This web site is not intended or designed to attract children under the age of 13. We do not knowingly collect personal information from or about any person under the age of 13. If you are under 13 years old and wish to ask a question or use this site in any way which requires you to submit your personal information, please have your parent or guardian review all applicable terms outlined here prior to doing so on your behalf.
Where appropriate and justified, your Personal Data may be shared with entities of the Criterion Global and its affiliates in the EU/globally.
Should you wish to exercise your rights listed under Section V of this Notice, the collection of your request will be performed via the form provided by our partner TrustArc, acting on our instructions and behalf as a data processor under EU regulation 2016/679 on the processing of personal data (“GDPR”). Once your request is sent to the Criterion Global, TrustArc shall immediately delete it from its servers and other IT tools.
We will not share your Personal Data with any third party, except as otherwise stated in this Privacy Notice.
Your Personal Data can be shared:
- In the context of a merge, acquisition or sale of all or part of the agency’s assets, to successors in title to our business,
- to establish, exercise or defend our rights,
- or where required by law, to respond to requests from legal or administrative organizations, government organizations or a judge.
If the services of third parties for technical maintenance, administration or processing of the Personal Data are necessary, these third parties will only have access to the Personal Data insofar it is necessary to ensure a smooth and secure technical processing of our Website. In every case, such access to your Personal Data will only be made in accordance with the applicable law, including Data confidentiality, privacy and security obligations.
Your rights on your Personal Data
In accordance with applicable privacy law, you may exercise the following rights with respect to the Personal Data we hold about you:
- Right to information:
You have the right to obtain clear, transparent, understandable and easily accessible information regarding how we use your Personal Data and regarding your rights. This is why we provide you such information in this privacy notice;
- Right of access to your Personal Data
You can access all Personal Data we hold about you, know the origin of this Personal Data and obtain a copy in an understandable format.
You may also use your right to access your Personal Data to control the exactness of the data and have them rectified or deleted. You have no justification to provide to exercise your right to access;
- Right to rectify your Personal Data
In order to avoid that inaccurate or incomplete Personal Data relating to you is process or shared, you can ask us to rectify them;
- Right to the deletion of your Personal Data:
You may request the erasure or deletion of the Personal Data we hold on you. This is not an absolute right since we may have to keep your Personal Data for legal or legitimate reasons. You may, for example, exercise your right to deletion in the following cases:
- if you have withdrawn your consent to the processing (see below);
- if you legitimately objected to the processing of your data (see below);
- when data is not or is no longer necessary for the purposes for which it was initially collected or processed;
- the data is processed unlawfully (e.g., publishing hacked data);
- Right to object to the processing of your Personal Data
When we process your Personal Data based on our legitimate interest (to determine to which processing this applies, please refer to Section III of this Notice), you may at any time object to the processing of your Personal Data for reasons relating to your personal situation. We may nevertheless, on a case-by-case basis, reject such a request by pointing out the legitimate and imperious reasons justifying the processing of this data which prevail on your interests, rights and freedoms, or when this data is necessary to establish, exercise or defend a right before a Court.
- Right to limit the processing of your Personal Data
The right to limit the processing completes your other rights. This right means that the data processing relating to you and that we are performing is limited, so that we may keep this data, but we cannot use it or process it in any other manner.
This right applies in specific circumstances, i.e.:
- if you challenge the exactness of your Personal Data. The processing is then limited for a period of time so that the agency may verify the exactness of the Personal Data;
- if the processing is unlawful and you object to the erasure of your Personal Data and request instead that its use be limited;
- if we do not need the Personal Data for the purposes mentioned above in Section I anymore, but you still need it to establish, exercise or defend rights before a Court; and
- in the cases where you objected to the processing which is based on the legitimate interests of the agency, you may ask to limit the processing for the time necessary for us to verify if we can accept your objection request (i.e., the time necessary to verify whether the legitimate reasons of the agency prevail over yours).
- Right to portability of your Personal Data
You may request to retrieve the Personal Data you provided us with, in a structured, commonly used and machine-readable format, for personal use or to share them with a third party of your choice.
This right only applies to Personal Data you provided us with, directly or indirectly, and which was processed through automated means, if this processing is based on your consent or the performance of a contract. Please check the list of our Personal Data processing activities’ legal grounds (in Section III of this Notice) to know whether our processing is based on the performance of a contract or on consent.
- Right to withdraw consent at any time to the processing of Data carried out on the basis of such consent
You may read Section III of this Notice in order to identify the purposes for which the processing of your Personal Data is based on your consent;
- Right to give instructions on the fate of your Data after your death.
You may define directives on the storing, erasure and sharing of your Personal Data after your death. These directive may be general, i.e. cover all your Personal Data, or specific, i.e. only cover certain data processing activities.
If we have reasonable doubts as to your identity, we may ask you to attach any document enabling proof of your identity, in order to avoid any risk of impersonation.
If we receive your request by electronic means, we will respond electronically unless you specify, in the comments field of the data subject rights form, that you wish to obtain a response via other means, such as by mail.
We will respond without undue delay and in any event within one month from the data we receive your request. This timeframe can be extended by two months to take the complexity of the request or the number of requests received into account. In this case, we will inform you within one month from receiving your request, specifying the reasons for extending the response timeframe.
If you feel that we are not complying with this Notice, if you are not satisfied with the way we have dealt with your request or if your request has been refused, you may also file a formal complaint with your competent authority in your jurisdiction. However, we invite you to contact our Data Protection Officer at firstname.lastname@example.org before filing a complaint with any Data Protection Authority.
Data retention periods
We store your Personal Data in accordance with the applicable legal requirements for data retention and our internal policies. The data retention will vary depending on the type of data and the purposes of processing. Your data will generally be retained for the duration of our contractual and/or pre-contractual relationship, after which time your data will be archived.
Personal Data collected in the context of your job application to an open position are kept:
- For no longer than two (2) years from the last contact if your application was rejected, except if you specify that you do not wish us to keep your application after the end of the recruitment process; in which case your Personal Data will immediately be deleted;
- For the duration of your stay with Criterion Global if your job application is accepted.
We use a variety of methods, such as firewalls, intrusion detection software and manual security procedures, to secure your data against loss or damage and to help protect the accuracy and security of Personal Data and to prevent unauthorized access or improper use. If you think that the Website or any Personal Data is not secure or that there has been unauthorized access to the Website or your Personal Data, please contact email@example.com immediately.
Given the international nature of our activities, your Personal Data are transferred outside the European Union, for instance, your personal data is accessed in the USA for the purposes of back up of emails. In this case, your data is stored in a secure manner on servers of the Criterion Global. This country is not considered by the EU Commission as providing an adequate level of protection. We ensure all data transfers comply with applicable legal requirements by executing contractual agreements with appropriate contractual protections in compliance with article 46 of the GDPR.
Should you wish to know more about how data is protected or wish to request a copy of the contractual protections please contact firstname.lastname@example.org.