Privacy Policy for Candidates-Employees at Keytrade Bank
Through this Privacy Policy for candidates-employees at Keytrade Bank, meaning anyone who has submitted an application in response to a collaboration offer ("Candidate Privacy Policy"), Keytrade Bank, the data controller, wishes to inform you in a clear and transparent manner about the conditions under which Keytrade Bank processes your personal data ("PD" or "data") that you have provided as part of your application ("you", "your").
Keytrade Bank needs certain PD to analyze your application and follow up on it (respond in writing, organize an interview, etc.). Keytrade Bank places great importance on protecting PD from unauthorized disclosure or processing.
Keytrade Bank commits to processing these PD only when necessary for a specific purpose and in strict compliance with regulations.
1. Collection of personal data
"Personal data" refers to any information related to an identified or identifiable individual. In other words, whenever a person can be identified based on elements that the data controller holds, any data related to this person (age, professional experiences, hobbies, etc.) is considered personal data.
Keytrade Bank collects your personal data from three different sources:
- Public sources: during or after the recruitment process, Keytrade Bank may consult and collect your data made public (e.g., your LinkedIn profile);
- Data collected by third parties: Keytrade Bank may also receive data from third parties after having obtained their contact details from the candidate and their consent (e.g., information transmitted by a recruiter, contacting former colleagues or managers);
- Data related to the professional whistleblowing system ("Whistleblowing"): includes the identity, roles, and contact details of the whistleblower (unless the report is anonymous) and/or the persons involved in the alert, including their business number if applicable; the identity, roles, and contact details of those involved in receiving and processing the alert (except for anonymous alerts); reported facts; data related to offenses, convictions, and security measures concerning individuals; elements gathered during the verification of reported facts; verification reports; and actions taken following the alert.
2. Data processing – Legal basis and purpose
2.1. Application Management
Keytrade Bank collects and processes your data exclusively for managing your application, following the procedure described in this section. The legal basis for processing is the taking of pre-contractual measures related to your application.
2.1.1. Analysis of your application e-mail and attachments
Initially, the human resources department analyzes the content of your application email and any attached documents (e.g., CV, cover letter). If they believe you possess the qualities sought by a Keytrade Bank manager, the information in your email is saved in a file on a server accessible only to recruitment personnel within the human resources department and the hiring managers.
2.1.2. Collection of public information and data from Keytrade Banks's databases
The human resources department may also consult public databases on the internet (LinkedIn profile, alumni pages, etc.) to supplement your application and obtain additional information.
They will also consult their own databases, including the email inbox cv@keytradebank.com, the file containing documents of candidates who have been interviewed, and the file with former employee information, provided their respective retention periods have not been reached. Keytrade Bank processes this data to check if there has been prior contact between you and Keytrade Bank and, if so, the content of the information exchanged (for applied retention periods, see the "Retention period of personal data" section).
Any data collected from databases consulted by the human resources department will be included in your file on the server, accessible only to recruitment personnel within the human resources department. The same applies to any written information you provide to Keytrade Bank as part of your application.
2.1.3. First interview with the Human Resources department
If recruitment personnel within the human resources department believe that a preliminary phone or online interview is warranted, a member of the HR team will contact you. Notes from this interview will be recorded by the HR personnel and stored in your file on the server, accessible only to recruitment personnel within the human resources department and the hiring manager.
If you provide additional documents or information following the interview, they will also be added to your file.
2.1.4. Review by the appropriate manager
If the human resources department considers that your application should be brought to the attention of one or more Keytrade Bank managers, your application and necessary information for their review will be made available to them. Necessary technical measures are in place to ensure that only recruitment-related personnel can access and view the data.
2.1.5. Second interview with an HR team member and the manager
In the event of positive feedback from one or more managers regarding your application, an interview will be organized with the manager(s), a human resources department member, and you. During this interview, notes are taken and added to your file on the server, accessible only by recruitment personnel within the human resources department and the hiring manager.
2.1.6. Verification of transmitted data
With your consent, and only in such a case, the references you actively provide can be checked by our human resources department. Notes will be taken during this contact and added to your file.
2.1.7. Drafting an employment contract
If Keytrade Bank wishes to offer you an employment contract, your necessary personal data will be processed. During the onboarding process, Keytrade Bank may also request specific documents from you (e.g., copies of your diplomas, a criminal record certificate) based on the position for which Keytrade Bank is making the offer.
2.1.8. Transfer of your data to the "employees" file
If you sign the offered employment contract, all your personal data stored in your application file will be transferred to a personal file within the "employees" section on the server, accessible only to the human resources department. Thus, your data will be processed in accordance with the Employee Privacy Policy.
2.2. Professional Whistleblowing System (Whistleblowing)
Keytrade Bank has implemented a professional whistleblowing system. This processing is carried out to comply with requirements related to the whistleblowing system mandated by the Law of November 28, 2022, on the protection of individuals reporting breaches of Union or national law observed within a private-sector legal entity ("Whistleblower Law").
You can report incidents to our "Regulatory" department by email (at whistleblower@keytradebank.com) or by postal mail using the format in Annex 1. Processing of your personal data is strictly limited to alerts falling into categories specified by the Whistleblower Law. If you file a professional alert or are the subject of one, your personal data (including reported facts, elements gathered during verification, and the verification reports and actions taken) will be processed for this purpose.
3. Retention Period of Your Personal Data
3.1. Data Sent in Writing with No Follow-Up
All data sent by email is retained for a period of one year. However, there are two exceptions to this rule:
- First, if you submit a complaint within this one-year period, your data will be kept for five years. The same applies in the case of legal proceedings; your data will be retained until the case has been fully resolved.
- Second, if the hiring manager considers that your profile might be suitable for a future position at Keytrade Bank, your data will be retained for two years, with your consent.
