This Company’s Notification to the candidate employees according to Articles 13, 14 of the GDPR (the "Notification") refers to Personal Data stored not only electronically but also hard copy filing systems. This Notification describes how MELLON collects and processes Personal Data of its candidate employees. In this context, and in its capacity as Data Controller, MELLON is fully committed to preserve the security of the candidates’ Personal Data, by meeting all the prescribed data protection standards imposed by the Data Protection Legislation.
1. Sources of Personal Data collection
MELLON normally collects personal data either directly from you, i.e., the candidate employees, or through authorized third parties (recruiters, e.g., Workable, jobrelated social media platforms, ex-employers or other references provided by you). In any case, your personal data are considered as a necessary condition for pursuing the purposes of processing, as specified below.
2. Processing of personal data and legal bases
The following table depicts the purposes of personal data processing, the categories of such personal data, as well as the legal basis for such processing.
| Receipt of candidate employees’ CV | personal details, CV’s contents and data (work experience, education, interests/ hobbies, military obligations), contact information, letters of recommendation, cover letter, any information included in the CV or provided voluntarily by the data subject | Article 6, par. 1, (b) – processing is necessary for taking measures at the request of the data subject before the conclusion of the contract. |
| Interview with candidates employee and evaluation of their candidacy | personal details, CV’s data (work experience, education, interests, military obligations), work experience data and information about the previous position and their confirmatory documents upon request, contact information, letters of recommendation, any information included in the CV or provided voluntarily by the Subject or requested in the context of preparing the employee’s dossier (in case of a job offer and its acceptance by the candidate) | Article 6, par. 1, (b) – processing is necessary for taking measures at the request of the data subject before the conclusion of the contract. |
| Retention of data base for the purpose of filling job vacancies in the immediate future | personal details, CV’s data (work experience, education, interests, military obligations), contact information, letters of recommendation, any information included in the CV or provided voluntarily by the Subject | Article 6, par. 1, (b) – processing is necessary for taking measures at the request of the data subject before the conclusion of the contract. |
3. Disclosure to third parties and Categories of recipients
Your personal data as described above are disclosed to the internal competent departments of MELLON, and its affiliates, in case any group entity has an employment post to be filled and that corresponds to your qualifications and, if applicable, to third parties, either public or private bodies, in accordance with the applicable legislation, when this is necessary to comply with a legal obligation of the Company or it is necessary for the purposes of the legitimate interests pursued by the Company. In particular, the Company may disclose your personal data required at each time:
- To public bodies, either by filing documents, digital files, or through online applications, as specified in each case.
- To administrative, judicial and prosecutorial authorities in the context of handling the Company's legal cases or following a court decision or a legal request to the Company.
- To third parties who provide technical support services. companies that provide software to the company (e.g. Workable platform), candidate assessment services.
In any case and where feasible, the Company complies with the requirements of the GDPR (art. 28) for the compliance of such third parties/ data processors with whom it deals, and it binds them to the protection of the personal data it transfers to them, as defined by the GDPR and its respective policies and procedures.
4. Ιnternational Τransfers of Personal Data
Due to the global nature of our operations, we may share your Personal Data with other entities MELLON, including entities of the Group out of the European Economic Area (EEA). In these cases, except for those countries for which the European Commission has decided that they provide an adequate level of protection (UK, Andorra, Argentina, Canada, Switzerland, Faroe Islands, Guernsey, Israel, Isle of Man, New Zealand and Uruguay), it is required that the recipients comply with appropriate measures and safeguards to protect Personal Data.
Any transfer of your Personal Data to entities of MELLON out of the EEA is carried out on the basis of a data transfer contract based on standard contractual clauses approved by the European Commission.
5. Personal Data of Third parties
In case you provide Personal Data of third parties to MELLON (employees candidates, data of spouse and/or family members, data and contacts details of referees/ex- employers), you must inform these persons about the processing of their Personal Data by MELLON and their relevant GDPR rights (for example, by presenting this Notice). In addition, if required by law, you should obtain the consent of such persons. If you provide the Personal Data of third parties, MELLON assumes that the relevant consent of such third parties has been obtained.
6. Data Subject’s rights
This section presents your rights in respect of personal data. These rights are subject to certain exemptions, reservations or limitations. Please submit your requests responsibly. The Company will respond as soon as possible and in any case within one (1) month of receipt of the request. If the review of your request is going to last longer, you will receive relevant information. To exercise your rights, you may contact us on the following email address: dpo@mellongroup.com.
The Company takes care of the unimpeded exercise of your rights below:
- The right to information
- The right to access
- The right to rectification
- The right to erasure
- The right to restriction of processing
- The right to object
- Τhe right to withdraw consent
7. Retention period of personal data
When determining the retention periods of Personal Data, in general, MELLON follows the principle that it must retain Personal Data for as long as necessary to fulfill the purpose for which it was collected, and deletes your Personal Data as soon as the purpose for which it was collected no longer exists. MELLON may retain your Personal Data for a longer period of time if there is a legal basis for further processing. In particular, the retention period of your Personal Data is eighteen (18) months from the day you have applied to a job position.
The retention periods mentioned above may be extended if we are obliged to retain the Personal Data in relation to a court case, investigation or proceeding, or if the law provides for a longer period of data retention.
8. Contact with the supervisory authority
For further information and advice on your rights or to lodge a complaint, you may contact the competent local supervisory authority of your jurisdiction.
9. Amendments of this Notification
We aim to review and keep up-to-date the initial Notification, in order to comply with privacy laws and new developments. Any updates to this Notice will be communicated to you immediately.