Careers Privacy Notice

Your trust is important to us and we are committed to protecting the privacy and security of your personal information. 

We process your data in accordance with all applicable data protection laws, including the observation of the data processing principles (such as, lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability). 

This document describes how we use and process your personal data, provided in a readable and transparent manner. It also tells you how to contact us if you have questions about your personal data, which we are more than happy to answer.

This Careers Privacy Notice (hereinafter, “Notice”) applies to any kind of information we collect through different means, such as your application form, your participation in our events or through the referral program. For example, this Notice shall apply to the following scenarios: 

• When you register your job application on our website and/or through LinkedIn (if applicable) we will process such data for the recruitment process of this or other related jobs. If hired, this data will be part of your employee file; 
• In an event (regarding, for instance, pictures, videos, interviews…); 
• In a contest, such as a Referral program, when you refer to a possible candidate we will also gather your identification and contact details.

We might amend this Notice from time to time. Do not hesitate to check it regularly and you will know exactly where you stand. We will note the date that revisions were last made to this document at the bottom of this page, and any revisions will take effect upon posting. We will also provide a ‘just in time’ notice before collecting your personal data highlighting  the purposes of the processing activities mentioned in this document.

Who is responsible for your data?

eDreams International Network, S.L., a Spanish-based company with tax ID number B62443700  (hereinafter, “eDreams ODIGEO” or “the Company”), is the data controller of your personal data processed unless this Notice or any other communication specifically states otherwise. 

Who is the DPO-Data Protection Office?

eDreams ODIGEO has appointed a Data Protection Officer (“DPO”) who watches over all processing carried out with respect for your privacy and the applicable regulations at all times.

The DPO is at your disposal to answer all the questions you may have regarding the processing of your personal data. You can contact the DPO as well as exercise your rights as described in Section 7 of this Notice (“How can you control the personal data you have given to us?”). 

Why do we collect your personal data and which legal basis do we rely on?

In this section, we inform you of the legal basis on which we process data for individual purposes (you can find general information at the end of this section “Lawful Basis we rely on”). 

I. Recruiting & contracting process. The recruiting process consists of sourcing candidates, providing suitable options to managers, interviewing and participating in the selection process, to the point of an accepted offer. When you register your job application on our website and/or through LinkedIn (if applicable) we will process such data for the recruitment process of this or other related jobs. If hired, this data will be part of your employee file.

Legal basis: This processing is essentially necessary for the performance of the contract or pre-contractual process. 

II. CV management for future career opportunities. Your data may be kept for a year for our employment exchange, for the continuous search of vacancies, as well as the availability of eventual job openings that may arise. Once a year has passed, we will keep your CV for longer periods of time if you provide us with your consent.

Legal basis: This processing is mainly based on our Company’s interest to reach out to prospective candidates for job positions similar to those that you considered when you applied. You can oppose the processing of your personal data as described in Section 7 of this Notice (“How can you control the personal data you have given to us?”). After a year, the processing will require your consent. You may withdraw your consent at any time as described in Section 7 of this Notice (“How can you control the personal data you have given to us?”). Please note that the withdrawal of your consent does not affect the lawfulness of any processing activities based on such consent before its withdrawal.

III. Communications. To communicate with you, with relevant information regarding your hiring process (e.g. to report on the status of the application, to request further information, to schedule an appointment, etc.). These communications are strictly necessary for their nature.

Legal basis: This processing is mainly based on our pre-contractual relationship understood as the hiring process. 

IV. Surveys. We may launch surveys to gather relevant information for the Company (normally designed as anonymous) regarding the hiring process to help us know how to improve and get feedback/comments from you.

Legal basis: This processing is mainly based on our Company’s interest to gather information about your satisfaction and quality perception regarding the process as this information will improve our hiring process. You can oppose the processing of your personal data as described in Section 7 of this Notice (“How can you control the personal data you have given to us?”).

V. Events. We celebrate different events in different cities for employment branding and hiring purposes.  Therefore, your personal data will be processed for the following purposes::

• Image and video capturing: photographs and videos will be taken during the event, which may be general shots or close-ups of the attendees, speakers and other important guests. 
• Content publication with no commercial purpose: eDreams ODIGEO will use this data for internal communication purposes and which could be published and/or processed for the purpose of broadcasting the activities promoted by eDreams ODIGEO through physical formats, such as flyers and rollups, as well as online channels managed by eDreams ODIGEO, such as our social networks, our corporate website, eDreams ODIGEO’s career website or LinkedIn, Twitter and Medium.