If, following your application, a human resources recruitment officer has organized an interview, your data will be transferred to a personal file stored in the ‘applications’ section of the server, which is only accessible to recruitment staff. These files are kept for two years. If you enter into an employment relationship with Keytrade Bank, all of your data will be transferred to the ‘employees’ section on the server, accessible only to human resources. In this case, your data will be retained for the period specified in the Employee Privacy Policy.
3.2. Online interviews via Teams
Interviews conducted online via Microsoft Teams (or any other video conferencing tool) with the human resources department and/or representatives of Keytrade Bank are not recorded or stored, unless you expressly request recording in writing beforehand.
3.3. Telephone calls
Telephone calls with the human resources department and, where applicable, with representatives of Keytrade Bank are not recorded.
3.4. Retention Period for Data in the Context of the Whistleblower System (“Whistleblowing”)
Keytrade Bank will retain the personal data and information you provide in connection with a report. Data that is clearly irrelevant to a specific report is not collected or, if accidentally collected, is promptly deleted.
If the report leads to action, such as disciplinary or legal measures, the collected data may be retained until the end of the procedure or until all appeals are exhausted. Data collected as part of a report without further action must be deleted or archived, after anonymization, within two months of the conclusion of verification procedures.
4. Transfers of Personal Data
All data submitted as part of your application is processed internally and is not shared with any third party, whether inside or outside the European Union. By not transferring any data, Keytrade Bank commits to ensuring the confidentiality of your application and the data provided.
5. Security Measures
Data security is a priority for the Crédit Mutuel Arkéa group, of which Keytrade Bank is a part. The storage and processing of your personal data are subject to strict rules and procedures.
To ensure the accuracy and confidentiality of your data, we take various measures, including:
Technical Measures:
- Your data (restricted access, no sharing of salary information) is only transferred to managers who need it to evaluate your application.
- Access to the human resources server is limited to members of the human resources department.
- Access to the operating system is password-protected, and for remote connections, additional security (VPN access) is in place.
Physical Measures:
- No data about you is stored on paper to avoid compromising confidentiality.
Additional Measures
- When you communicate a change to your personal data, it is updated by the human resources department in your file.
- Audits and controls are conducted to ensure regulatory compliance (including the GDPR).
- Employees receive training on the protection of personal data and GDPR compliance.
6. Human Decision-Making Based on Automated Analyses
Keytrade Bank does not apply fully automated decision-making, as defined in Article 22 of the GDPR, to candidate data.
7. Your Rights
To exercise your rights under the GDPR, you can contact cv@keytradebank.com using the same email address used in previous communications.
7.1. Right to Information
You have the right to obtain clear, transparent, and understandable information on how Keytrade Bank processes your data and on how to exercise your rights. This information is contained in this Candidate Privacy Policy. For any questions, please feel free to contact us.
7.2. Right to rectification: : Accuracy and Modification of Your Personal Data
If your personal data changes, you can inform Keytrade Bank by email at the address above to ensure that we have accurate, up-to-date information.
7.3. Right of Access
Anyone whose personal data is processed by Keytrade Bank has a right of access. This right allows you to know which data Keytrade Bank holds about you and to ensure that it is accurate, up-to-date, complete, and relevant.
7.4. Right to Erasure (“Right to Be Forgotten”)
Keytrade Bank needs some of your personal data to process your application. All of your personal data can only be deleted from our systems if you withdraw your application or if it is unsuccessful. If you wish to delete specific personal data but continue your application, this is possible as long as the data is not essential to the processing of your application.
Keytrade Bank may refuse your right to erasure if your data is necessary for the establishment, exercise, or defense of legal claims.
7.5. Right to Restriction
This right allows you to ask Keytrade Bank to temporarily stop processing your personal data in certain situations outlined in the GDPR.
7.6. Right to Data Portability
Under this right, you can request Keytrade Bank to transfer your personal data to yourself or directly to another data controller, where technically feasible. This right only applies to data you have provided to Keytrade Bank and that is processed automatically, based on a contract or your consent.
7.7. Right to Object
You have the right to object at any time to the processing of your personal data based on the legitimate interest of Keytrade Bank. Keytrade Bank does not process the data you provide as part of your application based on legitimate interest.
8. Disclosure of Your Data
In view of the purposes mentioned above, all or part of your data may be shared with the following recipients (only as necessary for their respective needs):
- Our human resources department;
- One or more representatives of Keytrade Bank (hierarchy) related to the position to be filled;
- Individuals specifically responsible for managing alerts within Keytrade Bank; and
- Our professional advisors (e.g., our lawyers in case of disputes), as needed.
Finally, in the case of a restructuring operation (including the complete or partial sale of assets, merger, acquisition, spin-off, or any reorganization of Keytrade Bank), we may transfer some of your data to a third party involved in the operation in accordance with GDPR.
9. Questions?
If you have any questions or encounter an issue related to your personal data, you can contact our DPO Team:
- By e-mail at dpo@keytradebank.com
- By mail at the address Boulevard du Souverain 100, 1170 Brussels, addressed to the DPO Team
10. Data Protection Officer
Keytrade Bank has appointed a Data Protection Officer (DPO) whose duties include informing and advising Keytrade Bank on all matters related to personal data protection. You can contact the Data Protection Officer:
- By postal mail: Madame the Data Protection Officer – Crédit Mutuel Arkéa – 1 rue Louis Lichou, 29808 Brest Cedex 9, France
- By e-mail at protectiondesdonnees@arkea.com
11. Complaints
In case of a complaint regarding the processing of your personal data, you may submit a mediation request to the Data Protection Authority at the following address:
Data Protection Authority Rue de la Presse 35, 1000 Brussels Tel: +32 2 274 48 00 E-mail: contact@apd-gba.be