All fields marked * are required.
Identification of Controllers
Description of processing
2.1 Purpose of Processing.
2.2 Categories of Data collected
2.3 Legal grounds for processing Data
Who we share data with
How users can exercise their rights
How long we keep your personal data
Transfers of data outside the European Union
Statement on Cookies
The present confidentiality policy (the “Confidentiality Policy”) is intended to inform the applicants who apply through the talent’up platform (hereinafter collectively the “Users”) of the methods of collecting and processing their personal data, the rights they hold, and how they can exercise them.
Talent’up is a secure human resource management solution that allows SUEZ, in France and throughout the world, to be at its Users’ side during every step of the recruitment process described in § 2 hereinafter (hereinafter “
Talent’up is published and hosted by the company CORNERSTONE EUROPE LIMITED., whose head office is located at 4 Coleman Street, London, EC2R 5AR, United Kingdom, and with whom SUEZ SA (“
SUEZ”) has entered into a contract, rendering them a Data Processor of SUEZ within the meaning of GDPR (the “Data
The present Policy may be modified at any time by SUEZ, particularly in order to remain compliant with any regulatory changes.
The personal data (“
) of Users, collected through talent’up, is subject to processing by SUEZ and its relevant subsidiaries, acting as joint controllers (hereinafter individually designated as the “Entity” and collectively designated as the “Entities” or the “Controller”).
The Controller is therefore SUEZ and the Entity is SUEZ, the potential employer of the User.
SUEZ is a limited liability company registered with the RCS [Commercial and Companies Registry] of Nanterre under no. 433 466 570, whose head office is located in Tour CB21, 16 place de l’Iris, 92040 Paris La Défense (France).
The complete contact information of each Entity in question will appear in the employment contract that will be entered into with the applicant in question, which will also contain, where applicable, the contact information of its Data Protection Officer.
Each Controller undertakes to strictly adhere to Regulation n°2016-679 of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“GDPR”) and the local law applicable in each country, namely, for the French entities of SUEZ, Law n°78-17 of January 6, 1978 on IT, files, and liberties as amended by the law of June 20, 2018 and to Implementation Decree N°2019-536 of May 29, 2019 (hereinafter, the “Regulation”).
The purposes for processing the personal data of Users as part of recruitment management are:
application processing (resume and cover letters) and interview management.
creation of a resume database, where applicable (a “talent Pool” feature).
Within the meaning of the Regulation, the following are considered personal data: data of a natural person that make it possible to identify them or render them identifiable, such as the last name, first name, email address, or mailing address of the person in question.
Personal data is collected directly from the User when they make an application through the talent’up platform or fill out the contact form.
Personal data collected as part of recruitment is that which the applicant provides in the application form on the talent’up platform.
The personal data contained in the fields which the applicant is required to complete are as follows:
Categories of Data
Examples of Data
of the Applicant
Data pertaining to identity
: last name, first name, email address, mailing address, phone number, resume, cover letter.
Data pertaining to previous employment
: start date – end date of previous jobs, positions held, company names.
Data relating to training received at the time of application
: organization, degree title, level of qualification.
This information is necessary in order to analyze the applicant’s application and respond to it. If the applicant does not wish to supply this data, they will not be able to apply through the talent’up platform.
No additional data collection is required of those applicants who opt to have their resumes stored by SUEZ for the purposes of creating the resume database (see § 2.1 above).
The following are the grounds for processing Users’ personal data:
performance of pre-contractual
for processing applications.
in the creation of a resume database.
to which SUEZ is subject within the framework of the exercise of Users’ rights.
Internal Departments at SUEZ
Data is shared with authorized persons within the “Human Resources” departments of each Controller, and authorized persons within other internal departments responsible for performing “human resources” processes.
The Entities of SUEZ benefit from the services of the CORNERSTONE IT department.
The Data Processor only has access to data for the performance of its services for said Entities. The Data Processor processes the Data in strict compliance with the documented instructions of the Controller and in accordance with the obligation of confidentiality to which it is subject with regard to SUEZ and its Entities.
The Entities of SUEZ may also send the data to service providers to which they may subcontract the management of certain activities, particularly recruitment agencies, training bodies (suppliers of external content, external trainers, where applicable).
Authorities and Public Bodies
In accordance with the law, the Controller may be required to divulge certain personal data to administrative or legal authorities.
The Controller may process and divulge certain personal data, in accordance with applicable law, to protect its legitimate interest, particularly within the framework of legal proceedings.
To make it easier for Users to exercise their rights, SUEZ has been named as the point of contact. Users may nevertheless choose to exercise the following rights with regard to SUEZ or the Entity concerned:
Right to access
: receive a copy of their personal data.
Right to correct
: request the correction of any error in the data. The Controller is required to keep data collected from Users up to date.
