Politique globale de confidentialité pour les candidats

Capitalised terms not otherwise defined in this Notice have the following meanings: 

Personal Data means any information relating to an identified or identifiable living individual. 

Sensitive Personal Data means any information relating to an individual’s racial or ethnic origin, political opinions, religious or other beliefs, trade union membership, criminal records/history or processing of genetic data or biometric data, data concerning health or data concerning a natural person's sex life or sexual orientation. Depending on the country you are based sensitive personal data may also refer to personal information that, once leaked or illegally used, may cause harm to natural persons, including but not limited to information on specially designated status, financial accounts, individual location tracking, as well as the personal information of minors or information on social security, driver’s license, state identification, and passport numbers, precise geolocation, combination of email address, debit card, or credit card with security or access code, password, or other credentials allowing access to financial account. 

Processing means the use of personal data including collection, recording, organization, structuring, adaptation or alteration, analysis, retrieval, consultation, providing or blocking access (including remote access) to, disclosure, dissemination, aligning, copying, transfer, storage, deletion, hosting, combination, destruction, disposal, or other use or handling of personal data. 

Data Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.  

Job Candidate means an individual who have applied to be full or part-time employee of Aesop Group of Companies, including apprentices, student trainees, interns and trainees, and temporary workers (also referred to as “you”). 

Third Party means any natural person or legal entity, public authority, agency or any other body other than Data Subject, Data Controller, any vendor, supplier or service provider who solely or jointly process personal data on behalf of the Data Controller and acts on the Data Controller’s instructions. 

Data Subject means the identified or identifiable living individual to whom the Personal Data relates. 

Aesop Group of Companies means all other Aesop entities globally.  

We collect, store, and process your Personal Data in a number of ways, including when:   

• You disclose to us such Data in the context of your application, including applications sent by job application platforms; 

• We obtain such Data from recruitment agencies with which we engage; 

• We obtain such Data through publicly accessible, professionally used and lawfully obtained social media for maintaining existing and making new business contacts. 

In certain cases, we may also receive relevant Personal Data from risk management service providers which support us, to the extent necessary and legally permitted, in carrying out a pre-employment compliance check of your suitability for the desired position.  

 Please note that you are neither under any contractual nor legal obligation to provide us with your data. However, we may not be able to fully process your application if you do not provide the data necessary to process your application.  Recruitment of job candidates: we collect and process any Personal Data that you have published via job application platforms or publicly accessible and professionally used social media platforms, in order to contact you with regard to suitable job vacancies or upcoming opportunities. The legal basis for processing your Personal Data in this regard depends on the country you are based. Usually, it will be the necessity of the processing to safeguard our legitimate interest (where applicable and depending on the country you are based) in recruiting suitable job applicants for our company and making them aware of suitable roles, or otherwise as permitted by law.  During your job application: we process your Personal Data in the context of your application only to the extent necessary for the processing of your application (including if applicable performing pre-employment compliance checks) and for the decision on establishing an employment relationship with you. The legal bases for processing your Personal Data in such context will depend on the country you are based. Usually, it will be: 

• The necessity of the processing for the decision on establishing an employment relationship with you, as well as to implement an employment relationship, where applicable; 

• To comply with statutory and/or regulatory requirements and obligations, such as equality and immigration legislation;  

• If necessary for pre-employment compliance checks, we may ask for your prior consent before processing your Personal Data, depending on the country you are based. You are free to refuse giving consent without any effect on your application process. If necessary, we may ask you in this case for further evidence enabling us to perform a full pre-employment compliance check. 

If an employment relationship is established with you: we will include your relevant Personal Data obtained during your job application process in our personnel database and process it in accordance with our internal Global Privacy Notice for Employees, which will be shared with you during the onboarding process.  If no employment relationship is established: we will store your Personal Data for a period of up to 24 months after the application process. The legal basis for storing the Personal Data will depend on the country you are based. Usually, it will be the necessity of the processing to protect our legitimate interests (where applicable and depending on the country you are based) in the establishment, exercise or defense of legal claim, or as otherwise permitted by law.   If we have received your application via a recruitment agency: we may further store limited Personal Data (in particular your name, the channel via which we received your application and the date of your application) for an additional 18 months (24 months in total after the end of the application process), to the extent necessary to be able to meet our contractual obligations to pay a recruitment fee to the recruitment agency in the event of a possible reapplication and recruitment of you within 24 months of your first application. The legal basis for storing the Personal Data will depend on the country you are based. Usually, it will be the necessity of the processing to protect our legitimate interests (where applicable and depending on the country you are based) in fulfilling our contractual obligations to recruitment agencies, or as otherwise permitted by law.  We may also contact you to ask if you would like to have your Personal Data recorded in a job applicant pool, always at your express consent, so that we can contact you again when filling any future vacancies aligned to your experience.  In this case, we will store your Personal Data in the job applicant pool in accordance with our retention periods determined as per the legal requirements in the country you are based.   Where you are asked to provide Personal Data for the purpose of monitoring equal opportunities (including Sensitive Personal Data), this will be voluntary and on the basis of your consent, unless a legal requirement to which we are subject requires us to collect this data. 

We store your Personal Data for the purposes stated in this Notice. To the extent storage of your Personal Data is no longer necessary for these purposes, your data will be deleted, unless your data is required for other purposes set out in this Privacy Notice, or further storage is mandatory by applicable laws and/or necessary to fulfil legal or regulatory obligations or to protect our legitimate interests (where applicable depending on the country you are based), including the establishment, exercise, or defence of any existing or potential legal claims. Our retention periods are being determined as per the legal requirements of the country you are based. 

