Our HR privacy notice applies to:

• Applicants for a position in MOLITOR answering to a recruitment advertisement or sending an unsolicited application;
• Employees of MOLITOR; and
• Associates of MOLITOR.

This notice is intended to inform you about the processing of personal data which MOLITOR handle as Data Controller in compliance with the Labour Law and with applicable data protection laws including the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR).

1. WHO IS RESPONSIBLE FOR YOUR PERSONAL DATA?

MOLITOR is responsible for the processing of your personal data, through its HR Manager, Ms Sophie ICHER. For any concerns regarding your personal data, please feel free to contact her:

MOLITOR Avocats à la Cour

Attn.: Ms Sophie ICHER

Head of HR and Organisation

sophie.icher@molitorlegal.lu

privacy@molitorlegal.lu

TEL: +352 297 298 1

2. WHAT PERSONAL DATA DO WE COLLECT ABOUT YOU?

The personal data that we process concerns:

• Identity data(first name, last name, phone number, email, ID card/passport number, birth place, signature, social security number, address, vehicle registration number);
• Banking or financial data (banking details, VAT numbers);
• Personal characteristics (age, gender, nationality);
• Physical data (photo and height such as appears on your ID card);
• Household composition (household composition, close relatives’ phone numbers);
• Hobbies and interests (as appears on your CV);
• Education, training and degrees (motivation letter, educational level, degree, language skills, computer skills, training, bar membership);
• Position and employment (present professional position, responsibilities, employment history/past collaboration);
• Salaries (amount of salary, payslips, tax revenue number);
• Professional appraisal (comments made during the appraisal meeting); and
• Data related to the attendance at work (attendance planning, annual leave register, request for day off/ short absence, management of sickness leave).

In compliance with our recruitment proceedings and in order to enforce our contract, you are required to give us these personal data and to inform us of any changes.

3. HOW DO WE OBTAIN YOUR PERSONAL DATA?

We may collect and process your data in several circumstances:

• When you apply for a position at MOLITOR;
• When we receive an unsolicited application for a fixed position or for a traineeship;
• When you apply for a position at MOLITOR through a recruitment agency;
• During our contractual relationship;
• During your training at MOLITOR;
• During your association with MOLITOR;
• At the end of your training;
• At the end of our contractual relationship;
• At the end of your collaboration with MOLITOR.

4. HOW DO WE USE YOUR PERSONAL DATA?

We use your personal data for the following purposes:

• The Management of applications in compliance with our recruitment process;
• The management of our employees and our associates;
• The management of in-house or external training for our associates;
• The work planning of our employees and associates;
• The enforcement of your employment contract or cooperation contract (e.g. the processing of salaries);
• The protection of our premises and the security of our IT systems (through our IT infrastructure, usage of keys, usage of cards for the car park);
• The health and security of our employees and associates (through video monitoring);
• Our legal duties (e.g. tax revenue calculation).

The processing of your personal data is required before the contract starts, for managing our application programme (recruitment) or for the enforcement of your employment contract, for complying with our legal duties or for our legitimate interests to protect our employees, our premises or our infrastructures (Article 6 1. b), c) and f) of the GDPR).

5. WHO DO WE SHARE YOUR PERSONAL DATA WITH?

To comply with our legal and regulatory duties and obligations, and to perform the above processes, we may share your personal data with certain trusted third parties, including:

• Tax administration, banks, the Luxembourg Social Security Administration, our payroll company, the Luxembourg Bar;
• The university or school where you study for the requirements of the traineeship at MOLITOR;
• Our IT Manager, for identification purposes relating to the usage made by our employees and associates of provided IT systems;
• Our Security Manager, for identification purposes relating to the usage made by our employees and associates of any keys or car park cards provided;
• People responsible for MOLITOR departments which you are assigned to;
• Training institutions, local or international associations which you participate in, contribute to or at which you attend events, workshops or other training they organise;
• Travel agencies, airline companies or accommodation providers when you travel for professional reasons at MOLITOR’s request;
• Legal Directories (e.g. The Legal 500, IFLR1000 or Chambers & Partners) and other publishers when you contribute to articles, or attend a workshop or a seminar.

6. WHICH COUNTRIES DO WE TRANSFER YOUR PERSONAL DATA TO?

We usually do not transfer your personal data to locations outside the European Economic Area or to an international organisation.

Where this is the case, only for the purposes set out in this privacy notice, the Law Firm certifies to previously inform you so that your personal information remains protected and secure in accordance with GDPR regulation

7. HOW DO WE PROTECT YOUR PERSONAL DATA AND HOW LONG DO WE KEEP THEM?

We commit that your personal data will be kept secure by the HR Manager for the purposes set out in this privacy notice only for the requested period.

We commit to keep your personal data only within the following time-limits:

• If your employment application is unsuccessful, we will keep your processed personal data during our application process and for a maximum of 12 months after the rejection of your application;

Other personal data will be kept for a maximum of 10 years after the end of our employment relationship.

8. WHAT ARE YOUR RIGHTS REGARDING YOUR PERSONAL DATA?

GDPR entitles you to specific rights according to legal grounds used by MOLITOR to process your personal data.

Under GDPR, you are entitled to:

• Obtain details of the personal data we hold and how we process it (“right of access”);
• Have your inaccurate personal data modified or have your incomplete personal data completed (“right to rectification”);
• Have your personal data deleted in the following circumstances: (i) when your data are no longer needed for the purposes set out in this privacy notice; (ii) when you no longer agree to have your data processed and when there is no other legal grounds on which MOLITOR can process your data; (iii) when you no longer want your data to be processed and when there are no compelling legitimate grounds on which MOLITOR can process your data; (iv) when your data are processed illegally; (v) when your data are to be deleted for a legal reason (“right to be forgotten”);
• Object to the processing of your personal data in 2 circumstances: (i) when we have to obtain your consent to process your data, you can object to the processing without giving any reasons; and (ii) when we process your data for our legitimate interests, you can object to its processing by giving reasons relating to your situation, unless MOLITOR is able to prove that there are compelling legitimate grounds overriding your interests, rights and freedom or to enforce, exercise or defend its own interests in court (“right to objection of processing”);
• Restrict the processing of your personal data so that a verification can take place (verify the data accuracy, the legal grounds of the processing, the legitimate reasons given by MOLITOR when you don’t agree with the processing), or when the processing is illegal but  you don’t agree to deleting the data (“right to restriction of processing”);
  Have your personal data transferred to another employer/law firm. You are entitled to this right when we have to obtain your agreement to process your data or when enforcing the employment contract and when the processing is automated (“right to data portability”).

If you have any other questions or if you would like to make a claim regarding the processing of your personal data, please send an email to privacy@molitorlegal.lu

Finally, you are entitled by the GDPR to lodge a complaint with a local supervisory authority.

In Luxembourg, you must apply to the Commission Nationale pour la Protection des Données (https://cnpd.public.lu/fr.html).