Security / GDPR

We are committed to protecting your personal data and this Privacy Notice explains how we handle the personal data that you provide to us via Keywork website. We may update this Privacy Notice from time to time and if we do so an updated version will be published and you can see when this Privacy Notice was last updated at the top of the page. We will obtain your consent to any material changes if required by Data Protection Laws.

Regarding applicants’ personal data that apply for a vacancy at Keywork Customers, the Data Controller will be processing the applicants’ personal data on behalf of those Customers as a ‘processor’ for the purpose of sourcing management. In these circumstances, Keywork Customers to whom applicants apply for a vacancy will be the controller of such applicants’ personal data and their Privacy Notice will apply rather than this Privacy Notice.

What personal data do we collect and process?

We may collect and process the following personal data:

• Name, e-mail and other contact details (telephone and/or mobile phone) of the person of contact designated by our Customers;
• Name, e-mail and other contact details (telephone and/or mobile phone) of the authorised persons to use Keywork appointed by our Customers as well as their access rights;
• Name, address, date of birth, nationality, gender, contact details, professional training, professional and education qualifications, professional experience, skills, interests, hobbies, current and past job positions, current and past employers, data of our Customers’ applicants introduced by the later in Keywork;
• Correspondence received from and sent to our Customers;
• Use of the Keywork (interactions, tools used, traffic data that results from the technical information provided by the device used by the customer or user whenever you access a Keywork service, namely IP address, browser, operating system and Internet search engine used and screen resolution);
• Details of all actions that you carry out through the Website and of the provision of services to you (such as weblogs and other communication data).

We may also collect information about the use of Keywork through cookies and other similar technologies, such as, domain name, browser type and operating system, webpages viewed, links clicked, IP address, length time of using Keywork and the referring URL or the webpage that led to Keywork. Please consult our Cookies Notice for more information about the cookies we use.

We may collect and process certain special categories of personal data about our Customers’ applicants data introduced by the later in Keywork. It is the Customers responsibility to ensure that the collection and processing of such data is required and made under local laws to carry out their obligations in the field of employment, health and safety, social security and social obligations law.

For which purposes do we process personal data and under which legal basis?

We use the personal data for the following purposes:

1. Provision of the services subscribed by our Customers
2. Customers’ relationship management
3. Keywork development, data analysis and statistical
4. Marketing to prospective Customers and Customers

The legal basis for the processing are the following:

1. Our legitimate interest in the performance of the contracts signed with our Customers
2. Our legitimate interest in the performance of the contracts signed with our Customers, reply to their queries and to comply with a legal obligation (e.g. tax, civil and corporate laws)
3. Our legitimate interests of (i) operating Keywork (ii) evaluating how Keywork is provided and used, including its performance and impact on our Customers (iii) validate upgrades and to keep Keywork safe and secure (iv) develop and test existing features and functionalities and to test and improve Keywork and (v) detecting or preventing illegal activities
4. Consent or where the law allows us to do so. You can opt-out of receiving any marketing communications from us at any time in each communication or by contacting us using the contact details section below. Please note that even where you have opted-out of marketing communications, we may still need to send you service messages, for example, information that is relevant to your use of Keywork.

To whom we may disclose personal data?

We do not sell or rent any personal data to any third party.  However, personal data may be shared with or disclosed to the following recipients:

• Affinity’s employees on a strict need-to-know basis to perform their professional duties;
• Third party providers who provide IT, could and data storage services to us (for example, to support the performance and enhance the security of Keywork);
• Competent law enforcement body, regulatory, government agency, court or other third party where we believe disclosure is necessary (i) as a matter of applicable law or regulation, (ii) to exercise, establish or defend our legal rights, or (iii) to protect your vital interests or those of any other person;
• Potential buyer (and its agents and advisers) in connection with any proposed purchase, merger or acquisition of any part of our business, provided that we inform the buyer it must use your personal information only for the purposes disclosed in this Privacy Notice;
• Other person with your consent to the disclosure.

Where we engage a third-party processor to process personal data on our behalf, such as some of those listed above, we will delegate such processing in writing, will choose a processor that provides sufficient guarantees with respect to technical and organisational security measures governing the relevant processing, and will obligate the processor to act only on our behalf and under our instructions.  In addition, we will impose in writing appropriate data protection and information security requirements on such third-party processors.

International transfers of personal data

Most of the recipients are located within the European Economic Area (EEA). However, if at any time we need to transfer personal data outside of the EEA, we will take steps to ensure that the information receives the same level of protection as if it remained within the EEA, including by entering into data transfer agreements, using the EU Commission approved Standard Contractual Clauses, or by relying on certification schemes such as the EU – US Privacy Shield.

If you have questions in relation to the transfer of Personal Data and the appropriate safeguards put in place by the Company, including to obtain a copy of the safeguards, please contact us using the contact details section below.

Security of personal data

We have implemented technical and organisational measures to protect personal information against unauthorised or unlawful processing of Personal Data and/or against accidental loss, alteration, disclosure or access, or accidental or unlawful destruction of or damage. Please keep in mind that no internet or Wi-Fi transmission is 100% secure, so please exercise caution when uploading personal information of your applicants to Keywork.

You are responsible for protecting against unauthorized access to your Keywork account. We recommend securing access to your Keywork account, by always logging out, choosing a robust password that nobody else knows or can easily guess, and keeping your account information and password private.  Affinity is not responsible for any lost, stolen or compromised passwords or for any activity on your Keywork account from unauthorized users where caused by you.  If you think your account has been compromised, please contact us as soon as you are able using the contact details section below.

Where is the personal data stored?

The personal data transmitted to Keywork will be stored in the cloud on secure regional servers of Microsoft (Microsoft Azure).

For how long do we retain personal data?

We will retain personal data while the contract is in force and in accordance with the Keywork Terms and Conditions. However, in some circumstances, we may retain personal data for longer periods of time, for instance where we are required to do so in accordance with legal, tax and accounting requirements. In specific circumstances, we may also retain personal data for longer periods of time so that we have an accurate record of your dealings with us in the event of any complaints or challenges.

When we have no ongoing legitimate business need to process personal data, we will either delete or anonymise it or, if this is not possible (for example, because personal data has been stored in backup archives), then we will securely store personal data and isolate it from any further processing until deletion is possible.

Who is the Data Controller of your personal data?

The Data Controller of the personal data of users of Keywork, including clients or prospects, is:

Name: Affinity, S.A.

Address: Av. António Augusto Aguiar, 130, 1.º e 2.º Piso, 1050-020 Lisboa

E-mail: gdpr@affinity.pt

Rights

Under the terms and subject to the exceptions foreseen in the applicable law you are entitled to:

• access the personal data we hold about you;
• have your personal data rectified if inaccurate;
• have the personal data we hold about you erased;
• restrict the use we make of your personal data;
• object to the processing of personal data we hold about you;
• receive any personal data you have provided to us on the basis of your consent, in a structured and commonly used machine-readable format or have such personal data transmitted to a third party;
• whenever the processing of your data is based on consent, withdraw your consent at any time
• lodge a complaint with your local Supervisory Authority

Your applicants may also have the right in relation to the personal data held about them through Keywork. Affinity will provide reasonable assistance and cooperation in assisting you to respond to any request by your applicants to exercise their rights.

The rights above can be exercised by using the contact details section below.

Our Contact details

If you have any questions about this Notice or any queries or complaints about how your personal information is used, or if you wish to exercise any of your information rights, please contact us by email at gdpr@affinity.pt.

Last update: July 2018