Legal basis: The legal basis for this processing varies depending on the type of image:  

• Accessory or casual images of general plans and/or ambient sound: eDreams ODIGEO has a legitimate interest in capturing, publicising and promoting its image and brand internally and externally, in order to give eDreams ODIGEO greater visibility and shape a public image of itself and of the people who relate to it in accordance with the values that govern its activity, through the dissemination of the events it organises or in which it participates. You can oppose the processing of your personal data as described in Section 7 of this Notice (“How can you control the personal data you have given to us?”).
• Close-up photography and/or direct recording of your voice: in this case, the processing is carried out on the legal basis of the consent you give by attending the event. You may withdraw your consent at any time as described in Section 7 of this Notice (“How can you control the personal data you have given to us?”), detailing the event in which you participated (e.g. location, date of the event, etc.) as well as if possible attaching an image of yourself in order to correctly identify you in the images and videos. Please note that the withdrawal of your consent does not affect the lawfulness of any processing activities based on such consent before its withdrawal.

VI. Contests. To make a more participative environment and gather information from your side (e.g. the Referral program).

Legal basis: Your participation in contests will be subject to the terms of the contest, which will normally be based on your voluntary participation (and, therefore, based on the contractual relationship understood as the acceptance of the terms of the contest). Referees sending others’ personal data within the Referral program are obliged to gather in writing the third’s party consent to provide their personal data for our Referral program. eDreams ODIGEO could eventually ask for proof of the third party’s valid consent as per the General Data Protection Regulation (“GDPR”). The Referee is responsible for such a purpose.

VI. Compliance purposes. Based on a possible sign or evidence, we might have to investigate further when there is a risk of breach of the internal policies and procedures, or any other legal obligations. 

Legal basis: This processing is essentially necessary for our Company’s legitimate interest to reduce any legal, internal compliance or labour and contractual risks as well as to protect any employee or asset affected by such risks. You may object to such processing as stated in the section “Your rights”, unless we can demonstrate compelling legitimate grounds for such processing or such processing is required for the exercise or defence of legal claims.  

VIII. Legal purposes. The law may require us to inform the competent authorities about the hiring process (e.g. for diversity requirements, if applicable). 

Legal basis: This processing is necessary for compliance with a legal obligation to which we are subject. 

Which kind of personal data do we collect?

The personal data that we may collect about you broadly fall into the following categories:

I. Personal and contact details (e.g. full name, address, contact telephone number and personal email addresses, your date of birth, gender, marital status, and a copy of your passport or similar photographic identification and/or proof of address documents, as well as next of kin, emergency contacts and their contact information) to manage, for instance, the hiring process, and, where necessary, internal communications, to comply with the health and safety obligations or legal actions.

II. Professional and academic-related information (including your historic qualifications, job application, employment references, right to work information and details of any criminal convictions that you declare, if allowed by labour law; your start and leave dates, salary and salary expectations,  as well as your current location of employment and details of any exceptional secondary employment). Some of this data might be necessary to handle the recruiting process.

III. Internal and external communications data.  We may process communications for quality control, analytics, staff training, know-how control and legal dispute purposes. Any personal information obtained from you during any communication will be processed in accordance with this Notice. 

IV. Other information (e.g. your responses to hiring surveys if this data is not anonymised, or any contest-related information, and any other information that you might share with us also on a voluntary basis).

In any case, the information eDreams ODIGEO will process about you will vary depending on your specific role and personal circumstances. 

Who will be the recipients of your personal data?

In certain circumstances, we may share your personal data with third parties: 

I. Third-party service providers (e.g. those providing us with recruitment, HR records and database systems, legal services provider, survey platform supplier, etc.) may process your personal data on our behalf and under our instructions for the purposes described hereinabove, acting as data processors or acting as autonomous data controllers. Where third-party service providers have access to data they will only collect information as needed to perform their functions. They are not permitted to share or use the information for any other incompatible purpose.

II. Our group companies may process your personal information, as previously referred to, for internal purposes relating to management centralization. In any case, they will follow practices that are at least as restrictive within the terms of the applicable law and our internal Group Privacy Policy.

III. Competent authorities. In some circumstances, such as under a court order, we are legally obliged to share information. We may also share information about you with third parties including government agencies and external auditors (e.g. we may share information about you with Labour and Tax Authorities for the purpose of collecting tax and national insurance contributions). We may need to further disclose personal data to competent authorities to protect and defend our rights or properties, or the rights and properties of third parties (including Courts and Police, when necessary).

