Vestiaire Collective SA and, where applicable, the group entity to which you are applying, collect and process personal data about you at the time of your recruitment, regardless of the type of contract envisaged (employment contract, internship, apprenticeship, etc.).

In accordance with applicable regulations, particularly Regulation (EU) 2016/679 of April 27, 2016, concerning the protection of individuals with regard to the processing of personal data and the free movement of such data (hereinafter referred to as the "GDPR"), we wish to provide you with all the necessary information to understand how and why we process your data, what we do with it, how long we retain it, the recipients to whom we may transmit it, and the rights you have.

We thank you for carefully reading this note, which is addressed to all candidates applying for a position within the Vestiaire Collective group.

1. Who is the data controller of your personal data? 

Vestiaire Collective SA, located at 53 rue de Châteaudun, 75009 Paris, France, is the data controller. Furthermore, if the job offer is attached to one of the subsidiaries of the group, that subsidiary also becomes the data controller for the routine administrative management of your file, including, for example, dealings with local authorities to comply with legal obligations that apply in the country where you work.

2. The categories of personal data we process:

The mandatory or optional nature of the information is indicated in the collection forms. Each data is collected and processed within the limits of applicable regulations.

The personal data listed below are collected directly or indirectly from candidates.

Information regarding your civil status and identity: Name, first name, photograph, date of birth, gender, personal contact information, information regarding immigration and right to work, languages spoken.

Economic and financial information: Remuneration and benefits, salary expectations.

Information related to the recruitment process: Personal data included in the CV and cover letter, application form, interview records and notes, evaluation records and notes, professional references, profile on professional networks, information related to your presence in our premises for face-to-face interviews, management of any declared conflicts of interest, emails exchanged during the recruitment process, type and duration of the proposed contract, content of the practical case, evidence of claims (diplomas, employer certificates, justification of non-competition clause release, etc.) following data provided in the application, participation in satisfaction surveys and recruitment process surveys.

Information related to health, workplace safety, and work disabilities: Disability or illness status only if you report it.

Information related to professional alerts and their processing (only if you use our professional alert system): Personal data related to the subject of the report or alert, reported facts, data regarding the person reporting and the person accused, testimonies.

Any other personal data: what you decide to communicate to the group's staff in the context of your recruitment, orally or in writing.

Vestiaire Collective does not process data related to offenses, criminal convictions, and related security measures.

Vestiaire Collective also conducts analyses and statistics, but only anonymously and in aggregate so that we cannot identify candidates.

3. The reasons and legal basis for which we process your personal data: 

All the steps and means implemented as part of our recruitment process aim to assess your ability to occupy the proposed position and measure your professional skills.

Processing based on legal obligation may differ or may not be applicable depending on your affiliated entity.

*Regarding your refusal or opposition to being part of a pool of candidates: Vestiaire Collective does not create a list of individuals who do not wish to be part of the candidate pool. If you refuse or object to being part of it, you may still be contacted through our recruitment and candidate search channels (professional social networks, headhunters), even though Vestiaire Collective has respected your choice.

Important clarifications regarding legitimate interest:

In order to legally establish processing based on legitimate interest, three cumulative conditions must be met: (i) the pursued interest must be legitimate (i.e., lawful, clearly and precisely determined, real, and present); (ii) the implemented processing must be necessary; and (iii) the processing must not conflict with the rights and interests of the individuals concerned.

Thus, we have conducted the following analysis to establish the processing of your personal data based on legitimate interest:

4. Those to whom your data is transmitted (in whole or in part, but always subject to strict necessity):

Your data is communicated only to the departments and/or employees of the Vestiaire Collective group who are authorized for their missions. Depending on the processing implemented, recipients may include:

• The Human Resources Department, the recruiting manager;
• Other entities of the group (current and future): for example, in the case of cross-linking within the group;
• Services responsible for disputes.

Additionally, we are required to transmit your data to third-party organizations (acting as sub-processor or data controller), as listed below:

• Subcontractors and service providers, particularly in recruitment (recruitment agencies, temporary agencies, etc.).
• Technical and IT subcontractors and service providers, as well as SaaS solution providers (e.g., when you apply through our platform).
• Legal advisors.
• Judicial and administrative authorities.

Your data is never sold to third parties or used for commercial purposes.

Furthermore, the managers of the premises where we conduct our activities may establish their own reception and video surveillance systems as data controllers. Vestiaire Collective is not responsible for these processing activities.

5. The duration for which we retain your data:

Your data is retained by us only for the strictly necessary duration to achieve the intended purposes.

When the legal basis is contract execution, the generally retained duration is the duration of the employment contract plus the applicable civil prescription period.

When the legal basis is legal obligation, the retained duration is the one necessary to demonstrate compliance with our legal obligation plus the applicable prescription period.

Data processed based on your consent (such as the retention of your CV in our candidate pool) is retained for 2 years from the date of your application or the date of the last contact with our organization. At the end of this two-year period, this operation may be renewed: we may ask you to consent again to the retention of your data for an additional two years.

Data processed based on our legitimate interest is generally retained for the duration of your application, plus 3 months after the decision is made to be able to answer any questions you may have, and then anonymized (unless you wish or do not object to the retention of your CV in our candidate pool).

Data processed for security purposes is retained for 30 days and then deleted.

In the event of a dispute, of any nature, Vestiaire Collective may retain data for a longer period than mentioned above, as we have a legitimate interest in taking legal action and defending our rights.

6. Transfers outside the European Union:

Your data may be transferred outside the European Union in the following cases:

• Transfers of data to other entities of the Vestiaire Collective group (for example, in the context of recruitment for a subsidiary).
• When you communicate with our partners (e.g., recruitment service providers).
• When you interact with our recruitment tools.

In all cases, and when a country outside the European Union is not recognized as having an adequate level of protection by the European Commission, we ensure the security of your data by signing the standard contractual clauses approved by the European Commission. Additionally, in situations where the recipient organizations are located in third countries whose legislation does not allow compliance with the level of protection required by European Union law and the guarantees provided by standard contractual clauses, we ensure that they have taken additional measures to ensure a level of protection equivalent to that provided in the European Economic Area.

7. Security

Vestiaire Collective implements relevant and adequate security measures to ensure the confidentiality, integrity, backup, and availability of data concerning you, in accordance with applicable regulations. Non-exhaustive measures include awareness training, user authentication, access management, logging, securing workstations and IT systems, premises protection, and subcontracting management.

8. Your rights

In accordance with applicable regulations, you have the right to access, rectify, delete, and port your personal information, as well as the right to object to and restrict processing, and the possibility to leave post-mortem directives, within the limits set by applicable regulations.

You can exercise your rights, subject to providing proof of identity if necessary to verify your identity, by contacting the Human Resources Department at the following address:

 

Vestiaire Collective

Human Resources department

GDPR request

53 rue de Chateaudun

75009 Paris

France

 

We also inform you that a Data Protection Officer ("DPO") has been appointed. You can contact the DPO directly:

 

Vestiaire Collective

Data Protection Officer        

53 rue de Chateaudun

75009 Paris

France

Or by clicking on this link: Privacy portal

Or by scanning this QR code: 

You can also file a complaint with the competent data protection authority or seek judicial remedy if your data is misused.

In France, this authority is the CNIL:

CNIL

3 Place de Fontenoy

TSA 80715

75334 PARIS CEDEX 07