Group personal data protection notice of applicants

1. Which personal data do we collect and use about you?

2. Who is concerned by this notice and from whom do we collect personal data?

3. Why and on which basis do we use your personal data?

4. Who do we share your personal data with?

5. International transfers of personal data

6. How long do we keep your personal data?

7. What are your rights and how can you exercise them?

8. How can you keep up with changes to this data protection notice?

9. How to contact us?

10. Local privacy notices and contacts

The protection of your personal data is important to the BNP Paribas Group, which has adopted strong principles in that respect for the entire Group in its Group Privacy Policy available on the BNP Paribas institutional site.

This Personal Data Protection Notice provides you with transparent and detailed information relating to the protection of your personal data processed by BNP Paribas SA and/or its subsidiaries as a recruiter ("us") in the context of our application and recruitment procedures.

This Personal Data Protection Notice applies to all candidates who have applied directly or indirectly for a job offer through BWELCOME website (permanent, Fixed Term Contract, Trainee/internship, international volunteer Program, summer job, apprenticeship, graduate program, Holiday/summer job) of the BNP PARIBAS Group (“you”).

As a controller, we are responsible for the collection and processing of your personal data in relation to our activities, in accordance with the applicable regulations.

This Data Protection Notice lets you know which personal data we collect about you, the reasons why we use and share such data, how long we keep it, what your rights are and how you can exercise them.

This Personal Data Protection Notice may be supplemented, where appropriate, by other local statements, in order to specify certain processing or as it is required to comply with local law in the country where you live, and/or apply.

At the end of BNP Paribas Applicant Privacy Notice (this document), you could find all information and redirection toward country privacy notices if any and also local data protection contacts to exercise privacy rights. (LOCAL PRIVACY NOTICES AND CONTACTS).

1. Which personal data do we collect and use about you?

We collect the following categories of personal data (i.e., any information that identifies or allows identifying you) directly from you when applying for a BNP Paribas Group job offer or from third parties such as recruitment firms, job sites or social networks, to the extent necessary for the purposes detailed in section 3.

Depending on the nature of our intended employment relationship, the targeted position and the stage of recruitment, we may process various types of personal data, including:

• identification and personal information about you (e.g.: full name, identity, ID card and passport information, nationality, place and date of birth, gender, family status (e.g. marital status, dependents and date of birth), photograph, video);
• private and professional contact details (e.g.: postal and e-mail addresses, phone number, emergency contact details);
• national registration number
• information about your training and career path (e.g.: education, CV’s, professional qualifications, cover letter, interview;
• information you provide in support of your application: (e.g.: declarative data, questionnaire replies, satisfaction survey, interviews, cats, etc.);
• information from your answers to the various tools used in the recruitment process (e.g. : personality tests or inventories, etc.)
• employment information and data related to previous work experience ;
• economic and financial information: (e.g.: salary expectations, other information necessary to administer payroll and, depending on the situation, details of bank accounts, taxes, pensions, and benefits;)
• information about your work permit (e.g.: residence and immigration status);
• recording of data image and sound (e.g. CCTV (Closed Circuit TeleVision) video surveillance, professional videos and photos, telephone and video calls, conversations and electronic communications);
• social networks Data when it is public and authorized by Terms and Conditions of social networks.

We may collect and use the following sensitive data only when required by law or when you have given your consent:

• biometric and genetic information (e.g.: the fingerprint, voice pattern, face pattern which can be used for identification and security purposes);
• health data in relation to workplace adaptation needs;
• information on criminal convictions and offences data (e.g.: for investigation or background checks).

We do not collect nor process personal data related to your ethnic origins, political opinions, religious or philosophical beliefs, or data concerning your sexual orientation unless it is required by law or made public by you and necessary for the purposes for which it is intended.

2. Who is concerned by this notice and from whom do we collect personal data?

This notice is addressed to all candidates as defined above and to your references (former employer, professor, etc.) for whom you have provided us with the contact details.

We may sometimes also collect additional data from other third parties, for example:

• Other BNP Paribas Group entities;
• Recruitment firms;
• Schools and administrations;
• Background check providers;
• Former employers;
• Social media and other public sources.

When you are providing us personal data about these third parties like the examples listed above, please remember to inform them that we process their personal data and direct them to the present Data Protection Notice.