IV. Others, with your consent to the disclosure or after having you transparently informed, when needed, and always within the limits of the law.

How do we protect your personal data?

Among other measures, we can regroup the main protection actions we take within the following categories:

I. Security measures. While nobody can guarantee absolute security, we design our systems and devices with your security and privacy in mind. We work to implement appropriate technical and organisational measures to ensure a level of security to the risk and to implement reasonable procedures to protect your personal data’s confidentiality, integrity and availability (e.g. preventing unauthorised access or misuse of your data, employing technical and physical restrictions for accessing and using personal data, using firewalls, etc.).

II. Retention procedures. We will keep your personal data for as long as we deem it necessary to manage our hiring relationship, comply with our legal, contractual or internal obligations and exercise the necessary controls, to resolve disputes with any parties or to face investigations from the corresponding competent authorities, and otherwise as necessary to allow us to conduct our Company (including, to detect and prevent fraud or other illegal activities). All personal data we retain will be subject to this Privacy Notice. Usually, we process your data for a maximum period of three (3) years since you applied for the job offer, unless hired, in which case your profile will be part of your employee file. 

For Communications related to future career opportunities, we will keep and use your data for this purpose until you unsubscribe or for a maximum of one (1) years, unless you provide your consent for three (3) more years. Remember that we will always provide you with a simple way to unsubscribe: either when gathering your personal data; and also in every email. In both cases there will be a clear and easy way to unsubscribe and therefore object to this type of processing. 

For events purposes, the Company will keep the data in order to fulfil the purposes of the processing pursuant to the provisions of the Self-Image regulations (e.g. Spanish Organic Act 1/1982, of May 5, on the Civil Protection of the Right to Honour, Personal Privacy and Self-Image and Italian Law No. 633/1941 on the Protection of Copyright and Neighboring Rights), or until you withdraw your consent..

III. International data transfers. The Company’s servers are located in the European Economic Area (“EEA”), but sharing content on social networks may involve an international transfer of data to third countries whose data protection laws may not be as comprehensive as those of EEA countries. Disclosure of your data will be made, where appropriate, in accordance with applicable law and with appropriate safeguards to ensure an adequate level of protection of privacy and fundamental rights of individuals.

How can you control the personal data you have given to us?

We want you to be in control of how your personal data is used by us. You can do this in the following ways:

1. Managing your information. You may access and update some of your information through your candidate profile or contact privacy.careers@edreamsodigeo.com 
2. Rectification of your information. You have the right to ask us to correct inaccurate or incomplete personal information about you and that you cannot update yourself in your candidate profile by contacting us at privacy.careers@edreamsodigeo.com
3. Data access. You may request information relating to your personal data and copies of such data.
4. Data portability. You may also be entitled to request copies of your personal information that you have provided to us in a structured, commonly used, and machine-readable format where technically feasible.
5. Data erasure. You may request to have your personal information deleted. We may not be able to erase it due to the fact that the data processing may be necessary for the performance of the contract between you and us, for our compelling legitimate Company interests (e.g. security-enhancing), or to comply with our legal obligations (e.g.legal reporting, auditing obligations). In any case, we will immediately erase it when we can do so. Please bear in mind that, as we protect our services from accidental or malicious loss and destruction, some residual copies of your personal information may not be removed from our backup systems for a limited period of time (within a week).
6. Objection and restriction of the processing. You may require us not to process your personal information for certain specific purposes where such processing is based on legitimate interest, such as, for non-strictly necessary communications (such as, notifications regarding relevant job opportunities or informing about relevant activities such as our referral program or other events). If you object to such processing, we will no longer process your personal information for these purposes unless we can demonstrate compelling legitimate grounds for such processing or such processing is required for the exercise or defence of legal claims.
7. Withdrawing your consent. If we are processing your personal information based on your consent you may withdraw your consent at any time, specifying which consent you are withdrawing. Please note that the withdrawal of your consent does not affect the lawfulness of any processing activities based on such consent before its withdrawal.

In order to exercise your rights, or contact our DPO, please contact privacy.careers@edreamsodigeo.com. In your request, you have to clearly state your personal identity, by indicating your complete name and the email address you used to apply or create an account, and the right(s) you are exercising.

We will come back to you as soon as possible and no later than one month after receipt of your validated request unless we need further time to manage your request, in which case we will inform you.

Please note that we may ask you to verify your identity and request before taking further action on your request. You can also ask the Supervisory Authority on Data Protection (for Spain https://www.aepd.es/) or any other applicable supervisory authority if you wish.

Last revision: March 2023.