RIB Group

Privacy Notice for Recruitment

1. The purpose of this document

1.1 This Privacy Notice explains how and why the RIB group companies (referred to in this notice as “RIB”, “we”, “our” and “us”) uses personal data about job applicants (referred to as “you”). The RIB Group Companies are listed below and are each a subsidiary of RIB Software GmbH, which is wholly owned by the Schneider Electric group. RIB is a “controller” of your personal information. This means we are responsible for making decisions about how and why we process your personal data about you.

RIB Denmark A/S

RIB Australia Pty Ltd

RIB Construction Computer Software (Gulf) (LLC)

RIB Cosinus AG

RIB Cosinus GmbH

RIB Deutschland GmbH

RIB Guangzhou Two Information Technology Co., Ltd.

RIB International Holding PTE. LTD.

RIB ITWO Software Pvt Ltd

RIB iTWO Software, Inc.

RIB Limited

RIB Malaysia SDN BHD

RIB New Zealand Limited

RIB SAA Engineering GmbH

RIB Schneider Electric Industries SAS

RIB Singapore Pte Ltd

RIB Software (Thailand) Co., Ltd

RIB Software DMCC

RIB Software Indonesia

RIB Software North America, Ltd.

RIB South Africa (Pty) Ltd

RIB Spain SA

RIB stavební software s.r.o.

RIB U.S. Cost Incorporated

RIB UK&I Limited

RIB Vietnam Company Limited

1.2 This Privacy Notice applies where you apply for a position with us directly or indirectly via a third party (e.g. via a recruitment agency or platform). You should read this notice, so that you know what we are doing with your personal data. This notice does not form part of your contract of employment (where applicable) or any other contract to provide services.

2. The personal data we collect

2.1 In connection with your application for work with us, we will collect store and use personal data you have provided to us in your application, curriculum vitae/resume and any covering letter and any other personal data you provide to us during your interview or the recruitment process. The personal data we collect is set out in Schedule 1. This personal data may be collected from you, recruitment agencies, your current and/or previous employers, publicly available information and, where applicable, background checking services.

2.2 It is your responsibility to make sure the personal data you provide to us is complete and accurate. If any of the personal data you have given to us changes, please inform us without delay by contacting our human resource department.

3. How and why, we use your personal data

3.1 Schedule 1 sets out the different purposes for which we process your personal data and the relevant lawful basis on which we rely for that processing.

3.2 The processing of your personal data may be necessary for us to comply with a legal obligation or to enter into an employment or work contract with you. Accordingly, we may not be able to process your application if you choose not to provide such personal data to us.

3.3 We may collect personal diversity data where permitted by local law (e.g. gender, age, disability status, sexual orientation, veteran status and racial/ethnic origin) to help us understand, monitor and improve diversity in the workplace. Providing such personal data is entirely voluntary and it is separated from your application so it is not visible to our hiring team. We aggregate the diversity data for high level analysis, and no individual will be identified or identifiable in any analysis. The original personal data is separated and later anonymised in accordance with the retention periods set out in paragraph 9.2 below. You may at any time exercise your rights under paragraph 10.1 if you want us to erase or amend any of the diversity data you provide to us voluntarily.

3.4 We will not sell your personal data. We will not use your personal data to make any automated decisions or for profiling purposes affecting you.

4. Sensitive personal data

4.1 During the recruitment process, we may process sensitive personal data (also known as ‘special categories’ of personal data), which is given additional protections in data privacy laws, e.g. health data, national identification, criminal background checks. We will only process such personal data where we are legally permitted to. The different purposes for which we may process your sensitive personal data and the relevant lawful basis on which we rely for that processing is set out in Schedule 1.

5. Use of cookies

5.1 The following cookies are used on our recruitment website, all of which expire at the end of the session:

• Session management cookies – purpose: user, device and session ID cookies along with a timestamp for timing out sessions after inactivity.
• Routing cookies – purpose: to forward requests for a single session to the same server for consistency of service.
• Application Security Management cookies – purpose: to help protect us from security attacks.

6. Sharing your Personal Data

6.1 Sometimes we need to disclose your personal data to third parties, including the companies in the Schneider Electric group. Where necessary, we may provide personal data about you:

• To other companies within the Schneider Electric group, for our general business and workforce management purposes (including the benchmarking and approval of applicants) and for shared group services, including recruitment services which are shared by Schneider Electric’s software companies.
• To our suppliers and agents (for example, third parties who assist with recruitment, online recruitment platforms, candidate screening, immigration and right to work checks).
• If we transfer, reorganize, merge or sell any part of our business; and
• If we are required or permitted to do so to comply with any law or any regulatory reason.

6.2 Access rights between members of the Schneider Electric group are limited and granted only on a need to know basis, depending on job functions and roles. If we think that you might be suited to an alternative role elsewhere in the Schneider Electric group, we shall inform you of the vacancy and ask you to apply for the role.

6.3 Where we engage with a supplier or other third party to process your personal data, we will undertake due diligence to ensure that your personal data is appropriately protected and shall enter into written agreements imposing appropriate security standards on them, where appropriate. If personal data is transferred from the United Kingdom or European Economic Area, paragraph 7.2 applies.

7. International transfers

7.1 Due to our global operations and shared IT systems, your personal data may be transferred to and processed in another country.

