Last update: January 2019

As part of its recruitment process, the CSSF collects and processes personal data relating to job applicants. The CSSF is committed to being transparent about how it collects and uses that data and to meeting its data protection obligations (Regulation (EU) 2016/679 (“GDPR”)).

About the CSSF

The Commission de Surveillance du Secteur Financier (CSSF) is a Luxembourg public institution and the financial supervisory authority in charge of the supervision of the Luxembourg financial sector. The CSSF’s head office is located at 283, route d’Arlon L-1150 Luxembourg.

The CSSF has appointed an internal data protection officer for you to contact if you have any questions or concerns about the CSSF’s personal data policies or practices.

The CSSF’s data protection officer’s name and contact information are as follows:

DPO/Pascal Pirih
CSSF
283, route d’Arlon
L-1150 Luxembourg
dpo@cssf.lu
(+352) 26 25 1 2283

What information does the CSSF collect and how?

The CSSF collects a range of personal information. This includes:

  • your name, last name, address, telephone number, email address;
  • personal characteristics like your age, gender, date of birth, place of birth, marital status, nationality;
  • your educational background and professional qualifications;
  • your professional experience: employer, title and job description, date of recruitment, place of work, specialisation;
  • information about your current level of remuneration, including benefit entitlements.

This information will be obtained from your application file and/or documents requested during the recruitment process. More details about the application file can be found under “Application & recruitment process“.

Data will be stored in different places, including in your application record, in the CSSF’s HR management systems and email system, all of which are in Luxembourg.

The CSSF does not use the information you provide to make any automated decisions that might affect you.

Why does the CSSF process your personal data?

The CSSF has a legitimate interest in processing your personal data during the recruitment process and in keeping records of the process. Processing data from job applicants allows managing the recruitment process and assessing and confirming a candidate’s suitability for employment. The CSSF may also need to process data from job applicants to respond to and defend against legal claims.

In some cases, data needs to be processed to ensure that the legal obligations are complied with. The CSSF will not use your data for any purpose other than the recruitment process of which you are a part.

Who has access to data?

Your information may be shared internally within the CSSF for the purposes of the recruitment process. This includes members of the HR team, interviewers involved in the recruitment process, and hiring managers within departments that are recruiting.

The CSSF will not share your data with third parties.

How does the CSSF protect your data?

The CSSF takes the security of your data seriously. It has internal policies and controls in place to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by its personnel in the proper performance of their duties.

For how long does the CSSF keep your data?

If your application for employment is unsuccessful, your data will be kept for a period of maximum 4 months. After that period, your application file will be deleted or destroyed (unless it needs to be retained for longer to exercise or defend any legal claims). The CSSF will keep record of your application for a period of 5 years after which this record will also be deleted.

If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your employee file and retained during your employment. The periods for which employee data is held will be provided to you in a separate privacy notice.

Your rights

As a data subject, you have a number of rights under data protection law. Without prejudice to the limitations provided by the GDPR, you can:

  • access and obtain a copy of your data on request;
  • require the CSSF to change incorrect or incomplete data;
  • require the CSSF to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing;
  • object to the processing of your data where the CSSF is relying on its legitimate interests as the legal ground for processing; or
  • ask the CSSF to transfer your data to another organisation.

If you have a complaint about the use of your information by the CSSF, we invite you to contact the CSSF directly so that your complaint can be addressed. However, you may also contact the CNPD via their website at www.cnpd.lu or write to them at:

Commission nationale pour la protection des données (CNPD)
Service des réclamations
15, Boulevard du Jazz
L-4370 Belvaux

What if you do not provide personal data?

You are under no statutory or contractual obligation to provide data to the CSSF during the recruitment process. However, if you do not provide the information, the CSSF may not be able to process your application.

Updates to this privacy policy

The CSSF will regularly review and, if appropriate, update this privacy policy, as its services and use of personal data evolves. If the CSSF wants to make use of your personal data in a way that has not been previously identified, the CSSF will contact you to provide information about this and, if necessary, to ask for your consent.

The CSSF will update the version number and date of this page each time it is changed.