Privacy Policy

This privacy policy is intended to inform you of the conditions of the collection and processing of personal data collected or processed by CLUSTREE in accordance with the applicable Data Protection Regulation.

 

The terms “you” and “your” refer, as applicable, to the Clients, Users, Candidates, CLUSTREE’s Suppliers and Visitors to the Website.

1.          Definitions

The terms hereinafter shall be defined as follows, whether they are used in the singular or in the plural:

  • Access: Refers to the process by which Users access the Solution by using an identifier (e-mail address) and a password or, if applicable, via a Single Sign-On. Accesses are determined by the Client based on the Users, which may be either:
    • HR User Access: Access intended for the teams responsible for human resources within the Client’s company covering all Services in the Solution in order to manage job opportunities broadcast by the Client, Client employee applications or Client recruitment candidate, User Profiles and to access analyses performed by the Solution;
    • Profile Access: Access to a Client employee or Client recruitment candidate account, which allows the User in question to complete or even create a personal profile with information on his or her career, skills and, more generally, Professional life, to apply for vacant positions and/or career opportunities within the Client’s company. [N.B.: Profile Accesses are optional; the Client may decide to provide them or even delete them at any time]

The Client is solely responsible for these Accesses, i.e., User identification and authentication, control of User Access to the Solution, for the protection against unauthorized User Access, and for the confidentiality of User names, passwords, and other information related to Users’ accounts.

  • Applicable data protection regulation: Refers to the “Loi Informatique et Libertés” (French Data Protection) Act 78-17 of January 6, 1978, in its latest version in effect and regulation 2016/679 on data protection.
  • Client: Refers to companies which have subscribed to the CLUSTREE Solution and which are proposing internal or external Offers to Users.
  • Candidate: Refers to individuals who have submitted an application for a job at CLUSTREE.
  • Data: Refers to all the data and information that are collected and processed by CLUSTREE and concern Users, Candidates, Suppliers, and Visitors and may be classified as personal data within the meaning of the applicable Data Protection Regulation.
  • Offers: Refers to offers for vacant positions and/or careers proposed or planned by the Client, which are available through the Solution.
  • Professional life: Refers to the data on career path, university courses, degrees, skills, positions, duties, seniority and any other data that is directly related to the work experience and skills of an individual.
  • Profile: Refers to the User’s account, whether the User is a Client employee or candidate for recruitment by the Client, in which data about his or her identity, Professional life and the Offers for which he applied are entered.
  • Services: Refers to the Solution features that are available to the User through the Access granted to him by the Client.
  • Solution: Refers to the Saas platform accessible via the Accesses, which is edited and maintained by CLUSTREE (simplified joint-stock company, registered with the Paris Business and Trade Registry (RCS) under number 798 427 290, with its headquarters located at 42 rue de Faubourg Poissonnière 75010 PARIS)
  • Supplier: Refers to legal entities that provide goods and/or services to CLUSTREE
  • User: Refers to individuals who have Access to the Solution based on authorizations defined and set by the Client and who can access the Services within the framework of these personal, individual Accesses.
  • Visitors: Refers to any individual or legal entity who accesses the Website.
  • Website: Refers to the website https://www.clustree.com/.

The terms “personal data“, “processing“, “processed“, “data subjects“, “data controller” and ” data processor” have the same meaning as in the applicable Data Protection Regulation.

 

2.          What are the Data categories processed by CLUSTREE?

CLUSTREE may collect various types of information depending on the nature and the purpose of the personal data it processes and the type of data subjects concerned. In all cases, CLUSTREE undertakes to collect and process only the data strictly necessary for the purposes intended for the data processing it carries out.

2.1       With respect to the Users of the Solution:

  • Administrative Data for HR Users: Identity of the manager and of the recruiter
  • Data on Users with a Profile: Identity of the candidate / CV / elements related to career path / skills / training / career development / annual performance review meeting
  • Connection Data: IP address, computer connection history and actions of Solution Users

Within the framework of the Data collection forms provided within the Solution, if the Data listed above must be included in order to allow full and complete access or execution of the Services, such Data will be identified with an asterisk.