3. Why and on which basis do we use your personal data?

a. To comply with our regulatory obligations

As a financial institution and a recruiter, we use your personal data to comply with various regulatory obligations:

• To verify the elements necessary for identity control and conduct identity checks;
• To perform background checks on candidates;
• To implement a system for handling professional alerts;
• To comply with regulation relating to sanctions and embargoes;
• Prevent market abuses to monitor and record transactions, phone calls (including VoIP and videoconferences), electronic communications (such as emails, instant messaging (chat), SMS…) in order to identify those which deviate from normal activities and habits such as personal account dealing;
• Ensure transparency of transactions on the financial markets by monitoring and recording transactions, phone calls (including VoIP and videoconferences), electronic communications (such as emails, instant messaging (chat), SMS…) when required;
• to exchange and report different information or reply to official requests from a duly authorized local or foreign financial, tax, administrative, criminal or judicial authorities, arbitrators or mediators, law enforcement, state agencies or public bodies
• to maintain security e.g., to ensure network and information security, including protecting BNP Paribas Group against malicious and inadvertent data security breaches

b. To take step at your request prior to entering into a possible contract with you

We use your personal data to conduct the recruitment process to enter into and perform your possible employment contract, including:

• To select and to analyze applications and professional skills (pre-selection of applications, …);
• To assess and to verify of your abilities, skills, professional skills and interest for the target job (conducting interviews, face-to-face or remote; conducting tests and evaluation);
• To communicate with you about the current recruitment process and your application;
• To use data collected during the recruitment phase for human resources management purposes for selected candidates.

c. To fulfil our legitimate interest

We also collect and use your personal data where we have a legitimate reason:

• to offer you employment opportunities related to your career and skills;
• to inform you of actions or events of interest (such as forums or fairs, conferences or thematic meetings);
• to establish CV-bank for the purpose of researching and identifying candidate profiles;
• to manage recruitment and mobility through the performance of personality tests, personality, matching of personality, comparison your test result to standard test result;
• to manage our platform for job applications;
• to check professional references;
• to perform background checks when it is not required by applicable law;
• to implement a system for handling professional alerts;
• to manage inquiries and surveys;
• to access information from your social network profile (when it is public and is authorized by Terms and Conditions of the social network);
• to establish aggregated statistics, tests and models (e.g. implementation of chatbots), to improve our processes;
• to conduct data analytics studies to review, better understand and monitor our recruitment procedures;
• to ensure physical security of our buildings, in particular video protection, and managing access to buildings;
• to prevent, detect and manage fraud, bribery and money laundering and financing terrorism when it is not required by applicable law;
• to comply with regulation relating to sanctions and embargoes when it is not required by applicable law;
• Monitor compliance with our internal policies and procedures including but not limited to our code of conduct. This may include monitoring and recording of phone calls and voice communications (including VoIP and videoconferences), emails and instant messaging (chat) communications when you interact with our employees subject to specific legal and regulatory obligations;
• to manage our defense of legal claims and litigation.

In any case, our legitimate interests remain proportionate, and we verify according to a balancing test, that your interests and fundamental rights are preserved. Should you wish to obtain more information about such balancing test, please contact us using the contact details in section 9 "How to contact us" below.

d. To respect your choice if we requested your consent for a specific processing

For certain personal data processing operations, we will communicate additional information and invite you to consent to such processing (note that you may be able to withdraw your consent at any time) notably:

• where the above purposes lead to automated decision-making, which produces legal effects or which significantly, concern and affects you. In this case, we will inform you separately about the logic involved, as well as the significance and the envisaged consequences of such processing;
• If we need to carry out further processing for purposes other than those above, we will inform you and, where necessary, obtain your consent.

4. Who do we share your personal data with?

a. Sharing of information within the BNP Paribas Group

To fulfill the purposes set out above, we may share your personal data with the following category of recipients :

• Recruitment operational teams including HR people and hiring managers;
• Recruitment tool support teams including system administration teams.

Where a shared platform exists within the same territory, recruitment data will be shared with the different entities if the candidate applies for several offers within the limits of the validity of these data (reasonable time between the different applications).

If applicable, to benefit of other job opportunity, your consent will be required for additional data sharing to other BNP Paribas entities (out of the Entities of position you directly apply for).

When creating your candidate account, one of following options (*) is to be selected by you on our career website:

• Your profile is shared internationally with other BNP Paribas Entities : in this case, any BNP Paribas entity could propose you other job opportunities that could match your profile at a worldwide level.
• Your profile is shared only with BNP Paribas entities located in your residence country : any BNP Paribas entity could propose you other job opportunities that could match your profile at a national level.
• Your profile is not shared: we will not send you any other job opportunity.