Your Personal Data will be kept strictly confidential and disclosed only to: 

• The departments/employees that need to process your Personal Data for handling your application; 

•  To Aesop Group Of Companies – to the extent necessary due to any international team and matrix structures, as well as the use of group wide integrated centralized HR functions and systems;  

• To external service providers, for example providers of IT services (such as technical service providers for storing your data) and compliance review, who have been carefully selected and are contractually bound in accordance with applicable data protection legislation. 

• Law enforcement and other government authorities. To do so, the authority requires an appropriate judicial order or warrant, for which they need to demonstrate that the disclosure of the requested or intercepted information is required. We reserve the right to challenge these requests.  

We may share or transfer your Personal Data in the course of any direct or indirect reorganization process including, but not limited to, mergers, acquisitions, divestitures, bankruptcies, and sales of all or part of our assets. Your Personal Data may be shared following the completion of such transaction and/or during the assessment processing pending transfer (subject to confidentiality requirements). If transferred, your Personal Data will remain subject to this Privacy Notice or a policy that, at a minimum, protects your privacy to an equal degree as this Privacy Notice unless you otherwise consent. 

International Data Transfers: We may transfer your Personal Data within the Aesop Group of Companies or to other third parties, in accordance with applicable local law, depending on the country you are based. We may also transfer your Personal Data from your country or jurisdiction to other countries or jurisdictions in accordance with legal requirements.  In some cases, this may include Australia , the United Kingdom and the United States of America.  Aesop will take reasonable steps to ensure that transfers are adequately protected as required by applicable data protection law. 

Your Sensitive Personal Data will not be used for any additional purposes that are incompatible with the purposes listed above unless we provide you with notice of those additional purposes.  

We do not sell your Personal Data or your Sensitive Personal Data, nor do we share it with third parties for cross-context behavioural advertising. 

Nous pouvons transférer vos Données au sein du Groupe de sociétés Aesop ou à d’autres Tiers.

Vos Données peuvent être transférées, stockés et accessibles dans un pays situé en dehors de l'Union Européenne et notamment dans les pays dans lesquels le Groupe Aesop est situé.

Dans tous les cas, de tels transferts de Données à Caractère Personnel en dehors de l'Union européenne ne peuvent être mis en œuvre que de manière sécurisée et dans le respect de la Réglementation Applicable. Nous pouvons contrôler les normes appliquées par les Tiers en matière de protection et de sécurité des Données à Caractère Personnel. En particulier, Nous encadrerons les transferts de vos Données à Caractère Personnel en signant les Clauses Contractuelles Types adoptées par la Commission européenne.

We implement comprehensive technical, physical and organizational measures to ensure a level of security appropriate to the risk to the personal data we process and to ensure compliance with applicable legal requirements. These measures are aimed at safeguarding the ongoing integrity and confidentiality of personal data. We evaluate and improve these measures on an ongoing basis.  

Depending on the country in which you are based, you may have some or all of the following rights: 

• To obtain information on your Personal Data processed and to obtain a copy of such data (right of access); 

• To obtain the rectification of any inaccurate data and, having regard to the purposes of the processing, the completion of incomplete data (right to rectification) (please let us know if and to what extent your data stored by us has changed, so that we can rectify or update the respective data); 

• If there are legitimate reasons, to request the deletion of your data (right to erasure); 

• To request the restriction of the processing of your data, if the legal requirements are met (right to restriction of processing); 

• To withdraw your consent at any time, if the data processing is based on consent, provided that such withdrawal does not affect the lawfulness of the previous processing of your data (consent withdrawal);   

• If the legal requirements are met, to receive the data provided by you in a structured, commonly used and machine-readable format and to transfer this data to another controller or, if technically feasible, to have it transferred by us (right to data portability); and 

• Not to be subject to a decision based solely on automated processing which produces legal effects concerning you or significantly affects you in a similar way, if the legal requirements are not met, although please note that in the job application context, an automated decision-making process is not carried out by us (not to be subject to automated processing). 

• To object, where applicable law provides, to the processing of your data (right to object):  - which is being processed for the purposes of our legitimate interests (where applicable and depending on the country you are based) unless such interests outweigh your individual rights and/or   - for direct marketing purposes, without any special reason. 

In order to exercise your rights, including the withdrawal of your consent, please contact us [here].You may also designate an authorized agent to make a request on your behalf. In order to protect your data from unauthorized access or alteration by third parties, all requests regarding your personal information will be subject to verification of the identity of the requesting individual.  We endeavour to respond to a verifiable request within required time frames. 

A Data Subject who feels that we are not adhering to this Notice or applicable data protection laws with respect to his or her Personal Data may contact us to register a complaint; submit requests for exercising rights; or address any other issue arising under this Notice. Complaints by any person may also be referred to the DPO team by email [here]. 

Without prejudice to any other remedies, you also have the right to lodge a complaint with a supervisory authority at any time. 

We may update this Notice periodically and will revise the date at the bottom of this Notice to reflect the date when such update occurred. If we make any material changes in the way we collect, use, and/or share the personal information that you have provided, we will endeavour to provide you with notice before such changes take effect, such as by posting prominent notice on the Company website. 

In the event of any difference in interpretation or meaning between the English version and any other translation of this Privacy Notice, the English version shall prevail. Please see the English version of this Privacy notice here.  

Effective Date: [17 February 2025]