The User is therefore recommended to update the data connected to their profile directly via talent’up or, failing this, to inform the Controller of any changes pertaining to them by sending an email to the following address:
Right to erasure
: request the erasure of personal data, for example if the data is no longer necessary with regard to the purposes for which it has been collected or processed (following an application, for instance).
Right to limit processing:
right to request that the processing of personal data be limited.
Right to challenge processing
: right to challenge, in certain situations, the continued processing of personal data, for example in the case of processing conducted on the grounds of legitimate interest. The right to challenge does not apply to processing which, by virtue of § 2.3 above, is necessary for the performance of pre-contractual measures taken at the User’s request.
Right to data portability:
right to receive the personal data transmitted, in a structured format in current use, and/or to request that such data be transmitted to a third party. The right to portability does not apply to processing which, by virtue of § 2.3 above, is conducted on the grounds of legitimate interest.
Right to set general and specific directives
defining the manner in which the User intends for their rights to be exercised following their death.
The User is informed that, in the event that their rights are exercised, they may be asked to prove their identity, if there is any serious doubt concerning this, by means of an identity document sent in a secure manner.
In accordance with the Regulation, the User may exercise their rights via the contact form available on www.suez.com, by sending an email to
or by sending a letter to SUEZ, Human Resources Department, Tour CB21, 16 place de l’Iris - 92040 Paris La Défense (France), including their first and last names and address, or by contacting the Entity concerned.
Should any difficulty arise with regard to the management of their data, the User may contact the SUEZ Data Protection Officer (Email address:
) or their Entity’s DPO (where applicable).
If the User finds the DPO’s response unsatisfactory, they may file a claim through or a send a claim to the competent data protection Authority (in France, the CNIL, at 3 Place de Fontenoy - TSA 80715 - 75334 PARIS CEDEX 07 or, depending on the situation, the local data protection Authority in the country of the Entity concerned.
Personal data is stored in accordance with the legal provisions in force in the country involved in the processing.
In France, data collected as part of recruitment is stored by SUEZ on an active basis for the time necessary to evaluate the application and for a maximum duration of
two (2) years
(or for any shorter duration which is specific to the country involved) from the time of most recent contact with the applicant.
Fifteen (15) days prior to the expiration of this time period of two (2) years, the applicant will receive an automatically generated email informing them of the impending deletion of their data, unless they actively intervene via their User profile. In this case, the applicant’s profile data and attachments will be automatically stored for a new maximum duration of two (2) years
If no new connection is established with the applicant in this time period of fifteen (15) days or if no action is taken on their part via their User profile, the personal data pertaining to the applicant’s profile will be anonymized, and associated attachments will be deleted. As a result, it will no longer be possible to contact the applicant in the event of any future opportunities.
SUEZ undertakes to take the appropriate organizational and technical measures to maintain the security, integrity, and confidentiality of the data as well as, in particular, to prevent them from becoming distorted, damaged, or accessible to unauthorized third parties. SUEZ has implemented security measures to protect personal data collected, especially against all unauthorized access and use.
SUEZ also uses procedures to handle any actual or presumed data breach and, in accordance with the Regulation, has implemented warning systems allowing it to meet its obligation to inform the relevant data protection Authority as well as, where applicable, the Users, in the event of a presumed data breach.
Nevertheless, SUEZ wishes to draw the Users’ attention to the fact that the transfer of personal information via networks cannot be completely secure.
Consequently, SUEZ cannot guarantee the total security of personal data sent by the applicants over the talent’up platform. Applicants send their information and data at their own risk and under their own responsibility.
As such, applicants acknowledge and accept that, subject to imperative legal provisions, SUEZ cannot be held liable in the event of unauthorized access, use, damage, or destruction of their data.
In the event that the User’s data is transferred to a SUEZ Entity or a third-party recipient located outside the European Union, the Controller ensures that the receiving country has been party to a adequacy decision made by the European Commission.
Failing this, the Controller undertakes to set guidelines for the transfer using the appropriate guarantees, such as the Standard Contractual Clauses of the European Commission.
Accordingly, the Data Processor is required to transfer data to subsidiaries located in third countries. This transfer is framed as follows:
Cornerstone OnDemand Europe Limited
Technical services for the management of talent’up
India, United States
“Data Processor” Contractual Clauses between SUEZ SA and CORNERSTONE
If the User wishes to receive more information regarding the way the Controller protects their data, or wishes to obtain a copy of the legal instruments applied, the User may send a request to that effect to the following email address:
The User is informed that, when they browse the talent’up platform, the platform’s publisher (Cornerstone) may store cookies on their device (computer, smartphone, tablet). The conditions and methods of storage, use, and configuration for these cookies appear in the Cornerstone Statement on Cookies.
We invite the User to read it via the following link:
For example, 12 months for Belgium and the Netherlands and 6 months for Germany.
Or the time period applicable according to country, as specified above, where applicable.
Or the time period applicable according to country, as specified above, where applicable.
March 25, 2021