Privacy policy for an expert to be registered in our expert database

(vE18.5.1)

Introduction

This privacy statement is provided to you by GOPA Luxembourg S.à.r.l. (hereafter in this text often abbreviated as GOPA or “we”), a company which is part of the GOPA Consulting Group, one of the leading European private and independent consulting groups in the area of development cooperation. Our clients are national and supranational institutions and organisations, such as national ministries or organisations like the European Commission or the World Bank. We are implementing projects for our clients by deploying own staff or by hiring and deploying freelance experts. Many of the projects are implemented by us alone, while others are implemented together with partner organisations and companies.

Data protection terminology used in this privacy policy

Our personal data processing activities are governed by the General Data Protection Regulation (Regulation (EU) 2016/679) which makes use of the following terminology.

‘Personal data’ is any information that can be used to identify you, including your name, email address, IP address, or any other data that could reveal your physical, physiological, generic, mental, economic, cultural or social identity.

For the purpose of the GDPRs, we are the ‘data controller’ of all personal data obtained by us as set out in this policy, because we ultimately determine how your personal data will be handled by us or our sub-contractors, who would be our ‘data processors’.

If we handle your personal data then you are a ‘data subject’. This means you have certain rights under the GDPR in relation to how your personal data is processed, which are set out in this privacy policy.

Name and address of the data controller

The responsible controller of your personal data is

GOPA Luxembourg S.à.r.l.

87 Route de Luxembourg

7240 Bereldange

Luxemburg

Email: statistics@gopa.lu

Website: www.gopa.lu

Data protection officer

You as data subject may, at any time, contact our Data Protection Officer directly with all questions and suggestions concerning data protection. The contact data of our Data Protection Officer is

GOPA Luxembourg S.à.r.l.

87 Route de Luxembourg

7240 Bereldange

Luxemburg

Email: dataprotectionofficer@gopa.lu

 

How we store and process your personal data

Within the scope of our expert recruiting process, we store your contact data (address, e-mail, telephone number, etc.), your curriculum vitae (CV) and any documentary evidence you may have supplied together with your CV (personal documents) in electronic form. In rare cases, we may also keep paper-based versions of your personal data, for instance if this is required by statutory obligations.

We process these personal data exclusively for the purpose of identification and selection of personnel for projects we are implementing or tendering at present or in the future.

The storage space for your CV and personal documents (such as diploma, work certificates, etc.) is our central database of experts. Besides this, we may store your personal data on our file servers, for instance when we rephrase, translate or shorten your CV for the purpose of the recruitment and deployment process.

We may also use your contact data to get in touch with you occasionally, for example to ask you for providing updates to your CV and personal documents. Please note that we do not use the personal data submitted with your CV for advertising purposes or the sending of newsletters etc.

How long we keep your personal data

On a regular basis, we keep your CV and related personal documents (such as diploma, work certificates, etc.) data in our expert database for a maximum of 3 years. We keep this data in our database longer only (i) after obtaining renewed consent from you, i.e. by contacting you through e-mail prior to the expiration of your expression of consent, or (ii) if we need them for the performance of a contract with you.

If we cannot obtain your renewed consent for any reason, we will delete your CV and related personal documents, or we block access to them if we are required by statutory obligations to keep them for a longer period (for instance for audit purposes obligatory in services provided through public procurement).

Legal basis for data processing

The legal basis for the processing of data is Art. 6 para. 1 lit. a GDPR in case the user has given his consent to the processing. In case we have to fulfil a contractual obligation to you, the legal basis is Art. 6 para. 1 lit. b GDPR. In case we are subject to statutory obligations the legal basis can be found in Art. 6 para. 1 lit. c GDPR.

Your rights in terms of data protection

As data subject you have the following rights in relation to your personal data:

• Right to confirmation – you can ask us to confirm whether we are processing personal data concerning you.
• Right to be informed – this is information on the personal data we are processing and the purpose for which we are processing them.
• Right of access – you have the right to be provided with copies of your personal data that we are processing.
• Right to rectification – if you think the personal data that we hold on you is inaccurate or incomplete you can request us to correct this.
• Right to erasure – if you want us to delete the personal data we are holding for you then you can request us to do so.
• Right to restrict processing – if you oppose the way how we are processing your personal data then you have the right to inform us accordingly and we will restrict the processing on the basis of your right.
• Right to data portability – if you want us to forward your personal data to a different organisation or person then you have the right to inform us and we will transfer your personal data respectively (without adversely affecting the rights of others).
• Right to withdraw your consent – you can withdraw your previously given consent to the processing of your personal data at any time by contacting us using the contact form provided.

If you want to exercise one or more of these rights, please contact one of our staff or use the general contact address provided above. You can request your rights free of charge unless your request is clearly unfounded, repetitive or excessive. Alternatively, in these circumstances we may refuse to comply with your request. In accordance with the GDPR, we will try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

In addition to the above rights, as a data subject you have the right to lodge a complaint with your local data protection authority within the European Union. Please note that you can use whichever local data protection authority within the European Union that is most convenient for you.

Transfer of personal data

The expert database we are using to store your CV and personal documents (such as diploma, work certificates, etc.) is a database that our authorised staff can access, as well as the authorised staff of the other companies of the GOPA Consulting Group. In this regard, your personal data may be transmitted to the other Group companies simply by sharing the access to this database by authorised staff. This helps us to identify staff for potential expert positions and it increases the possibility for you to be hired for a position.

In the course of our expert recruiting process we may transmit your CV and related personal documents (such as diploma, work certificates, etc.) also to other entities or bodies, for example to cooperating consulting companies or national or supranational authorities (ministries, EU authorities). Yet, before we would specifically propose you as expert for a project or tender, we will contact you again.

In cases where we are conducting or applying for a project located outside the EU or where we are cooperating with partners located outside the EU, we may transmit your CV and related personal documents also to entities and bodies outside the EU.

These transmissions are not taking place on a regular, but on an occasional basis, i.e. only if there is a particular project for which we would like to hire you, or a particular tender for which we would like to nominate you, or a particular business strategy we are pursuing with cooperating consulting companies, for instance in the strategic period before a certain tender procedure is launched.

Automated decision making and profiling

As a responsible company, we neither use automated decision making nor profiling.

Further information on personal data protection

For further aspects on how we process your personal data outside the recruitment process described in this privacy policy, please refer to our general privacy policy published on our website.

Deleting your personal data

We delete your personal data on a regular basis in accordance with the requirements of the GDPR.

As mentioned above, we delete your CV and related personal documents (such as diploma, work certificates, etc.) after a period of 3 years, unless we receive a renewed expression of consent from you, after we have contacted you again.

If we have to keep your CV and related personal documents longer due to statutory obligations, we delete them as soon as the statutory obligations allow. In the meantime, i.e. between the end of a 3-year storage period and the end of the storage period required by statutory obligations, we block access to your CV and related personal documents.

 

 

(end of privacy declaration, v18E.5.1)