Data concerned by this data sharing are the following :

• Identity information and contact, skills, experiences, Job preferences.
• Your profile includes also the files uploaded at your account creation or at the job application launch (ex: CV, cover letter).

(*) Please note You can modify at any time this initial option selection in your Candidate Profile.

b. Disclosing information outside the BNP Paribas Group

In order to fulfil some of the purposes described in the Notice, we may disclose from time to time your personal data with third parties, including:

• service providers and subcontractors performing services on our behalf;
• partners and associations with whom we are partnering or, when you choose to participate in any of their events;
• local or foreign financial, tax, administrative, criminal or judicial authorities, regulators, arbitrators or mediators, law enforcement, state agencies or public bodies, where we are required to disclose data pursuant to:
  • their request;
  • defending or responding to a matter, action or proceeding;
  • complying with regulation or guidance from an authority applying to us.
• certain regulated professionals such as lawyers, notaries, rating agencies or auditors under specific circumstances (e.g. litigation, audit, etc.) or insolvency administrators in case of private bankruptcy.

5. International transfers of personal data

In case of international transfers originating from the European Economic Area (EEA) to a non-EEA country recognized by the European Commission as providing an adequate level of data protection, your personal data will be transferred on this basis.

For transfers to non-EEA countries where the level of personal data protection has not been recognized as adequate by the European Commission we will either rely on a derogation applicable to the specific situation or implement one of the following safeguards to ensure the protection of your personal data:

• notably by Binding Corporate Rules (BCR) and any supplementary measure as appropriate;
• standard contractual clauses (SCC) and any supplementary measure as appropriate;

To obtain a copy of these safeguards or additional details on where they are available, you can send a written request as outlined in Section 9.

6. How long do we keep your personal data?

We will retain your personal data for the period required to comply with the applicable laws and regulations or another period to achieve the purpose for which it was collected and until the applicable limitation periods have expired.

Your personal data will be kept two years after last contact with you, and will then be archived for three additional years (with regards to legal obligation or establishment, exercise or defense of legal claims) before deletion or anonymization.

Nevertheless some countries are subject to specificities regarding retention periods.

To access to country specificity regarding retention period, please use the link displayed at the end of this standard privacy notice. (10.LOCAL PRIVACY NOTICES AND CONTACTS )

7. What are your rights and how can you exercise them?

In accordance with applicable regulations and where applicable, you have the following rights:

• to access: you can obtain information relating to the processing of your personal data and a copy of this personal data;
• to rectify: where you consider your personal data to be inaccurate or incomplete, you may request that your personal data be amended accordingly;
• to erasure: you can require the deletion of your personal data, to the extent permitted by law;
• to restrict: you can request the restriction of the processing of your personal data;
• to object: you can object at any time, on grounds relating to your particular situation, to the processing of your personal data. In such case, we will no longer process your personal data unless we demonstrate compelling legitimate grounds for the processing, which override your interests, rights and freedoms, or for the establishment, exercise or defense of legal claims. You also have the absolute right to object to the processing of your personal data for direct marketing purposes, which includes profiling related to such direct marketing;
• to withdraw your consent: where you have given your consent for the processing of your personal data, you have the right to withdraw your consent at any time;
• to data portability: where legally applicable, you have the right to have the personal data you have provided to us be returned to you or, where technically feasible, transferred to a third party.
• to organize data after death when it is required by law

If you wish to exercise any of these rights, you can send your application by mail or by email via the recruitment service to which you have applied and for which an acknowledgement of receipt has been sent.

In accordance with the applicable rules, in addition to your rights above, you are also entitled to lodge a complaint with the competent supervisory authority.

8. How can you keep up with changes to this data protection notice?

In a world of constant regulatory and technological changes, we may need to regularly update this Notice. We invite you to review the latest version of this Notice online. 

9. How to contact us?

If you have any questions relating to our use of your personal data under this Notice, you can contact your Data Protection Officer via the recruitment service to which you have applied and for which an acknowledgement of receipt has been sent to you.

If you want to know more about cookies, please read our Cookies policy.

10. Local privacy notices and contacts

To access the contacts and/or data protection notices of BNP Paribas entities in Belgium, please use the corresponding link