Fluxys is committed to correctly and securely processing personal data and complying with the associated legislation.

This privacy policy sets out the basis on which any information we collect from you, or that you provide to us, will be processed by us. This document contains all legally mandatory information by GDPR (General Data Protection Regulation).

What personal data does Fluxys process?

Fluxys may be required to process the following categories of personal data:

• Identification data, e.g. name, address, phone number or private email address;
• Professional data, e.g. profession, education/training, professional experience, languages and other skills, (current or offered) contract and labour conditions, etc.;
• Financial data, e.g. your (current or offered) salary, other allowances and benefits in kind, etc.;
• Personal, physical and psychological characteristics, e.g. date of birth, nationality, results of (psycho-)technical testing and, information on performance and development, possession of a driver's licence, etc.;
• Medical data, e.g. from medical check-ups required by law;
• Pictures and video footage, e.g. photos on CVs, footage from security cameras, video interviews.

Who is responsible for processing these data?

In this privacy notice, Fluxys refers to all entities controlled by Fluxys SA/NV, that use the Fluxys job portal. Each of these entities is responsible for their own individual processing procedures. You can contact them via the Fluxys Data Protection Officer (see the contact details below).

Why does Fluxys process my personal data?

Personal data are processed to carry out Fluxys' activities, among which the following purposes:

• Recruitment (in the event of a new application, contact by Fluxys regarding a new role or an invitation to an event) and selection
• Well-being, health and safety policies
• Access control and safety of Fluxys buildings and facilities
• Management of claims

Such processing is underpinned by the following legal bases:

• It is necessary for the purposes of Fluxys' or a third party's legitimate interests (e.g. if we record your personal data in our in-house administrative system or if we seek publicly available information in order to assess your application).
• It is necessary in order to comply with our legal obligations (e.g. in the context).
• When you have consented to processing.

Where do the personal data come from?

Personal data Fluxys processes are partly provided by yourself and partly come from other sources (such as Fluxys itself, recruitment agencies, assessment and development centers, information that is publicly available online and on social media platforms, people you have specified as referees, security authorities, etc).

With whom does Fluxys share my personal data?

Internally, access to your information will exclusively be given to those Fluxys collaborators (i.e. employees and contractors working for the Fluxys group) who require this information to carry out their job.

In addition, Fluxys may need to share, in the context of the purposes mentioned above, specific information with external parties (who need this information to provide services to Fluxys), such as:

• our service providers, e.g. assessment and development centers, the keeper of our paper archives, and ICT service providers;
• our professional advisors, e.g. law firms;
• the security authorities.

In this context, personal data may be transferred outside the European Economic Area (e.g. to our Swiss affiliate, to the USA should one of our service providers' servers be located there). In such scenarios, Fluxys will make sure that the information is protected by safeguards by making, for example, the necessary agreements with the service provider concerned.

How long will you retain my personal data?

Personal data are not kept any longer than necessary (max. 2 years) to achieve the purpose stated above, and taking into account the applicable limitation periods for a complaint or legal claim. Deviations are possible should a security check be required by law.

How are my personal data processed?

Your personal information is processed in accordance with the regulation on personal data processing. Fluxys takes the right organisational and technical measures. This implies, among other measures, security features regarding Fluxys facilities and ICT infrastructure and multiple internal procedures regarding access to information and management of confidentiality of data.

What are my rights regarding the processing of my personal data?

You have certain legal rights when it comes to the processing of your personal data. These rights are summarised below:

• Information – You have the right to information about the processing of your personal data. This is the reason why we provide you with this Privacy Policy.
• Access – You can ask access to the personal data we process about you.
• Rectification – If your information is inaccurate or incomplete, you have the right to request the rectification of your information.
• Deletion – Under certain circumstances, you have the right to request deletion of your information (for example when you think it has been processed illegally).
• Transfer – You have the possibility to obtain, under certain circumstances, your information in a structured and machine readable form so you can reuse it for your own purposes.
• Limitation of further use – Under certain circumstances, you can ask us to limit (further) use of your information. For example, when you dispute the correctness of some information, you can limit further processing of the data during the time Fluxys controls their correctness.
• Objection – You can object some processing, for example when the processing is based on Fluxys’ or a third party’s legitimate interests (cfr. above) you can object based on reasons that are specifically linked to your situation.
• Withdraw of consent – If you have given your consent for a specific processing, you have the right to withdraw your consent. This has no impact on the legitimacy of the data processing carried out before your withdrawal.
• Press charges – If you have charges against the processing of your personal data by Fluxys, we ask you to contact Fluxys’ Data Protection Officer (see contact details below) first. If you wish to do so, you can register a complaint at the Data Protection Administration.

More information can be obtained via Fluxys’ Data Protection Officer (see contact details below) or via the website of the Data Protection Administration.

If you wish to exercise one of your rights, you can contact Fluxys’ Data Protection Officer (see contact details below).

The above mentioned rights are not absolute. This means that in certain circumstances, Fluxys has the right to refuse your request (e.g. when consent with your request would undermine Fluxys’ rights or legitimate interests) ) and/or to charge a reasonable fee for administrative costs (e.g. in the case of very extensive requests).

For sure, we will reply as soon as possible to your request. If we need more than one month to respond to your demand, we will let you know.

What if I do not want to share my personal data?

Pursuant to the GDPR, if an individual does not wish their personal data to be retained, they have a number of rights enabling them to protect these data (see the list above). Please note that, depending on the type of right you decide to exercise, where applicable, Fluxys may no longer be able to consider your application or send you vacancies or other targeted information.

Who should I contact if I have any further questions?

If you have any further questions about this privacy notice or the processing of your personal data, please contact the Fluxys Data Protection Officer at privacy@fluxys.com.