PRIVACY STATEMENT FOR JOB APPLICANTS
1. Protection of Applicants’ Personal Data. This Privacy Statement (hereinafter the “Statement”) applies to all individuals submitting an application for recruitment, whether for an employment contract or a service contract (“Applicant” or “you”), with any of the NLMK Europe companies (hereinafter “NLMK”).
This Statement aims to (i) inform you about the personal data collected and processed by NLMK during the recruitment process and your rights in this regard; (ii) help you maintain control over the personal data NLMK processes about you; and (iii) enable you to fully exercise your rights concerning your personal data.
This Statement has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, as well as with the applicable national legislation (collectively, “GDPR”), including the Belgian Law of 30 July 2018 on the protection of natural persons with regard to the processing of personal data and the French Law No. 78-17 of 6 January 1978, as amended, known as the “Data Protection and Liberties Law.”
2. Definitions. To facilitate the understanding of this Statement, the following definitions of key terms used herein are provided:
- Personal Data: Any information that directly or indirectly identifies the Applicant.
- Processing: Any operation (or set of operations) performed on the Applicant’s personal data, such as collection, organization, recording, consultation, use, storage, adaptation, disclosure by transmission, erasure, or deletion.
- Data Subject: The identifiable individual to whom the personal data relates; in this context, the Applicant.
- Data Controller: The natural person or entity that processes personal data for its own purposes and on its own behalf. In this context, this refers to NLMK EUROPE in its capacity as the Employer.
- Data Processor: The entity that processes data on behalf of the Data Controller.
- Data Protection Officer (DPO): The person responsible for ensuring compliance with the GDPR and assisting Data Subjects in exercising their rights.
- NLMK EUROPE: The European economic group active in the production and sale of steel products, including the Belgian holding company NLMK Belgium Holdings SA and its subsidiaries located (i) in Belgium: NLMK Sales Europe SA, NLMK La Louvière SA, NLMK Manage Steel Center SA, NLMK Jemappes Steel Center SA, NLMK Plate Sales SA, and NLMK Clabecq SA;
(ii) in France: NLMK Strasbourg SA, NLMK Distribution France SA, and NLMK Coating SA; (iii) in Denmark: NLMK DanSteel A/S; (iv) in Italy: NLMK Verona SPA; (v) in Spain: NLMK Spain Steel SL; (vi) in Germany: NLMK Deutschland GmbH; and (vii) in Latvia: NLMK Plate Baltic. This also includes any company that may become part of NLMK Europe after the issuance of this Statement. The term ‘NLMK EUROPE’ refers both to the group as a whole and to each individual company there within.
3. Purposes of Collecting and Processing Your Personal Data in the Context of Recruitment. NLMK EUROPE collects and processes your personal data solely to manage and evaluate your application
within the recruitment process, whether for an employee position or assignments as a self employed worker. This data is used exclusively to make decisions regarding your potential employment or collaboration with NLMK EUROPE.
If your application is not successful, we will explicitly ask for your consent before retaining your data in a recruitment database. This database allows us to contact you later if your profile matches
future opportunities.
The legal basis for this processing is Article 6(1)(b) of the GDPR, relating to pre-contractual measures in the context of recruitment.
4. Data Controller. NLMK EUROPE acts as the Data Controller for applicants’ personal data.
NLMK Belgium Holdings SA has appointed a Data Protection Officer (DPO) for all NLMK Europe entities. The DPO’s role is to advise, monitor compliance with the GDPR and national data protection laws, and serve as the main contact point for Applicants regarding the processing of their personal data.
The DPO can be reached by email at DPO@eu.nlmk.com or by mail at: DPO / GDPR – NLMK Belgium Holdings SA – Rue des Rivaux 2, 7100 La Louvière, Belgium.
5. Personal Data. Within the recruitment process, NLMK EUROPE collects the following personal data about Applicants, including but not limited to:
- Identification details: name, first name, address, email, phone number, etc.
- Personal characteristics: gender, date of birth, age, marital status, family situation, etc.
- Educational and professional background, diplomas, and trainings.
- Current position and employer.
- Driver’s license possession.
- Where required by specific legislation, a criminal record extract.
- If applicable, hobbies, photographs, and/or videos.
6. How We Collect Personal Data? We collect personal data (i) directly from Applicants, notably through documents submitted such as CVs, cover letters, application forms, and via our recruitment platform managed by a subcontractor (currently: Talent Finder) when you use the
platform. This also includes email exchanges, interviews (in-person, phone, or video), and any other information you voluntarily provide during recruitment.
We may also collect certain data indirectly from previous employers regarding your education and career, but only after obtaining your prior written consent, which we will explicitly request.
