How we process your data

Mangopay S.A., registered at 2 Avenue Amélie, L-1125 Luxembourg (“Mangopay S.A.”), Mangopay UK Limited, registered at 42 Berners Street, W1T 3ND London, UK, (“Mangopay UK”), Mangopay Ireland Ltd registered at 6th Floor, 2 Grand Canal Square, Dublin 2, D02 A342 (“Mangopay Ireland”), Leetchi S.A., registered at 4 Rue de la Tour des Dames, 75009 Paris, France, (“Leetchi”), Nethone Sp. z o.o. with its registered seat in Warsaw (00-844) at Plac Europejski 1 (“Nethone”) are joint controllers of your personal data for the purpose recruitment processes and informing about recruitment events and initiatives (jointly referred to as the “Group Companies”, “we”, “our”).

Legal bases of the processing

The Group Companies will process your personal data on the following legal bases:

1.    Consent, for the purpose of:

• processing your current recruitment applications, insofar as consent may be required, and for future recruitment purposes;
• processing your application for events or trainings;
• informing you about current initiatives of the Group Companies in the area of recruitment and/or HR;
• participation in surveys;

2.    To fulfil contractual obligations: 

• the processing of your personal data is necessary to take steps, at your request (by actively submitting your job application), prior to entering into a contract with you -  to assess your eligibility for the job you are applying for;

3. Our legitimate interests, i.e:

• assessing your qualifications and suitability for the job position(s) you apply to and to manage our recruitment processes;
• defending against potential legal claims, should such arise in the future (for the purpose of exercising our legal rights);
• securing information in the event that such need arises based on provisions of law (for evidentiary purposes);
• keeping you informed about new job offers, events organized by the Company and other ongoing activities (for the purpose of keeping an ongoing relationship with you), provided that you expressed the will to take part in future recruitment and to receive such communication.

Provision of your personal data through application form and in the attached CV is necessary in order for us to process your application. If you don’t provide us with the required data, we will not be able to invite you to take part in our recruitment process.

If you apply through a recruitment agency, the relevant agency will be acting as a separate data controller and will be responsible for ensuring legality of processing of your personal data as well as fulfilling information obligations towards you. We only receive your personal data from the agency if you grant your consent, in which case the agency provides you with this personal data protection notice on our behalf.

Responsibilities of Joint Controllers

Group Companies run multiple recruitment processes simultaneously, while searching for candidates with comparable qualifications for similar positions. Because of that, the recruitment process is highly centralised and Group Companies are acting as joint controllers with respect to your personal data. As a result, the Group Companies jointly determined their respective responsibilities for compliance with data protection obligations. In particular the Group Companies have decided that Mangopay S.A. and Nethone, as the case may be, are responsible for:

• collecting consents for processing of personal data for current and future recruitment projects and for communication with individuals on behalf of all the joint controllers;
• fulfilling information obligation on behalf of joint controllers;
• ensuring legal basis for data transfers outside the European Economic Area (EEA), should Group Companies decide to entrust the processing of data in the HR database to entities  located in a third country;
• conclusion of data processing agreements when data are entrusted to processors for recruitment purposes;
• acting as a common points of contact for individuals whose data are processed.

Your rights

In order to exercise your rights under applicable data protection regulations, such as the GDPR, you can contact us either at privacy@nethone.com or dpo.mangopay@mangopay.com.

Right to object. You have the right to object to the processing carried out by Group Companies based on our legitimate interests. If you do so, we will stop processing your data for the purposes listed above, unless we are able to prove that legally justified bases exist, which override your rights and interests, or that your data is necessary for the purpose of establishing, defense and exercise of legal claims, or when we have an obligation to keep your data based on binding provisions of law.

Withdrawal of consent. When your personal data is processed based on your consent, you have the right to withdraw it at any time, in which case we will stop processing your personal data and we will delete it. Withdrawal of consent does not affect legality of processing carried out by Group Companies prior to your withdrawal. 

Moreover, you have the right to:

• access your data and obtain a copy thereof;
• rectification (correction) of your data, in the event that it is outdated or incorrect and to restriction of processing;
• data portability, i.e. to ask us to transfer your personal data to another data controller;
• to file a complaint with a data protection authority (DPA).

Retention period

We process your data for the duration of recruitment process and additionally for up to three months after closing the recruitment process. We may process your data for a longer period, established based on the following criteria:

• whether we are planning to recruit for similar positions in the future, which you might find of interest, and you consented to processing of your data for the purpose of future recruitment – we will keep your personal data for up to 2 years from the date of consent;
• whether processing of your personal data is necessary for defense of potential future claims – for the aforementioned purposes, depending on circumstances, we may archive your personal data for a period of up to 5 years, starting from the closure of the recruitment process.

If we receive your personal data from a recruitment agency, we need to keep it for up to 1 year for evidentiary purposes which follow from our contractual obligations with the agencies.

Your data will be deleted upon the lapse of the established retention periods or if you (i) withdraw your consent, (ii) successfully object to the processing based on legitimate interest or (iii) if we establish that your data is outdated or no longer necessary for the purpose of collection (e.g. if you stop expressing your will to take part in future recruitment). 

Data recipients

We do not make your data available to third parties. However, we may sometimes have to share your personal data with competent authorities (in particular the police or prosecution service), if they approach us with such a request, provided that there exists an appropriate legal basis for making your personal data available to them (e.g. a court order). 

Your application is treated confidentially. Only our hiring managers and our HR departments (recruitment officers, managers, etc.) will have access to your personal data. If the recruitment process is successful, in order to finalize the recruitment, our HR department will be required to transmit some of the information collected to the relevant organizations (notably pertaining to unemployment insurance, health insurance, retirement, mutual insurance).

We entrust the processing of your personal data to entities, which provide us with hosting services and recruitment management software (e.g. HR database). In the event that we entrust the processing of your personal data to entities outside the EEA, we make sure that appropriate safeguards are in place. In particular we ensure to conclude a data transfer agreement based on Standard Contractual Clauses adopted by the European Commission.

Data Protection Officers

• For Nethone:

Mr. Michał Madej; mail: privacy@nethone.com.

• For other Group Companies :

You can contact the DPO at: dpo.mangopay@mangopay.com. 

Supervisory Authority

If you consider that your rights under applicable data protection legislations have been infringed as a result of the processing of your personal data, you have the right to lodge a complaint with or directly contact the following supervisory authorities at any time.

• Polish DPA: Prezes Urzedu Ochrony Danych Osobowych,
• Luxembourg DPA: Commission nationale pour la protection des données  
• UK DPA: Information Commissioner’s Office (ICO)
• French DPA: Commission nationale de l’informatique et des libertés
• Irish DPA: Data Protection Commission