the Norconsulting Website. To log in use your username and password. If you do not currently have a username and password, please conta the DPO office dpo@gnorcon.com

Data retention

We hold your data with a view to providing future recruitment services to you and to manage our business relationship with you.

We retain personal data for varying time periods in order to assist us in complying with legal and regulatory obligations, to enable compliance with any requests made by regulators or other relevant authorities and agencies, to enable us to establish, exercise and defend legal rights and claims, and for other legitimate business reasons.

We retain your personal data for the period of time required for the purposes for which it was collected, any compatible purposes which we subsequently establish, any new purposes to which you subsequently consent, or to comply with legal, regulatory and policy requirements.

Security

We have appropriate technical and organisational security measures in place to ensure the security of your information and to protect it against deliberate or accidental manipulation, destruction, loss or unauthorised access. Despite our efforts regarding security it is important to bear in mind that the internet is not a secure means of communication. Personal information communicated through the internet may be intercepted by other people. We cannot guarantee the security of personal information sent to us through this website. By using this website and entering your personal data, you accept that you use this website at your own risk.

If you choose, or you are provided with, a user identification code, password or any other piece of information as part of our security procedures for one of the registration-only sections of the website, you are responsible for maintaining the confidentiality of your password and user name for the website and you are responsible for all activities that are carried out under them. We do not have the means to check the identities of people using the website and we will not be liable where your password or user name is used by someone else.

Your rights

Right to access, correct and delete your personal information

Norconsulting aims to ensure that all personal information is correct. You also have a responsibility to ensure that changes in personal circumstances (for example, change of address and bank accounts) are notified to us so that we can ensure that your data is up-to-date.

You have the right to request access to any of your personal information that the Company may hold, and to request correction of any inaccurate data relating to you. You furthermore have the right to request deletion of any irrelevant data we hold about you.

Additional rights

You also have the following additional rights:

Data portability – where we are relying upon your consent or the fact that the processing is necessary for the performance of a contract to which you are party as the legal basis for processing, and that personal information is processed by automatic means, you have the right to receive all such personal information which you have provided to Norconsulting in a structured, commonly used and machine-readable format, and also to require us to transmit it to another controller where this is technically feasible.

Right to restriction of processing – you have the right to restrict our processing of your personal information where:

you contest the accuracy of the personal information until we have taken sufficient steps to correct or verify its accuracy;

where the processing is unlawful but you do not want us to erase the data;

where we no longer need the personal information for the purposes of the processing, but you require it for the establishment, exercise or defence of legal claims; or

where you have objected to processing justified on legitimate interest grounds (see below) pending verification as to whether Norconsulting has compelling legitimate grounds to continue processing.

Where personal information is subjected to restriction in this way we will only process it with your consent or for the establishment, exercise or defence of legal claims.

Right to withdraw consent – where you have provided us with your consent to process data, you have the right to withdraw such consent at any time. You can do this by: (i) in some cases deleting the relevant data from the relevant HR system (although note that in this case it may remain in back-ups and linked systems until it is deleted in accordance with our data retention policy); or (ii) contacting your local Human Resources contact.

Right to object to processing justified on legitimate interest grounds – where we are relying upon legitimate interests to process data, you have the right to object to that processing. If you object, we must stop that processing unless we can either demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms or where we need to process the data for the establishment, exercise or defence of legal claims. Where we rely upon legitimate interests as a basis for processing we believe that we can demonstrate such compelling legitimate grounds, but we will consider each case on an individual basis.

You also have the right to lodge a complaint with a supervisory authority, in particular in your country of residence, if you consider that the processing of your personal information infringes applicable law.

Contact details

If you wish to exercise your rights or have any queries or requests about how we process your personal information, you can contact us at dpo@gnorcon.com.

If you are unhappy about how we use your personal information, we hope that in the first instance you will let us know. However, you can also contact our Data Protection Officer at dpo@gnorcon.com

You also have the right to lodge a complaint with your data protection regulator.

Changes to this Policy

Any changes we make to our Privacy Policy in future will be posted on this page. We encourage you to check the date of this Policy whenever you visit our website for any updates or changes.

This Policy was last updated on 25 May 2018.