2.2       With respect to CLUSTREE Clients and prospects:

  • Identity-related Data: civil status, last name, first and middle names, address, telephone number (landline and/or cell phone), fax number, email address, date of birth, internal processing code to allow for Client identification. A copy of an identification card is kept as proof of the exercise of an access right, correction or opposition right or to meet a legal obligation
  • Financial Data: Bank account details of the legal entity to be invoiced
  • Data to monitor the business relationship: Requests for documentation, services subscribed, frequency, order number, correspondence with the client and after-sales service, revews from clients and prospects, person or persons responsible for the client relationship
  • Data on payment of invoices
  • Data necessary to conduct loyalty programs, prospecting, studies, surveys, tests and promotion
  • Data relating to any promotional operation
  • Data on the contributions of persons who submit reviews on the CLUSTREE solution: particularly, the pseudonym of these persons

2.3       With respect to Candidates for a position within CLUSTREE:

  • The Data on the identity of the Candidates: Last name, first name, e-mail address
  • Data on the Candidate’s Professional Life: recent experiences, degrees, etc.
  • and, more generally, any other information that the Candidates decide to communicate in their Curriculum Vitae and/or cover letter

 

CLUSTREE does not wish to receive sensitive Data from you, particularly any information on your origin, state of health, morals, sexual orientation, political opinions, trade union activities, religious beliefs, affiliation or non- affiliation with an ethnic group, nation or race. Any communication of this type of sensitive information may result in the rejection of your application within CLUSTREE.

2.4       With respect to Visitors to the Website:

  • Connection Data: Date, time, Internet address, Visitor’s computer protocol, page viewed on the Website

2.5       With respect to CLUSTREE Suppliers:

  • Data on the Supplier’s identity: Company name, first and last name / title of the contact person, address (headquarters, billing address), telephone, fax, e-mail address, SIREN number
  • Data on billing and the payment of Supplier invoices

3.          For what purposes is the Data processed?

3.1       For Users of the Solution.

The Solution is implemented for the needs and at the request of CLUSTREE’s Clients, within the framework of their human resources management and, more specifically, their internal mobility and recruitment. Therefore CLUSTREE, as a data processor, processes the Data of Solution Users in the name and on behalf of its Clients, and in accordance with their instructions, in compliance with the Applicable Data Protection Regulation. The Clients remain responsible for the processing. To learn more about each party’s respective obligations, CLUSTREE invites Users to refer to the privacy policy of their employer.

Data processing executed by CLUSTREE within the framework of its Solution is intended to facilitate the identification of job offers for employees wishing to change positions internally, or conversely, the identification of employees for a position.

CLUSTREE does so using a “matching” algorithm based primarily on skills in order to provide these recommendations.

CLUSTREE also processes User Data to allow them to benefit from technical support in the use of the Solution and to develop statistics to improve the use of the Solution.

In accordance with its own privacy policy, the Client ensures that the User with Access expressly grants consent for the Data to be processed by CLUSTREE for the aforementioned purposes.

3.2       With respect to Clients and prospects.

CLUSTREE processes its Clients’ Data for the sole purpose of managing contracts and orders, providing support to Solution Users, issuing invoices and monitoring payment, managing potential debts, accounting, monitoring the Client relationship and retention, the opinions of persons within the Solution and developing business and Solution usage statistics. Prospect Data is processed in order to carry out prospecting, studies, surveys, product testing, promotion and solicitation operations.

3.3       With respect to Candidates for a position at CLUSTREE.

CLUSTREE processes Candidate Data for the sole purpose of reviewing and processing applications, responding to their requests and conducting any physical and telephone interviews.

3.4       With respect to Visitors to the Website.

Visitors login Data is processed for the purposes of statistical estimations of Site traffic.

3.5       With respect to Suppliers.

CLUSTREE processes Supplier Data in order to manage administrative operations related to their contracts, orders, receipts, invoices, payments, and compatibility as it relates to the management of Supplier orders.

 

4.          Who are the recipients of your Data?

The Data will not be transferred, leased or exchanged for the benefit of third parties for purposes other than those described below.

4.1       With respect to Solution Users.

All Data collected and processed in the Solution within the Client space will be available to Users with an HR User Access (and according to the authorizations stipulated by the Client) and to CLUSTREE’s strictly authorized personnel (support department).

