APPLICANT PRIVACY NOTICE

Applicable as of 25 May 2018 

1           Purpose of this Document

Mizuho Trust & Banking (Luxembourg) S.A. (“MHTBL”, the “Bank”, “we” or “us”) is committed to protecting the privacy and security of your personal data.

MHTBL, as data controller, is responsible for processing your data. This means that we are responsible for determining how we hold and use personal information about you. According to the General Data Protection Regulation (EU 2016/679) (GDPR) we, as data controller, are required to notify you of the information contained in this privacy notice.

The purpose of this privacy notice is to let you know which personal data we collect about you, the reasons why we use and share such data, how long we keep it, what your rights are and how you can exercise them.

It is important that you read and understand this notice. If you have questions or do not understand it fully, please seek additional information from the Bank’s Data Protection Coordinator by using the contact details provided at the end of this notice.

2           Personal information we collect about you

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We will collect, store, and use the following categories of personal information about you as listed below.

Personal basic data:

•                 personal contact details such as name, title, addresses, telephone numbers, and personal email addresses

•                 date of birth

•                 gender

•                 marital status and dependents

•                 government-issued identification numbers, such as national ID number or national insurance number

•                 nationality

•                 languages

•                 photo

•                 copy of your passport or identity card

Data related to your recruitment process:

•                 personal information included in you CV

•                 data relating to your work and education record and more specifically the information contained in your CV

•                 declarative data ( information provided during recruitment interviews by you or third party sources if they are relevant to the processing of your application)

•                 data collected using innovative solutions (video interviews to short-list candidates); technical data (login data used by you to access our website)

•                 data from video surveillance devices and devices used to record electronic communications, in accordance with applicable rules (e.g. security surveillance cameras on our premises)

•                 data made public at your initiative (e.g. profiles from professional social networks)

This data may be provided directly by you or collected from third parties.

3     Grounds for collecting and using your data

We collect and process your data for a number of purposes and where we have a legal basis to do so.

Legitimate interests

We have a legitimate interest in processing personal data during the recruitment process and for keeping records of the process. Processing data from job applicants allows us to manage the recruitment process, assess and confirm a candidate's suitability for employment and decide to whom to offer a job. We may also need to process data from job applicants to respond to and defend against legal claims.

Compliance with legal obligations

In some cases, we need to process data to ensure that we are complying with our legal obligations. For example, we are required to check a successful applicant's eligibility to work in Luxembourg before employment starts.

Special categories of data

We may process information about whether or not applicants are disabled so we can make reasonable adjustments for candidates who have a disability. Where we process other special categories of data, such as information about ethnic origin, sexual orientation, health or religion or belief, this is for equal opportunities monitoring purposes. Our processing of these types of data will be carried out to ensure you or us can meet our obligations or exercise our rights under law related to employment or (only where applicable) to enable us to establish, exercise or defend legal claims.

Further processing and other information

We will not use your data for any purpose other than the recruitment process of which you are a part. We ensure that the information you provide to us or that we collect through various channels (our website, our correspondence, conversations and interviews with our employees and particularly our recruitment consultants) are only used for the purposes indicated in this privacy notice. Please note that, regarding personal information we receive from recruitment consultants, we are not responsible for the processing of your personal data by those third parties and we are acting solely as recipient in this respect. 

4           Change of purpose

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and explain the legal basis which allows us to do so.

Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law. 

5           Automated decision making

You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making. There will always be human intervention into decisions based on automated processing, including automated analytics, testing, profiling.

However if this position changes, or there is a need and lawful base to do so, we will notify you in writing.

6           Transferring information outside the EU

As an international company, if necessary, we will transfer the personal information we collect about you to the Bank’s parent company (Mizuho Trust & Banking Co., Ltd.) and ultimate parent company (Mizuho Financial Group, Inc.) in Japan.

The European Commission adopted on 23 January 2019 its adequacy decision on Japan, allowing data to flow freely between the EU and Japan on the basis of the strong protection guarantees.

7           Data Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

We limit access to your personal data to those employees, agents, contractors and other third parties on a need-to-know basis, i.e. who need the access in order to fulfil the tasks and duties relating to service provision. All service providers are permitted to process your personal data based on our instructions, they are subject to a duty of confidentiality, and they are required to be compliant and demonstrate the compliance with Personal Data Protection.

Our IT systems are protected against unauthorised access with various level of controlled and password protected access rights.

When transferring or disclosing your personal data the safety measures vary based on the sensitivity of the data and may include e.g. strong identification of the recipient and encryption of the transferred information.

Any sensitive information (such as health-related information or any sensitive data required by local legislation) will usually be used separately from other personal data, and access rights to such sensitive personal data are granted only with weighty reasons to persons making decisions, usually HR representatives, direct manager and direct manager’s manager.