Data controller
For its own processing activities (commercial relationship, account management, billing, security, abuse prevention, legal obligations), the controller is:
- Company
- OPERIANCE
- Address
- 125 boulevard Diderot, 75012 Paris, France
- Contact
- jeremie@operiance.com
Where OPERIANCE processes data on behalf of a client organisation as part of its business processes, that organisation is the controller and OPERIANCE acts as processor, within the scope defined by the applicable data processing agreement (DPA).
Applications to job offers published via OPERIANCE: when a person applies to an offer published on an OPERIANCE page, the controller for the application is the organisation publishing the offer. OPERIANCE acts as technical processor for this recruitment processing.
Abuse prevention on the application form: for this purpose, strictly limited to the security and abuse prevention of the OPERIANCE platform, OPERIANCE acts as controller on its own behalf. This processing is separate from the recruitment processing.
Applications to job offers
Journey: an organisation publishes an offer on an OPERIANCE page (Public offer); a person applies to it (Application); an authorised user of the organisation may then manually analyse how well the application fits the assignment (Positioning).
Recipients: authorised recruiters and users of the organisation publishing the offer; OPERIANCE, as processor; the technical providers already listed in the “Recipients and providers” section.
The application is processed only for the offer concerned. It does not feed a candidate pool, does not create a permanent profile and is not reused for other assignments.
When a Positioning is created from an application, it is limited to evaluating that application for the assignment to which the person applied.
Application form abuse prevention: to limit abusive submissions, a temporary technical fingerprint may be computed when the form is submitted. No raw IP address is stored in the application file or retained by this anti-abuse mechanism. A temporary technical fingerprint may be used to limit abuse; it is kept separate from the candidate file and automatically deleted within 24 hours.
Data that may be processed
Depending on how the website and the service are used, the following categories may be processed:
- Identity and professional contact details
- Account and organisation data
- Contact or demo requests
- Contractual and billing data
- Candidate and profile data where the service is used for that purpose
- CVs and professional documents
- Information related to assignments and requirements
- Qualification responses and positioning information
- Generated documents and deliverables
- Technical and connection data
- Necessary security and usage logs
For an application to an offer published via OPERIANCE, the data collected is: first name, last name, email address, CV or skills dossier, message (optional), application status, and technical data strictly necessary for operation and abuse prevention under the rules described above.
Purposes
- Providing and operating OPERIANCE
- Managing accounts and organisations
- Performing contracts and responding to requests
- Managing applications to offers published via OPERIANCE, on behalf of the organisation publishing the offer
- Providing support and issuing invoices
- Securing the platform and preventing abuse
- Complying with applicable legal obligations
- Improving the technical operation of the service according to applicable roles
Legal bases
- Performance of a contract or pre-contractual measures
- Legitimate interest (security, abuse prevention, commercial relationship management, technical improvement)
- Legal obligation
- Consent, only where it is genuinely required
Mapping between purposes and legal bases:
- Application to an offer: pre-contractual measures taken at the data subject’s request (Article 6(1)(b) GDPR), on behalf of the organisation publishing the offer, as controller.
- Application form abuse prevention: OPERIANCE’s legitimate interest in ensuring the security of the service and preventing abuse (Article 6(1)(f) GDPR).
Recipients and providers
- Authorised OPERIANCE personnel
- Authorised users of the client organisation
- Providers necessary to operate the service
- Legally competent authorities where required by law
Providers are involved by category: cloud hosting and infrastructure, artificial intelligence model providers, email delivery, and technical services necessary to operate the service.
Additional information about providers can be shared within a contractual or due diligence framework.
International transfers
The primary infrastructure is located in the European Union. Some providers may nevertheless involve processing outside the European Economic Area.
Where such transfers occur, the applicable legal mechanisms (in particular standard contractual clauses or an adequacy decision) are used where required.
Retention periods
Retention periods depend on the nature of the data, the contractual context, legal obligations and applicable internal rules.
- Unconverted prospects: retention of up to three years from the last relevant commercial contact, subject to applicable regulations.
- Active clients: retention for as long as needed for the contractual relationship, then according to the applicable end-of-relationship periods and mechanisms.
- Billing data and accounting obligations: retention for the legally required periods.
- Applications: retained for the duration of the recruitment process, then for up to three months after the decision on the application or the closure of the relevant assignment. Creating a Positioning does not extend this period.
- Data derived from a Positioning (extractions, analyses, generated deliverables): deleted together with the application they originate from.
- Anti-abuse technical fingerprint: automatically deleted within 24 hours.
Artificial intelligence
Certain processing activities use automated systems and artificial intelligence models to analyse, structure, match, summarise, flag information to be confirmed and enrich available information.
The purpose is to assist the business process, not to artificially create experience or skills. No absolute accuracy or completeness is guaranteed and important elements must be verified.
Positioning: when an authorised user of the organisation manually creates a Positioning from an application, AI-assisted processing may be used to extract information from the CV, assess coverage of the assignment requirements, produce a diagnosis, prepare qualification and generate deliverables.
This processing assists the user and makes no decisions. No decision based solely on automated processing, within the meaning of Article 22 GDPR, is taken: no rejection, hiring or presentation to a client is triggered automatically.
Enrich the information. Never invent it.
Security
Reasonable technical and organisational measures are implemented: access control, strong authentication for administrative access, encryption in transit, logging and monitoring.
As no measure can guarantee absolute security, these measures constitute a best-efforts obligation and evolve with the state of the art.
Data subject rights
Where applicable, data subjects have the following rights:
- Access
- Rectification
- Erasure
- Restriction
- Objection, where processing is based on legitimate interest
- Portability, where processing is based on contract or consent and carried out by automated means
- Withdrawal of consent where processing is based on consent
- Lodging a complaint with the CNIL (French data protection authority)
These rights can be exercised at jeremie@operiance.com. Reasonable identity verification may be requested where necessary.
Where data is processed on behalf of a client organisation, the request may be redirected to that organisation as controller.
For an application to an offer, the data subject should first contact the organisation publishing the offer, as controller. If the request is sent to OPERIANCE, it is forwarded to that organisation. For the abuse prevention mechanism, requests can be sent directly to OPERIANCE at jeremie@operiance.com.