1.      BACKGROUND

IMPACT Initiatives is an Swiss-based Association located at chemin de Balexert 9, Chatelaine, Geneva, Switzerland. IMPACT Initiatives (« IMPACT », « us ») collects applicants’ (« applicants », « you ») Personal data as part of its recruitment process.

This Applicants Privacy notice (« Privacy notice ») illustrates IMPACT’s commitment to respect the privacy and the protection of applicants’ Personal data.

For the proper understanding of this Privacy notice, it is specified that IMPACT is to be considered as the Data controller of your Personal data.

 

2.      DEFINITIONS

« Recipient » means the natural or legal person, public authority, department or other body that receives disclosure of Personal Data, whether or not it is a third party;

« Personal data » means any information relating to an identified or identifiable natural person; an “identifiable natural person” is deemed to be a “natural person” if it can be individually identified, directly or indirectly, in particular by reference to an identifier, such as a name, an identification number, location data, an online identifier, or to one or more elements specific to its physical, physiological, genetic, psychological, economic, cultural or social identity;

« Applicable regulation » refers to the legislation in force relating to the protection of privacy regarding the processing of Personal Data, in particular the Swiss Federal Act of 25 September 2020 on Data Protection (“FADP”) and its ordinances, and where applicable, the Regulation (UE) 2016:679 of the European Parliament and of the Council of 27 April 2016 (“General Data Protection Regulation” or “GDPR”);

« Data Controller » means the natural or legal person, public authority, agency or other body who/which, alone or jointly with others, determines the purposes and means of the processing of Personal data;

« Third party » refers to a natural or legal person, a public authority, a department or body other than the data subject, the data controller, the data processor, the subcontractor, if any, and the persons who, placed under the direct authority of the data controller, the data processor or the subcontractor, if any, are authorized to process the Personal Data.

 

3.      DATA CONTROLLER

As Data controller, IMPACT is committed to respect all the principles as established by the Applicable regulation.

IMPACT processes your Personal data lawfully by ensuring that the processing carried out have a legal basis (lawfulness). IMPACT also commits to process your Personal data only for specific purposes (purpose limitation) and to process only adequate, relevant and limited Personal data (data minimization). Furthermore IMPACT carries out all reasonable steps to ensure that your Personal data is accurate (accuracy). IMPACT commits not to store your Personal data beyond the time necessary to fulfill its purpose (storage limitation). IMPACT also implements security measures in order to ensure the integrity and confidentiality of your Personal data (integrity and confidentiality).

 

4.       CATEGORIES OF PERSONAL DATA COLLECTED

This Privacy notice applies to all the Personal data that IMPACT collects and processes as part of its recruitment process.

Failure to provide your Personal data may prevent or delay the processing of your application.

In this regard, IMPACT informs you that if you refuse to accept the counter-terrorism controls processing that IMPACT performs for any recruitment, IMPACT will not be able to continue the recruitment process. Indeed, IMPACT strives to ensure the utmost transparency and compliance with its commitments and those made to its donors to ensure that it does not contribute in any ways to the financing of terrorist activities.

IMPACT will endeavor to update your Personal data to the best of its knowledge. Nevertheless, it is your responsibility to ensure that any changes in your Personal data (e.g. new personal address, change of name, etc.) are communicated to IMPACT in writing immediately or as soon as possible after the change is made.

4.1.            Personal data that IMPACT collects directly from you

The categories of Personal data that IMPACT collects directly from you may include:

  1. Identification data (e.g. name, gender, place and date of birth, personal telephone number, personal e-mail) ;
  2. Data relating to the applicants’ personal situation (e.g. family situation: single, married, divorced, number and age of children);
  3. Occupational data: (e.g. position applied for, work experience, recommendations, educational history, skills).

4.2.            Personal data that IMPACT collects from other sources

Personal data that IMPACT does not collect directly from you may include:

  1. Information relating to a professional background check or information from your references obtained during the recruitment process;
  2. Professional information available on websites or social networks (e.g. LinkedIn).

5.       LEGAL BASES OF THE PROCESSING

5.1.            Processing of Non-Sensitive data

The processing that IMPACT carries out are based, alternatively or cumulatively, on the following legal bases:

  • The processing is necessary to the performance of a contract to which the data subject is party or to the performance of precontractual measures taken on the data subject’s request;
  • The processing is necessary for the purposes of the legitimate interest pursued by the Data controller or a Third party.

When IMPACT processes your Personal data to meet its legitimate interest, it implements strong safeguards in order to ensure that your privacy is protected and that your fundamental rights and freedoms are respected.

