Job applicant privacy policy

Last update: March 2024

As part of its recruitment process, the CSSF collects and processes personal data relating to job applicants. The CSSF is committed to being transparent about how it collects and uses that data and to meeting its data protection obligations (Regulation (EU) 2016/679 (“GDPR”)).

About the CSSF

The Commission de Surveillance du Secteur Financier (CSSF) is a Luxembourg public institution and the financial supervisory authority in charge of the supervision of the Luxembourg financial sector. The CSSF’s head office is located at 283, route d’Arlon L-1150 Luxembourg.

The CSSF has appointed an internal data protection officer for you to contact if you have any questions or concerns about the CSSF’s personal data policies or practices.

The CSSF’s data protection officer’s name and contact information are as follows:

DPO/Pascal Pirih
CSSF
283, route d’Arlon
L-1150 Luxembourg
dpo@cssf.lu
(+352) 26 25 1 2283

What information does the CSSF collect and how?

The CSSF collects a range of personal information. This includes:

• your name, last name, address, telephone number, email address;
• personal characteristics like your age, gender, date of birth, place of birth, marital status, nationality;
• your educational background and professional qualifications;
• your professional experience: employer, title and job description, date of recruitment, place of work, specialisation;
• information about your current level of remuneration, including benefit entitlements.

This information will be obtained from your application file and/or documents requested during the recruitment process. More details about the application file can be found under “Application & recruitment process“.

Data will be stored in different places, including in your application record, in the CSSF’s HR management systems and email system, all of which are in Luxembourg.

The CSSF does not use the information you provide to make any automated decisions that might affect you.

Why does the CSSF process your personal data?

The CSSF has a legitimate interest in processing your personal data during the recruitment process and in keeping records of the process. Processing data from job applicants allows managing the recruitment process and assessing and confirming a candidate’s suitability for employment. The CSSF may also need to process data from job applicants to respond to and defend against legal claims.

In some cases, data needs to be processed to ensure that the legal obligations are complied with. The CSSF will not use your data for any purpose other than the recruitment process of which you are a part.

Who has access to data?

In the process of analysing your application, your personal data may be shared internally within the CSSF. This includes members of the Human Resources department, people involved in job interviews and recruitment managers within the recruiting departments.

At a more advanced stage of the recruitment process, you may be asked to share your data with third parties in connection with the completion of questionnaires or tests.

How does the CSSF protect your data?

The CSSF takes the security of your data seriously. It has internal policies and controls in place to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by its personnel in the proper performance of their duties.

For how long does the CSSF keep your data?

If your application for employment is unsuccessful, your data will be kept for a period of maximum 4 months. After that period, your application file will be deleted or destroyed (unless it needs to be retained for longer to exercise or defend any legal claims). The CSSF will keep record of your application for a period of 5 years after which this record will also be deleted.

If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your employee file and retained during your employment. The periods for which employee data is held will be provided to you in a separate privacy notice.

Your rights

As a data subject, you have a number of rights under data protection law. Without prejudice to the limitations provided by the GDPR, you can:

• access and obtain a copy of your data on request;
• require the CSSF to change incorrect or incomplete data;
• require the CSSF to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing;
• object to the processing of your data where the CSSF is relying on its legitimate interests as the legal ground for processing; or
• ask the CSSF to transfer your data to another organisation.

If you have a complaint about the use of your information by the CSSF, we invite you to contact the CSSF directly so that your complaint can be addressed. However, you may also contact the CNPD via their website at www.cnpd.lu or write to them at:

Commission nationale pour la protection des données (CNPD)
Service des réclamations
15, Boulevard du Jazz
L-4370 Belvaux

What if you do not provide personal data?

You are under no statutory or contractual obligation to provide data to the CSSF during the recruitment process. However, if you do not provide the information, the CSSF may not be able to process your application.

Cookies

The CSSF uses cookies on the CSSF Careers website but they are not ‘intrusive’. This means that:

• they are not used to gather Personal Data about You in any way;
• the CSSF does not use targeting or advertising cookies that build up a profile.

When You use the CSSF Careers website notably to view the information the CSSF makes available, download documents or use online forms, a number of cookies are used by the CSSF and by third parties to allow the website to function and to collect useful information about visitors and to help to improve your user experience.

Updates to this privacy policy

The CSSF will regularly review and, if appropriate, update this privacy policy, as its services and use of personal data evolves. If the CSSF wants to make use of your personal data in a way that has not been previously identified, the CSSF will contact you to provide information about this and, if necessary, to ask for your consent.

The CSSF will update the version number and date of this page each time it is changed.