7.2 We will ensure appropriate safeguards are in place in relation to international transfers of personal data to provide adequate levels of protection for your personal data and to comply with local laws and regulatory requirements. For transfers outside of the United Kingdom and European Economic Area, we use the standard model clauses approved by the European and United Kingdom data protection authorities.

8. Keeping your personal data secure

8.1 We have put in place appropriate security measures (as required by applicable data protection laws) to protect your personal data from unlawful or unauthorized processing and to prevent accidental loss, destruction or damage. We limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. Where they act on our behalf, they will only process your personal data on our instructions, and they will be subject to a duty of confidentiality. Details of these measures can be obtained from the Data Privacy Team.

9. How long we keep your personal data

9.1 If your application is successful and you become employed by or contracted with us, we will keep your personal data in accordance with the RIB Group Privacy notice for Employees, Workers and Contractors. A copy will be provided to you.

9.2 If your application is unsuccessful, we will only retain your personal data for a limited period of time, depending on any laws or regulations that we are required to follow and the need to keep your personal data for a valid reason. In general, we will keep the personal data you provided as part of your application, for 12 months after the end of the recruitment process, unless you provide consent for us to keep it for longer. For candidates based in Germany, Switzerland and Bulgaria personal data shall be retained for 6 months

10. Your rights

10.1 Under certain circumstances, by law you may have the right to:

• Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
• Request correction of the personal information that we hold about you.
• Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
• Object to processing of your personal information where we are relying on a legitimate interest and there is something about your particular situation which makes you want to object to processing on this ground.
• Request the restriction of processing of your personal information.
• Request the transfer of your personal information to another party.

10.2 Where our processing of your personal data is based on your consent, you have the right to withdraw your consent at any time and we will stop processing your personal data for that purpose, unless there is another lawful basis we can rely on – in which case, we will let you know.

10.3 If you wish to exercise any of your rights please contact the Data Privacy Team. If you believe that we have processed your personal data in violation of the law, you have the right to lodge a complaint with our Data Privacy Team or the supervisory authority located in your country (the Data Privacy Team shall provide information on the relevant supervisory authority).

11. Updates to this notice

11.1 We may update this notice from time to time to make sure it is up-to-date and accurate.

12. Further information

12.1 We have Data Protection Officers appointed where we are required to do so (see our website Privacy Notice). We also have a central Data Privacy Team whose role is to inform and advise us about, and to ensure that we remain compliant with, data privacy legislation. The Data Privacy Team should be your first point of contact if you have any queries or concerns about your personal data. Our Data Privacy Team can be contacted at [email protected].

Schedule 1: The data we collect and use

The data we collect	Why we collect the data (purpose)	Legal basis for processing (we rely on consent plus legal bases set out below)
Part A: Up to and including the shortlisting stage
Your name and contact details (ie address, home and mobile phone numbers, email address)	So that we can contact you, where necessary to progress your application, arrange interviews and inform you of the outcome and inform the relevant manager or department of your application	-Legitimate interest: to carry out fair recruitment process and to progress your application, arrange interviews and inform you of the outcome
Details of your qualifications, experience, employment history (including job titles and working hours) and interests	So that we can make an informed decision about which candidates to shortlist for interview and ultimately recruit	-Legitimate interest: to carry out fair recruitment process and to make an informed decision to shortlist for interview and (if relevant) to recruit
Nationality, citizenship status, place of birth, date of birth, gender	So that we can make an informed decision about which candidates to shortlist for interview and ultimately recruit	-Legitimate interest: to carry out fair recruitment process and to make an informed decision to shortlist for interview and (if relevant) to recruit -Explicit consent required for sensitive personal data
Your racial or ethnic origin, sex and sexual orientation, religious or similar beliefs*	To comply with our equal opportunities monitoring obligations and to follow our policies	-Legitimate interest: to rebalance our workforce and against targets set and to ensure we have inclusionary policies -To comply with our legal obligations and for reasons of substantial public interest (equality of opportunity or treatment) -Explicit consent required for sensitive personal data
Details of your referees	To obtain a reference about you, to make an informed decision about your recruitment	-Legitimate interest: to carry out a fair recruitment process
Any other data you choose to provide	–	–
Part B: Before making a final decision to recruit
Information about your previous academic, employment history (including details of any qualifications, conduct or performance issues, appraisals, time and attendance, references)	So that we can make an informed decision about your recruitment and comply with any legal/regulatory obligations	-Legitimate interests: to make an informed decision to recruit, maintain employment records, verify the qualifications information provided by you -To comply with any legal obligations placed on us in respect of the particular role
Only where required by law or where specific role justifies it (see note 2): Background checks, nationality and immigration status checks, data regarding your criminal record* or fitness for work information*	To make an informed recruitment decision, to enter into/perform the employment contract and to comply with our legal obligations	-To meet a legal requirement -Legitimate interest: to verify the background, rights to work and criminal records data provided by you or to ensure you are fit to perform the duties -For the purposes of obligations and rights in employment and social security law

Notes:

1. The categories of personal data marked with * above contain sensitive personal data and may place additional legal requirements upon us under data privacy laws. We will comply with all legal requirements in respect of these sensitive personal data categories and will not process them in countries where it is prohibited to do so.
2. The necessity and scope of the data collection depends on the position to be filled. If the position involves the performance of particularly confidential tasks, increased personnel and/or financial responsibility, or is linked to certain physical and health requirements, more extensive data collection may be necessary. In order to protect data privacy, such data processing will only take place after the selection of applicants has been completed and immediately before you are hired.