4.2       With respect to Clients and prospects.

Authorized persons from CLUSTREE’s sales and marketing department, and the support department, are required to process your Data and have Access only to the Data they require within the framework their duties

4.3       With respect to Candidates for a position at CLUSTREE.

The Data collected and processed may be sent:

  • To managers in charge of recruitment;
  • To head hunter firms / employment agencies.

4.4       With respect to Visitors to the Site. The Data collected and processed may be sent:

  • To the information and external communication department within CLUSTREE;
  • To CLUSTREE’s communications and public relations agencies.

4.5       With respect to Suppliers. The Data collected and processed may be transmitted to:

  • the personnel responsible for the procurement department, administrative and accounting departments, their hierarchical superiors, and persons contractually working with CLUSTREE or to an organization to conduct its accounting;
  • external firms bound by contract for the performance of Suppliers’ contracts
  • the persons responsible for auditing the accounts;
  • court and ministry officers in the context of their mission to collect debts;
  • financial institutions holding active accounts.

4.6       Other recipients.

In General, all of the aforementioned Data may also be communicated to authorized CLUSTREE service providers and subcontractors, such as computer systems providers, hosts, payroll subcontractors, consultants (such as CLUSTREE’s legal counsel) and other suppliers of goods and services, and any authority legally authorized to know it/access it, especially judicial, police or administrative authorities.

 

5.          How long will the Data be kept?

The CLUSTREE company keeps Data only for a period necessary and proportionate to the purpose for which it has been collected. Thus, the periods are specified for each Data category in the following table:

Data categoriesRetention time
Solution User DataRetention for as long as the User’s Access is active and in accordance with the Data retention policy applied by the Client. In principle, the Data retention period is that of the subscription chosen by the Client + 3 months; at the end of this period, the Data is deleted. However, the Solution provides that the deletion of Offers results in the deletion of the applications related to this Offer
Client and prospect DataCustomer Data used for prospecting purposes: Period strictly necessary for the management of the business relationship (in principle, the duration of the business relationship with the Client + 5 years)

Personal data relative to non-client prospects: 3 years from collection by CLUSTREE or the last contact from the prospect (for example, a request for documentation or click on a hypertext link contained in an email; however, the opening of an e-mail is not considered a contact from the prospect)

Data for Candidates for a position at CLUSTREERetention for 2 years after transmission of the Data when the Candidate is not selected
Website login DataThe information stored in the User’s terminal or any other element that is used to identify the User and allow for tracking them or their usage (such as logs or connection Data) will not be kept longer than 1 year
Supplier DataRetention for the duration of the contractual relationship and for a period of five years thereafter

 

6.          What are your rights?

According to the applicable Data Protection Regulation, you have the following rights:

  • The right to obtain confirmation by the data controller that your Data is processed, as well as a right to access the Data collected and processed within this context;
  • The right to the correction of your Data, by the data controller, when it is incorrect or incomplete;
  • The right to the deletion of your Data by the data controller in accordance with the conditions stipulated by the Applicable Data Protection Regulation;
  • The right to limit the processing of your Data by the data controller;
  • The right to legitimately object to the processing of your Data by the data controller, and to the use of this Data for business prospecting purposes.

When CLUSTREE is acting as a data controller, *you can exercise your rights by sending an e-mail to privacy@clustree.fr. We undertake to answer your requests within one month from the* receipt of the request; this period may be extended to 2 months, taking into account the complexity and number of the requests

 

On the other hand, Users will be able to exercize their rights not with CLUSTREE, which is acting as a data processor, but with the Client by writing to the Client’s Data Privacy point of contact, as indicated in their data privacy policy.

The exercise of these rights must also be compatible with the legal obligations of and the legitimate interests pursued by the data controller.

In the event of a dispute, you have the right to file a complaint with the French Data Protection Authority (Commission Nationale de l’Informatique et des Libertés).

7.          What security measures are implemented?

All useful precautions and appropriate organizational and technical measures are taken in order to preserve the security, integrity and confidentiality of the Data, including to prevent alteration or damage to the Data, or access to the Data by unauthorized third parties.

In the event of risk, proven or potential, identified by the Client, the Client agrees to alert CLUSTREE immediately so that measures are taken as a result.

Thus, loss or disclosure of Access may be considered a Data security risk. In such a case, the User may request a change in his or her password via the “forgot password” function provided for in the Solution.

