RECRUITMENT PERSONAL DATA PROTECTION POLICY - Alara Group

1. Who are we?

Alara Group is a simplified joint-stock company (SAS) with a capital of 12,500 euros, registered with the Trade and Companies Register (RCS) under number 881 751 697, headquartered at 7 ALLÉE DE L'EUROPE, 67960 ENTZHEIM, and whose intra-community VAT number is FR16881751697. Alara Group offers expertise services regarding radiation.

2. Why this policy?

We wish to inform you of the means implemented to protect your personal data processed by Alara Group on its recruitment website via the Tellent/Recruitee platform. This Policy may be revised when new features or activities are added to the website, when personal data processing methods are modified, or when laws and regulations evolve affecting the activity and/or services offered by Alara Group. In the event of a revision to this Policy, Alara Group commits to publishing the modifications on its website and updating the publication date of said Policy. Any revised Policy will apply both to personal data already being processed at the time of the modifications, and to any other personal data collected and processed after the revised Policy comes into effect. Alara Group assigns a version number to this Policy, including the month and year of its last revision. Alara Group encourages Users to regularly consult this Policy to check if any changes have been made.

3. Definitions

• “French Data Protection Act” (Loi informatique et libertés): Law n°78-17 of January 6, 1978, relating to information technology, files, and freedoms, as amended by Law n° 2018-493 of June 20, 2018, relating to personal data protection.

• "Regulation" or "GDPR": Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), and repealing Directive 95/46/EC.

• “Data Controller”: the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

• “Data Processor”: a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller.

• “User” or “Data Subject”: any visitor to the website whose personal data is processed.

• “Personal Data”: any information relating to an identified or identifiable natural person; an ‘identifiable natural person’ is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

• “Personal Data Breach”: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed.

• “Processing”: any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

4. Roles and Responsibilities of Alara Group

In the course of its activities, Alara Group processes personal data relating to the data subject in compliance with the provisions of the GDPR and the French Data Protection Act, particularly regarding lawfulness, fairness, and transparency.

Origin and collection of the data concerned All data concerning the data subjects is collected directly from them through their use of the website. Alara Group commits to informing any data subject using the website of how their personal data is processed and of their rights in this regard. The personal data collected is used within the framework of the services provided by Alara Group. It is used to fulfill recruitment-specific purposes and to respond to the various needs and requests of our website users. Alara Group commits to collecting and processing only the personal data strictly necessary for the processing purposes and the determined objectives, in compliance with the principle of data minimization.

5. Alara Group as Data Controller

a. Purposes of processing

Alara Group acts as Data Controller within the framework of providing the website, specifically for the following purposes:

• Submission of candidate applications on the Alara Group recruitment platform

• Management of applications and recruitment

• Retention of your application documents for the authorized duration to build a CV database

• Statistics and audience measurement through third-party application cookies (see the section dedicated to cookies)

Alternatively, data subjects' data is also processed for communication needs relating to product and offer developments falling under Alara Group's legitimate interest. At any time, the User can exercise their right to object to receiving these communications by sending an email to: dpo@alara-group.fr, or by mail to 7 Allée de l'Europe, 67960 Entzheim.

b. Legal basis for processing

The processing of personal data is legally based on:

• The contract and pre-contractual basis for the purpose of emailing prospects and clients;

• Alara Group's legitimate interest in informing data subjects about news regarding its open positions;

• Alara Group's legal obligation arising from its status as an employer.

c. Categories of data subjects

• Website visitors

• Candidates

d. Processed Personal Data

• Website visitors: IP address, cookies

• Candidates: first name, last name, email address, phone number, country, personal skills and qualifications (CV), cover letter, and any other personal data strictly necessary within the hiring process.

6. Methods and retention period of personal data

a. Hosting of data collected on our website

All personal data collected on our website is hosted exclusively in the European Union, by the following providers:

• Google Cloud – Data centers in Frankfurt and Berlin, Germany (europe-west3): core infrastructure (web servers and databases)

• Amazon Web Services – Data center in Frankfurt, Germany (eu-central-1): file hosting and encrypted backup storage

• Amazon Web Services – Data center in Ireland (eu-west-1): used solely for the video response feature

b. Retention period of processed personal data

Alara Group only retains Users' personal data for the time necessary for the operations for which it was collected and in compliance with current regulations (https://www.cnil.fr/fr/le-guide-du-recrutement).

