Privacy policy
How your personal data is collected and processed on this website and on the map&match platform.
Version V.2 / 2022-04
This is a translation, provided for information only. The French version is the one that applies.
Respect for privacy is a fundamental right and one of the core values of Human Capital Link (“HCL” or “we”), whose registered office is at 144, avenue Charles de Gaulle, 92200 Neuilly-sur-Seine, France.
HCL undertakes to comply with French and European personal data protection law, in particular the General Data Protection Regulation (EU) of 27 April 2016 (“GDPR”) and the French Data Protection Act of 6 January 1978 as amended (“LIL”).
This privacy policy sets out how your personal data is collected and processed on this website and on the map&match platform.
If you would like to know more about the cookies we use, please see our cookie policy.
1. Definitions
In this privacy policy, the following terms have the meaning given below.
- « Client(s) » :
- means HCL’s clients, authorised to give Users access to the map&match platform.
- « Visitor(s) » :
- means any visitor to this website.
- « Partner(s) » :
- means HCL’s partners, authorised to give Users access to the map&match platform.
- « User(s) » :
- means the Users of the map&match platform.
2. Where the personal data comes from
2.1. Personal data collected from the User
All personal data concerning map&match Users and/or Visitors is collected:
- (i) from them by HCL when their map&match accounts are created (in particular using the “magic link”), or through the forms or other documents Users complete when using map&match and this website;
- (ii) or from them by map&match Clients and Partners when registering their Users on map&match, or through the forms or other documents they complete when using map&match.
2.2. Personal data collected automatically
HCL automatically collects certain personal data, in particular through cookies. To find out more, please see our cookie policy.
3. Roles and responsibilities within the map&match ecosystem
Under the GDPR, the controller is the person who determines the means and purposes of the processing.
The processor is a person who processes personal data on the controller’s behalf. It acts under the controller’s authority and on its instructions.
This article sets out the respective responsibilities within the map&match ecosystem under the GDPR.
3.1. Responsibility for processing
Depending on the purposes for which your personal data is processed, HCL may act either as controller, or as processor for Clients and Partners, who then act as controllers.
In either case, whether HCL acts as controller or as processor under the GDPR, HCL always takes measures to protect your personal data.
3.2. Processing carried out by HCL as controller
HCL is the controller of your personal data for the following purposes:
| Why does HCL process your personal data? | What personal data is processed? | On what legal basis is this data processed? | How long is the personal data kept? |
|---|---|---|---|
| Cookies | see our policy | see our policy | see our policy |
| Answering requests sent by Visitors through the form(s) on this website | Surname(s) and first name(s) — Email — Postal address — Telephone — Any other data provided by the Visitor with their request | Consent of the data subject | We keep your personal data for as long as is needed to follow up our relationship with you, that is three (3) years from our last contact. |
| Registering and enabling use of the map&match platform for profiles created at HCL’s initiative (pro bono and commercial prospecting — in particular through the “magic link”) | Surname (and birth name) — First name — Gender — Email address — Telephone number — Company — Language — T5™ profile — Role — Team | Necessary for the performance of a contract to which the data subject is party, or to take steps at the data subject’s request prior to entering into a contract (acceptance of the map&match platform terms of use) | We keep your personal data for as long as you use the map&match platform, and for no more than [durée] after the end of the authorisation or contract giving you access to the map&match platform. |
| Running, improving and securing our services, by collecting information about how the map&match platform is reached and used | IP address — Browser type and version — Time and date of visit — Time spent on these pages — Pages selected | HCL’s legitimate interest in improving its services and the map&match platform | We keep your personal data for thirteen (13) months from collection. |
| Running, improving and securing our services, by collecting information about how this website is reached and used | IP address — Browser type and version — Time and date of visit — Time spent on these pages — Pages selected | HCL’s legitimate interest in improving its services and the map&match platform | We keep your personal data for thirteen (13) months from collection. |
| Providing Users with information about managing their User Account | Surname (and birth name) — First name — Gender — Email address — Telephone number — Company — Language — T5™ profile — Role — Team | Necessary for the performance of a contract to which the data subject is party, or to take steps at the data subject’s request prior to entering into a contract (acceptance of the map&match platform terms of use) | We keep your personal data for as long as you use the map&match platform, and for one (1) month after the end of the contract giving you access to the map&match platform. |
| IT prevention and security | Connection data for map&match and our website — Device used to browse — Operator — Browser type and version — IP address | HCL’s legitimate interest in ensuring the IT security of its website and of its map&match platform. | We keep your connection data for a maximum of six (6) months. |
| Providing support to Users of the map&match platform | Surname(s) and first name(s) — Email — Telephone | Necessary for the performance of a contract to which the data subject is party, or to take steps at the data subject’s request prior to entering into a contract (acceptance of the map&match platform terms of use) | We keep your personal data for as long as you use map&match, and for [durée] after the end of the contract giving you access to the map&match platform. |
| Exercise of your data protection rights | Surname — First name — Email address — Content of the request — Proof of identity | Legal obligation | Five (5) years from the date you ask to exercise one of your rights. |
3.3. Processing carried out by HCL as processor
HCL acts as processor of your personal data on behalf of Clients and/or Partners (who act as controllers), for the following purposes:
- Personal data processed to give their Users access to map&match (registering their Users, sending account initialisation emails, managing User profiles and the associated rights, and so on);
- Training their Users on map&match;
- Organising seminars at the Client’s or Partner’s request;
- Training map&match referents.
