Information notice on the protection of personal data - recruitment

Introduction

The client and the candidates are at the centre of CFL's concerns.

The protection of your personal data is consequently a priority for CFL and for each entity of the CFL Group that processes your personal data for the purposes of its activity.

This notice provides the necessary information and explains how we collect, use, share, store and protect your personal information in the recruitment process.

It also informs you of your rights and how to exercise them.

1. Who is the data controller?

The Société Nationale des Chemins de Fer Luxembourgeois (CFL), established and having its registered office in 9 Place de la Gare, L-1616 Luxembourg, registered with the Registre de Commerce et des Sociétés [Trade and Companies Register] (Luxembourg) under number B59025, is the Controller of the personal data that we process when you apply to CFL, CFL Mobility, CFL Evasion or CFL Immo.

CFL multimodal, established and having its registered office at 100 ZAE Wolser E, L-3437 Dudelange (Terminal Intermodal Eurohub Sud) [Eurohub South Intermodal Terminal], registered with the Registre de Commerce et des Sociétés [Trade and Companies Register] (Luxembourg) under number B 88577, is the Controller of the personal data we process when you apply for CFL multimodal, CFL intermodal, CFL terminals, CFL logistics, CFL site services, CFL cargo or CFL cargo France.

2. What categories of personal data are processed and for what purposes?

The mission of CFL and CFL multimodal (hereinafter referred to as CFL) is to transport people and goods, and to manage and make investments in rolling stock and in the modernization of its infrastructure and facilities.

To carry out these tasks, we may collect and process the following personal data:

• surname, name, civil status, telephone number, e-mail address, postal address,
• a birth certificate, proof of address,
• the data indicated on your curriculum vitae (date and place of birth, photo, hobbies, marital status, address, etc.),
• information about your background given in your letter of motivation,                    
• driving license if required for the position,                                       
• copies of diplomas, reports and transcripts,
• languages and level of proficiency,
• registration in the register of university degrees,
• the certificate of equivalence of my diplomas or certificates,
• pre-screening exams and results (if available),
• interview and pre-selection reports.                                                       

Your personal data are processed for the purpose of:

• recruitment management: selection of candidates, verification of the professional aptitude of the candidates,
• sending surveys,
• conducting satisfaction surveys relating to recruitment.

Your data may also be used to check your career path with your former employers.
 
In certain cases, we also process sensitive data, namely:

• criminal records,
• health data relating occupational health and interviews with psychologists.

You will be provided with additional information if you are required to undergo a psychological evaluation by occupational psychologists and/or a medical examination by occupational physicians.
We make sure that your data in all cases are collected for specific purposes and that they are processed in an appropriate and relevant manner and only to the extent necessary for said purposes.

3. How do we collect, process and use your data?

We collect and use the personal data you provide when you apply for a position with CFL, including its subsidiaries.    
​ For each afore-described purpose, the collection and processing of your data are:

• carried out in accordance with applicable regulations on the protection of personal data including the GDPR (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), the Guidelines thereto and national laws implementing the GDPR where applicable,
• legally based:
  • either on the fact that the processing of your personal data is necessary for the performance of a contract to which you are party or for the performance of pre-contractual measures taken at your request; or
  • on your consent; or
  • on an interest recognized as legitimate; or
  • on the fact that the processing is necessary for compliance with a legal obligation to which we are subject as data controller.

4. Who has access to your data?

We ensure that the processing of your personal data is carried out in compliance with the afore-indicated purposes.
Such data are shared with some of our internal departments in strict compliance with the missions entrusted to them.

• the departments concerned with recruitment (only the CV and cover letter),
• the Occupational Health division,
• the Psychology division,
• the Legal and Insurance Division,
• the Internal Audit department.

5. Where is your data processed?

Your data is processed by CFL, which takes all appropriate technical and organisational measures to protect the security thereof and, in particular, their confidentiality, integrity and availability.

IT service providers may have access to certain personal data in the context of maintenance work carried out at the request of the competent departments of CFL.

CFL may transfer your personal data outside the European Union. In such case, we contractually impose security and confidentiality safeguards for your personal data on service providers through appropriate technical and organizational measures, such as standard contractual clauses in accordance with European regulations, and ensure that these safeguards are duly complied with.

We acknowledge the invalidation of the Privacy Shield. We take steps to ensure that the level of protection for your personal data to the United States remains adequate.

6. How long do we keep your data?

We retain some of your personal data for three years as of the date of first contact with unsuccessful candidate unless you should decide otherwise.

7. What rights do you have with respect to your personal data?

Under the conditions set out in the regulations, you have the right to:

• access the personal data we hold about you,
• have the data corrected if they are inaccurate or incomplete,
• have the data removed in certain cases, such as, for example, whenever your data are no longer necessary for the purpose for which they were collected and or processed and we have not yet done because  legal and regulatory obligations applicable to the period of retention of the data have expired
• request the restriction of the processing of your personal data, such as the restriction of the processing of data whose accuracy you question and for the period of time we need to verify your request
• request the portability of your personal data in order to transmit them to you in a structured, commonly used and readable format or to have them transferred to another controller,
• withdraw your consent to the processing of your personal data at any time without prejudice to the lawfulness of the processing based on the consent given prior to your withdrawal and unless the processing is conducted on a legal basis other than your consent,
• object to the processing of your data based solely on the pursuit of our legitimate interests or prohibit us from processing them, including for direct marketing
• lodge a complaint with the competent authority for the protection of personal data in your country and/or in the Grand Duchy of Luxembourg (Commission Nationale pour la Protection des Données – CNPD [National Data Protection Commission), at 15, Boulevard du Jazz, L-4370 Esch-sur-Alzette - www.cnpd.public.lu ).

8. How to contact us and exercise your rights?

You can address your questions concerning the processing of your personal data and/or exercise your rights mentioned above:

• by post: for the attention of Data Protection Officer (DPO), 100, ZAE Wolser-E, L-3437 Dudelange or,
• by E-mail : DPO@cfl-mm.lu

Complaints about the processing of your personal data can be addressed to the above e-mail or postal address or to the supervisory authority of the Grand Duchy of Luxembourg, Commission Nationale Pour la Protection des Données – CNPD [National Data Protection Commission], 15 Boulevard du Jazz, L-4370 Esch-sur-Alzette - www.cnpd.public.lu.

9. How do we update this privacy notice?

CFL multimodal undertakes to update this privacy notice as and necessary so as to comply with the regulations in force.
The latest version in force is posted on our website.