5.1.            Processing of Sensitive data

As part of its recruitment process, IMPACT may have to process data concerning your criminal records, such as in case of work with children, or during checks related to the fight against terrorism financing (your name is then searched on the basis of lists published by governmental authorities). To this end, your data shall be automatically processed. This processing is based on IMPACT’s legitimate interest in order to meet its obligations.

 

6.      PROCESSING PURPOSES

Personal data that IMPACT collects from applicants is processed for the following purposes:

  • Recruitment ;
  • Applications management and organisation ;
  • Recruitment monitoring ;
  • Counter-terrorism control.

Occasionally, in order to carry out its activity IMPACT may need to process your Personal data for purposes that were not initially intended at the time of first collection. In such a case, IMPACT will inform you as soon as possible of the new purpose so that you are able to exercise your rights.

7.       YOUR RIGHTS

You have several rights as a data subject. You can exercise these rights at any time and IMPACT commits to make every effort to process your requests as quickly as possible. Thus, you benefit from the following rights:

  • right of access: the right to be informed and request access to all or part of your Personal data;
  • right of rectification: the right to request the modification or update of your Personal data;
  • right of erasure: the right to request that IMPACT permanently erases all your Personal data;
  • right to restrict the collection and processing: the right to request that IMPACT temporarily stops the processing of all or part of your Personal data;
  • right to object to the collection and processing of your Personal data: the right to object to certain processing of your Personal data for reasons relating to your particular situation;
  • right to data portability: the right to request a copy of your Personal data in a readable format for personal use or for transmission to a third party.

You also have the right to communicate instructions regarding the storage, deletion and disclosure of your Personal data after your death.

You can exercise your rights by sending a request email to IMPACT’s Data Protection focal point either by email to geneva.dp@impact-initiatives.org or in writing to IMPACT Initiatives Data Protection focal point, 9 chemin de Balexert, 1219 Chatelaine, Switzerland.

For any request, IMPACT reserves the right to verify your identity.

8.       RECIPIENTS AND SHARING OF PERSONAL DATA

The Recipients of your Personal data are entities, authorities and authorized persons whose functions require them to have knowledge of your Personal data.

As an applicant, the Recipients of your Personal data are as follows:

  • IMPACT’s Human Resources Department;
  • IMPACT hiring managers and, when relevant, third-party staff[1] who are involved in the recruitment process.

 

In addition, IMPACT may be led to share your personal data to Third-Parties under the following circumstances ::

  • Lawyers and external auditors: IMPACT may share your Personal data when it appears necessary to the functions of the above-mentioned persons. These Recipients are subject to legal or contractual obligations that result in preserving the confidentiality of your Personal data.
  • Law enforcement agencies, national courts, governmental authorities or any other Third party falling under this category of Recipients: IMPACT may share your Personal data with these Recipients when this appears necessary in order to comply with a legal or regulatory obligation or to protect its rights or a Third party’s rights (e.g. during a control by Swiss authorities such as the Préposé federal à la protection des données et à la transparence).
  • IMPACT’s IT subcontractors: IMPACT shares your Personal data as part of the outsourcing of its telecommunication, storage, backup and archive services, as well as of some of its information systems (e.g. IMPACT’s data storage service provider).

 

9.      SECURITY

In accordance with Applicable regulation, IMPACT makes every effort to process your Personal data securely and confidentially.

In particular, IMPACT implements technical and organizational measures needed to ensure the security and confidentiality of the Personal data collected and processed, including to prevent it from being distorted, damaged or communicated to unauthorized Third parties, by ensuring a level of security appropriate to the risks involved in the processing and to the nature of the Personal data to be protected , taking into account the level of technology and the cost of implementation.

However, IMPACT cannot guarantee the confidentiality of Personal data made public by the applicants themselves, as well as the confidentiality of Personal data collected and/or processed on websites or external sources.

 

10.    STORAGE LIMITATION

In the context of the processing carried out during the recruitment process, IMPACT takes care not to store your Personal data beyond the period necessary to fulfill the purpose for which the Personal data were collected and in accordance with Applicable regulation.

In the event of a positive outcome following the recruitment process, the Personal data collected are transmitted to the department in charge of personnel administration in order to fulfil the legal and regulatory obligations necessary for recruitment and to ensure the administrative management of the file. Thus, the applicable storage periods are those specific to these purposes.

11.    MODIFICATION OF THE PRIVACY NOTICE

IMPACT may be required to make changes in this Privacy notice. In such a case, IMPACT will use its best efforts to inform you. The date of this Privacy notice will be amended accordingly for each modification.

In the event that a change to this Privacy notice is likely to have a fundamental impact on the nature of the processing or a substantial impact on you, IMPACT will inform you sufficiently in advance so that you can exercise your rights.

 

***End***

 

[1] For example, ACTED’s when a security interview is required (as part of IMPACT & ACTED Global partnership)