7. Sharing and communication of personal data

Within the limits of their respective responsibilities and for the purposes stated above, the main people likely to have access to personal data collected on the Alara Group website are primarily its own employees and service providers. The data subjects' personal data is not transmitted to commercial or advertising actors. Alara Group may choose to share or transfer its Users' personal information as described below:

• Alara Group may disclose the data subject's personal data (a) to comply with a legal obligation, a judicial procedure, a court order, or legal process served on Alara Group, (b) as part of a judicial investigation, (c) to protect or defend the rights or property of Alara Group or Users of Alara Group's services, and/or (d) to investigate or assist in preventing any potential violation of the law, this Policy, or our General Terms of Use;

• Alara Group may share all or part of the data subject's personal data in connection with any merger, financing, acquisition, or dissolution transaction or proceeding involving the sale, transfer, divestiture, or disclosure of all or a portion of our business or assets. In the event of insolvency, bankruptcy, or receivership, personal information may also be transferred as a business asset. If another entity acquires Alara Group or its assets, that entity will possess the personal information collected by Alara Group and will assume the rights and obligations regarding your personal information as described in this Policy;

• Alara Group may share all or part of the data subject's personal data with entities belonging to or associated with our corporate structure in compliance with the law and regulations. This personal data may only be processed for the purpose of fulfilling the objectives described in this Policy;

• Alara Group may share the data subject's personal data with third-party service providers and subcontractors to provide the proposed services, conduct quality assurance testing, provide technical support, and/or to provide other services (emailing, audience analysis) to Alara Group. Alara Group commits to requiring its subcontractors to have a sufficient level of security regarding the processing of personal data they carry out on its behalf. If these third-party service providers use servers outside the European Union, Alara Group enters into specific contracts and binding contractual clauses established by the European Commission to regulate and secure the transfer of such personal data to these providers. In this case, all third parties commit to approving and strictly applying this Policy. This obligation is set out in the contracts that bind these third parties to Alara Group in accordance with personal data protection rules.

  
  

8. Data transfers outside the EU

We do not transfer your data outside the European Union.

9. Cookies

A "cookie" is a small information file sent to the User's browser and saved on the User's terminal (e.g., computer, smartphone), (hereinafter "Cookies"). This file includes information such as the User's domain name, the User's Internet service provider, the User's operating system, as well as the date and time of access. Cookies cannot damage the User's terminal under any circumstances. The Alara Group website uses Google Analytics audience cookies. By a decision on July 10, the European Commission noted that the United States ensures a level of personal data protection equivalent to that of the European Union. Transfers of personal data from the EU to certain US organizations can now take place freely, without specific safeguards. Thus, there is currently no contraindication to the use of Google cookies. You can consult the cookie management banner to get details of the cookies used, and you are free to change your choice regarding their use at any time.

10. Technical and organizational security measures

Alara Group is committed to protecting users' personal data by implementing technical and organizational security measures aimed at combating unauthorized disclosure, alteration, use, or destruction of the processed personal data. Alara Group implements all measures at its disposal to create an environment that preserves the quality, security, confidentiality, and integrity of the processed personal data. Alara Group also uses reasonable technologies to secure the processing of personal data within the framework of the purposes described in this policy, including:

• Access management;

• Let’s Encrypt SSL (Secure Socket Layer) encryption;

• Physical protection of premises, authentication processes with secure individual access, confidential username and password policy, traceability and logging of connections, personal data encryption;

• Regular assessment and improvement of its information technology systems, facilities, and data collection, storage, and processing practices.

• Data hosting with HDS-certified service providers in accordance with Article L.1111-8 of the French Public Health Code.

However, Alara Group cannot ensure or guarantee against all risks regarding the security of this personal data. Alara Group does not guarantee that this data cannot be accessed, disclosed, altered, or destroyed in the event of a breach of any of our safeguards due to failure or negligence on the part of website users, a failure of our data hosting provider, or one of our subcontractors.

11. Users' rights

Alara Group is committed to ensuring respect for Users' rights regarding personal data protection. In accordance with the amended French Data Protection Act of January 6, 1978, as well as the European regulation on personal data protection of April 27, 2016, except in cases of limitation, your data rights are as follows:

• Right of access: the right to be informed and to request access to the personal data that Alara Group processes;

• Right to rectification: the right to request the modification or updating of personal data when it is inaccurate or incomplete;

• Right to erasure (right to be forgotten): the right to request the permanent deletion of personal data processed for the purposes described in this policy;

• Right to restriction of processing: the right to request to temporarily or permanently stop the processing of all or part of the personal data;

• Right to object: the right to refuse the processing of personal data at any time;

• Right to data portability: the right to request a copy of personal data in electronic format and the right to transmit this personal data for use by a third party;

• Right not to be subject to automated decision-making: the right not to be subject to a decision based solely on automated decision-making, including profiling, where the decision would have a legal effect on you or produce a similarly significant effect.

The user can also inform Alara Group of their wish to determine what happens to their personal data after death. In such a case, Alara Group commits to respecting the processing arrangements for this personal data within the limits of applicable legal obligations. In the absence of precise instructions from the data subject, Alara Group commits to destroying the personal data concerned, unless its retention proves necessary for evidentiary purposes or to comply with a legal obligation.

12. Support and contact

If you have questions or complaints regarding this policy or our personal data collection or processing practices, if you wish to exercise your rights regarding personal data protection, or if you wish to report any security breach to us, please contact us by email at dpo@alara-group.fr or by mail at Alara Group, Data Protection Officer, at 7 Allée de l'Europe, 67960 Entzheim. In the event of a complaint, you may choose to contact the French supervisory authority responsible for compliance with personal data protection rules, the Commission Nationale de l'Informatique et des Libertés (CNIL):

• By mail: 3 Place de Fontenoy TSA 80715, 75334 Paris, Cedex 07

• Online: https://www.cnil.fr/fr/plaintes/