Moreover, the Clients, in order to preserve Data confidentiality, ensure that Users keep the following information strictly confidential:

  • Their Access, in order to prevent third parties from accessing the Data, even if the third party is a Client employee;
  • The Data to which they have access within the context of HR Users Access.

8.          Transfer of Data to third parties

In order to meet its legal and contractual obligations, CLUSTREE may transfer all or a portion of the processed Data to trusted third parties, such as computer systems providers, hosts, payroll subcontractors, consultants (such as CLUSTREE’s legal counsel) and other suppliers of goods and services.

Within this context, and in accordance with Article 28 of Regulation 2016/679, CLUSTREE works only with data processors offering sufficient guarantees in order to ensure protection of the rights of the Users in question.

Moreover, CLUSTREE guarantees that it does not transfer Data to countries that do not provide an adequate level of protection, without first implementing one or more of the safeguards provided for by the applicable Data Protection Regulation to regulate said transfer, namely through the use of standard contractual clauses approved by the EU.

9.          Cookies

Cookies are text files, often encrypted, stored in your browser. They are created when the browser of an internet user loads a given internet website: the website sends information to the browser, which then creates a text file. Whenever a user returns to the same website, the browser retrieves this file and sends it to the website’s server.

There are two types of cookies, which do not have the same purpose: technical cookies and advertising cookies:

  • Technical cookies are used while you are browsing, in order to facilitate and execute certain functions. For example, a technical cookie can be used to store the answers completed in a form, or the internet user’s preferences for the language or the presentation of a website, when such options are available.
  • Advertising cookies can be created not only by the website on which the internet user navigates, but also by other websites disseminating advertisements, announcements, widgets or other elements on the page displayed. In particular, these cookies can be used to target advertising, i.e. advertising based on user navigation.

Within the Solution, only technical and audience statistics cookies are installed:

  • Technical cookies are stored in the User’s browser for a period of twelve (12) months.
  • The statistical audience analysis tool generates a cookie to measure the use of the Solution, the number of page views and User activity. The retention time for this cookie is limited to 12 months. As part of the installation of these cookies, the IP address is also collected in order to determine the city from which access to the Solution is executed.

On the Site, both audience statistics cookies and advertising cookies are installed allowing for advertisements targeted to the Website’s Visitors. These cookies have a retention period limited to 12 months.

Finally, it is possible to oppose the use of cookies by configuring your browser as follows:

For Mozilla Firefox

  1. Select the “Tools” menu followed by “Options”,
  2. Click on the “Privacy” icon,
  3. Locate the “Cookie” menu and select the options that suit you.

For Microsoft Internet Explorer 6.0

  1. Select the “Tools” menu followed by “Internet Options”,
  2. Click on the “Confidentiality” tab,
  3. Select the desired level using the cursor.

For Microsoft Internet Explorer 5

  1. Select the “Tools” menu followed by “Internet Options”,
  2. Click on the “Confidentiality” tab.
  3. Customize the level using the cursor.

For Netscape 6.X and 7. X

  1. Select the “Edit” > “Preferences” menu,
  2. “Confidentiality and Security”,
  3. “Cookies”.

For Opera 6.0 and above

  1. Select the “File” > “Preferences” menu,
  2. “Privacy”.

However, it is possible that this refusal will disrupt the Website or the Solution’s functionality, or even jeopardize access to the Website or the Solution.

10.       Websites belonging to third-parties

Links present on the Website can direct you to outside sites over which CLUSTREE has no control. The data protection policies of these websites may differ from this policy, and we invite you to take note of that. In any event, CLUSTREE’s cannot be held responsible in the event that the content of one of those websites in question would contravene the legal and regulatory provisions in effect.

11.       Update to this privacy policy

This privacy policy may be modified or adapted at any time.

CLUSTREE will inform you of the changes made via the usual means of communication used to communicate with you.

The updated Privacy policy will take effect as of its publication on the website or within the Solution.

12.       Entire Agreement

In the event that one of the clauses of this privacy policy becomes null and void as a result of a change in the law, the application Data Protection Regulation, or a court decision, this shall not in any manner affect the validity of and compliance with the other clauses of the privacy policy.

Last modification: 05/20/2019.