This list is not necessarily exhaustive, and it is for Clients or Partners to inform you of the processing they carry out on your personal data.
For any question or clarification about processing carried out by Clients or Partners (purpose, retention period, and so on) for which HCL is only the processor, we therefore recommend that you contact the Client or Partner directly, as controller.
In any event, Clients and Partners are solely responsible for the processing they carry out from their use of the map&match platform (advisory and support services, career management, recruitment, and so on), and in particular for any profiling and automated decision-making based on it.
4. Information about processing carried out by HCL as controller
4.1. Who receives your personal data when HCL acts as controller?
Strictly within the purposes set out above, your data is processed first of all by our own teams in the course of their usual work.
It is also shared with certain of our processors and suppliers (website manager, host of the map&match platform, and so on).
We require all such third parties to apply at least the basic security rules set out by the CNIL, the French data protection authority, on administrative, technical and organisational matters alike, so as to protect the data shared with them against unlawful disclosure, use, alteration and destruction.
HCL does not pass your personal data to commercial or advertising operators.
4.2. Is your personal data processed outside the European Economic Area?
Your personal data is processed within the European Economic Area (EEA) or the European Union, or in third countries offering an “adequate level” of personal data protection under the applicable rules.
Should HCL need to use suppliers located outside the EEA or the EU, and should such a transfer be made to a third country whose law has not been recognised as offering an adequate level of personal data protection, HCL will ensure that the necessary measures are put in place in accordance with the French Data Protection Act and the GDPR.
4.3. What are your rights?
Under Article 13 and Articles 15 to 22 of the GDPR, HCL informs you that you hold the following rights over your personal data:
a) Right of access : You have the right to request access to your personal data and to information about the purposes of the processing, the categories of personal data processed, the persons or categories of person to whom it has been or will be disclosed (indicating where those persons may be in third countries or international organisations), where possible the retention period or the criteria used to determine it, the existence of your rights to rectification and/or erasure of personal data, to restriction of processing and to object to processing, the origin of the data, and the existence and logic of any automated decision-making. If you exercise this right, and unless you say otherwise, you will receive an electronic copy of the personal data being processed.
b) Right to rectification : you have the right to obtain rectification of your personal data if it is inaccurate or incomplete;
c) Right to erasure : you have the right to obtain erasure of your personal data if one of the conditions of Article 17 of the GDPR is met (for example: if your personal data is no longer necessary for the purposes for which it was collected, if you decide to withdraw your consent to the processing — where that is the legal basis — and there is no other legal basis for the processing itself, if you object to the processing and no other legitimate interest of the controller prevails, or if your personal data is processed unlawfully);
d) Right to restriction : you have the right to obtain restriction of the processing of your personal data 1) for the time HCL needs to verify the accuracy of your personal data (if you have contested it), or 2) if the processing is unlawful and you ask for restriction rather than erasure, or 3) where HCL no longer needs your personal data but you need it to verify, exercise or defend a legal claim, or, finally, 4) for the time needed to assess whether the controller’s legitimate grounds override your own, if you have objected to the processing of your personal data under point f) below;
e) Right to portability : you have the right to obtain your personal data in a structured, commonly used and machine-readable format, including in order to transmit it to another controller, where the processing is based on consent or on a contract and is carried out by automated means. If you wish, you may ask HCL to transmit your personal data directly to the other controller, where that is technically possible;
f) Right to object : you also have the right to object to the processing of your personal data where it is carried out under Article 6.1(f) of the GDPR (to pursue a legitimate interest of the controller), unless the controller has legitimate grounds to carry on the processing, in accordance with Article 21 of the GDPR;
g) Right to withdraw your consent : you have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
h) Right to set what happens to your data after your death : you have the right to give general or specific directions on the retention, erasure and communication of your personal data after your death.
You may also lodge a complaint with the Commission nationale de l’informatique et des libertés (CNIL), the French data protection authority.
4.4. How do you exercise your rights?
To exercise your rights and/or obtain any information about the processing of your personal data, you may contact HCL at the following address, subject to proving your identity:
By post :
Protection des données personnellesHuman Capital Link144, avenue Charles de Gaulle92200 Neuilly-sur-Seine- By email : support@mapandmatch.com
4.5. For any request about personal data for which HCL is the processor for a Client or a Partner
If you wish to exercise your rights, you may contact the Client and/or Partner concerned directly.
As processor, we can assist them in following up requests from their Users, but we cannot answer your requests directly.