7. Who Has Access to Your Data? Applicants’ personal data are only shared with: (i) personnel responsible for recruitment management within NLMK EUROPE; (ii) supervisory managers of potential or future employees; and (iii) the subcontractor managing our dedicated recruitment platform (currently: Talent Finder) when you use the latter.
8. Where Are Personal Data Stored? Your personal data are stored and processed within the European Union but may, in certain cases, be transferred outside the EU, notably to the Russian Federation, as some of our servers are located there. In specific circumstances, Applicants’
personal data may also be transferred to the NLMK Group in Russia (Novolipetsk Steel PJSC) as the industrial shareholder of NLMK EUROPE, for human resources management purposes, based on
the legitimate interest of the Data Controller.
To ensure an adequate level of protection during transfers outside the EU/EEA and in compliance with GDPR requirements, NLMK EUROPE has entered into standard contractual clauses approved by the European Commission, guaranteeing that transferred data are subject to security and protection measures consistent with European data protection standards.
9. Data Retention Period. Your data will be kept only for as long as necessary to achieve the purposes described in Section 3 and will be deleted or anonymized once they are no longer needed, unless the law requires their retention.
If your application is not successful, we will ask for your consent to keep your data in NLMK EUROPE’s recruitment database so that we can contact you later if your profile is considered suitable for future opportunities. If you agree, your personal data will be retained for a period of one year and then deleted. If you decline, your personal data will be deleted or anonymized once the recruitment process is completed, unless the law requires their retention.
10. Overview of Your Rights as a Data Subject. You will find below an overview of your rights as a data subject. Please note that these rights are not absolute and may be subject to certain conditions.
- Right of access to your personal data: You have the right to access the personal data processed by NLMK EUROPE and to request to view them at any time. NLMK EUROPE will provide a copy of this personal data.
- Right to rectification of your personal data: You have the right to have incorrect, incomplete, inappropriate, or outdated personal data corrected or deleted at any time.
- Right to erasure of your personal data: You have the right to request the deletion of your personal data if (i) the processing is no longer necessary for the purposes for which the data was collected; (ii) the data has been processed unlawfully; and/or (iii) you object to the processing for justified reasons.
- Right to restriction of processing: You have the right to request the restriction of the processing of your personal data in the following cases: (i) Accuracy disputed: when you contest the accuracy of your personal data, for the time necessary to verify their accuracy; (ii) Unlawful processing: when the processing is unlawful and you oppose the erasure of your personal data, requesting instead the limitation of its use; (iii) Data needed for legal purposes: when NLMK EUROPE no longer needs your personal data for processing purposes, but they are still necessary for the establishment, exercise, or defense of legal claims; (iv) Pending objection: when you have objected to processing, during the period needed to verify whether the legitimate interests of NLMK EUROPE override yours. - Right to data portability: You have the right to receive the personal data you have provided to NLMK EUROPE in a structured, commonly used, and machine-readable format, so you can retain it for personal use or transmit it to another data controller; this right applies to the extent technically and reasonably possible for NLMK EUROPE as the data controller.
- Right to object to certain processing: You have the right to object at any time to the processing of your personal data for reasons relating to your particular situation. If you object, NLMK EUROPE will cease processing your data, unless it can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or if processing is necessary for the establishment, exercise, or defense of legal claims.
- Right to withdraw consent: When NLMK EUROPE asks for your consent for a specific processing of your personal data, you have the right to withdraw this consent at any time without justification. Withdrawal of consent does not affect the lawfulness of processing performed prior to the withdrawal.
11. How to exercise your rights. To exercise your rights regarding your personal data, please send a dated and signed request, along with proof of identity, by email to DPO@eu.nlmk.com and/or by mail to: DPO / GDPR – NLMK Belgium Holdings SA, Rue des Rivaux 2, 7100 La Louvière, Belgium
This request is free of charge, except if NLMK EUROPE considers it manifestly unfounded or excessive (e.g., in the case of repeated requests). For any additional copies requested, we may also charge a reasonable fee based on administrative costs.
Your request will be processed within one month. This period may be extended by two months, taking into account the complexity and number of requests being handled. In case of extension, you will be informed of the reasons for the delay.
We will also inform any third parties to whom your personal data has been transferred of any correction, erasure, or restriction, unless this is impossible or involves disproportionate effort.
If you believe that the processing of your personal data is not compliant with applicable law and/or if we do not respond correctly to your request, you can file a complaint with the competent supervisory authority in your country of residence, such as the Data Protection Authority (APD) in
Belgium, and the Commission Nationale de l’Informatique et des Libertés (CNIL) in France.
12. Updating this Privacy Statement. NLMK reserves the right to modify and update this Statement at any time. We encourage you to consult this Statement regularly on the recruitment site to stay
informed about how we process and protect your personal data. You can obtain a copy upon request from the DPO.