Privacy notice for candidates

1. Introduction

This notice (Notice) describes how EDP RENOVAVEIS, S.A. and its subsidiaries, where relevant for the recruitment process (hereinafter, jointly referred as the “Group”), will process personal data provided by the candidate (the "Candidate") that applies to an EDPR job opening as published on the website www.edpr.com or on LinkedIn, or sends his/her CV to EDPR, also by means of head hunters or external job recruiters.. 

2. What and Who This Privacy Notice Cover?

This Notice applies to all candidates of EDPR Group and its affiliated companies.

The Candidate is informed that his or her personal data will be processed by EDP RENOVÁVEIS, S.A. which will be managing the recruitment process on behalf of the entities of its Group. Consequently, the Data Controller will be the corresponding entity which establishes the precontractual or contractual relationship with the data subject (hereinafter, “EDPR” or “the “Data Controller”). Please find the list of Group entities involved in Annex I. 

The Group has designated a Data Protection Officer which can be contacted at the following e-mail address dataprotection@edpr.com

3. What Kind of Personal Data Does EDPR Collect About the Candidate?

We collect and use the following categories of personal data from and about our candidates (some or all may apply to you):

Candidates´ Personal Data is identifiable information that an individual makes available to EDPR either directly or indirectly in connection with the recruiting process orsharing your work experience or interests. EDPR may collect Candidate Data directly from a job candidate or from third parties, for example, through LinkedIn. Candidate Data may include a variety of information, such as candidate status, work history/job data, education, employer feedback, questionnaire results, contact information, additional information  provided by the candidate (e.g., a cover letter), expertise or project work publicly shared if applicable and/or require by law.

4. How Does EDPR Use the Candidate's Personal Data?

EDPR processes the Candidate's personal data for the following purposes (hereinafter, the “Purposes subject to Consent”): 

a) Administer the recruiting process; managing your application; conducting assessments; 
organizing interviews; processing interview feedback; on-boarding; analysing the hiring process and outcome; 
b) administrative and accounting purposes during the pre-contractual phase in order to execute an employment or collaboration agreement with the Candidate;
c) offer the data subject prospective positions matching his or her profile.
d) to keep and store the CV of the Candidate who does not pass the selection process, including it, if applicable, in a repository with this information (Job Bank), in order to be able to be called again to other different processes that arise in the future based on the needs of EDP RENOVAVEIS, S.A. or any of its subsidiaries and require profiles that include their professional characteristics.

EDPR processes the Candidate's personal data for the following purposes (hereinafter, the “Purposes subject to Legitimate Interest”):

e) exercising or defending legal claims in court proceedings or in an administrative or out-of-court procedure; and
f) complete a potential merger, sale of assets or transfer of all or a material part of its business, by disclosing and transferring the Candidate's personal data to the third party or parties involved in the transaction as part of the transaction.
g) manage spontaneous applications and administer the recruitment process; conducting 
assessments; organizing interviews; processing interview feedback; on-boarding; analysing the hiring process and outcome.
h) Analyse the Candidate's adequacy in line with EDPR Group's due diligence procedures, in accordance with EDPR's legitimate interests in ensuring compliance with internal integrity requirements and policies among its employees, for which a balancing assessment between EDPR's legitimate interests and the rights and freedoms of data subjects has been performed. In order to achieve this objective, the following checks will be carried out:

  • i. checks relating to the Candidate's relationship with Politically Exposed Persons (PEPs),
  • ii. verification on the Candidate's inclusion on national and international sanction lists or exclusion lists.
  • iii. verification of the Candidate's involvement in judicial and/or administrative proceedings that may lead to the commission of unlawful acts that may affect, directly or indirectly, EDPR's activities.

The checks described above are necessary to prevent the risk of committing certain offences and to maintain an adequate level of integrity among EDPR employees.

However, in order to avoid damage and potential negative consequences arising from such 
processing, technical and organisational measures have been taken to guarantee the appropriate use of this information, in accordance with the principle of data minimisation, as well as to reinforce its confidentiality and security. The Candidate may object to this processing in accordance with the provisions of the section on the Candidate's Rights regarding Personal Data Protection.

Finally, EDPR processesthe Candidate’s personal data for the following purposes (hereinafter, “Purposes subject to Legal Obligations”):

i) compliance with the applicable national/EU laws and/or respond to request from public and government authorities.

5. On What Legal Basis Does EDPR Process the Candidate's Personal Data?

The lawful basis for the processing of personal data for purposes subject to Consent lies on the consent of the data subject, through a positive and affirmative action, which can be withdrawn at any time (without prejudice of the lawfulness of any previous processing), although this would mean that the data subject would not be taken into account for the corresponding application process.

The lawful basis for the processing of personal data for purposes subject to Legitimate Interest lies on the Legitimate Interest of the Data Controller, which is carried out pursuant to article 6, letter f) of the EU General Data Protection Regulation No. 679/2016 (the "GDPR"), for the pursuit of EDPR legitimate interest, which is adequately balanced with the Candidate's interest since the data processing is performed within the limits strictly necessary to perform such activities. This data processing activity regarding the Legitimate Interest Purposes is not mandatory and the Candidate can object to the data processing at any time through the modalities as per Section 10 of this Privacy Notice. In such case no data processing will be carried out by EDPR, except in case where EDPR demonstrates the existence of compelling legitimate grounds for the processing or for the establishment, exercise or defense of legal claims.

The lawful basis for the processing of personal data for the purposes subject to Legal Obligation lies on the need for the Data Controller to comply with applicable regulation, which renders the processing mandatory.

If a candidate is hired, Candidate Data may be used in connection with his/her employment contract. 

6. How Does EDPR Process the Candidate's Personal Data? 

Candidate's personal data will be processed both electronically and/or manually, in any case in such a way as to guarantee the security, protection and confidentiality of the data, thanks to appropriate administrative, technical, personnel and physical measures against loss, theft and unauthorized use, disclosure or modification.

7. Who Can Have Access to the Candidate's Personal Data?

At EDPR, we use third parties for recruitment-support services (e.g., head-hunters, work agencies). In providing such services, these third parties process your personal data on behalf of, or in collaboration with. EDPR. For any third party that we use, we will confirm that they provide sufficient guarantees regarding the protection of your data. We will require that any third party complies with our data security standards and international transfer restrictions. 

In turn, the EDPR subsidiaries listed in Annex I of this privacy policy may receive the Candidate's CV through the Job Bank, if he/she is included in it with his/her consent, in order to offer him/her jobs in the event that new recruitment processes are opened in the different subsidiaries of the Group that fit his/her professional profile.

EDPR may be required to disclose certain Candidates´ Personal Data to other third parties (1) as required by law; (2) to protect EDPR’s rights to the extent authorized or permitted by law; or (3) in an emergency where the health or safety of a Candidate or other individuals may be endangered. 

In addition, in the event of a re-organization, merger, sale, joint venture, assignment, or other transfer or disposition of all or any portion of EDPR’s business, EDPR may transfer Candidate Data to successor entities or parties.

8. Is the Candidate's Personal Data Transferred Abroad?

Data may be transferred to foreign countries within the European Economic Area, in particular in Spain and Portugal. For transfers from EU to countries not considered adequate by the European Commission, the Company has put in place appropriate and suitable safeguards to protect the personal data of the Candidate. Accordingly, personal data are transferred in compliance with the requirements and the obligations provided by applicable data protection laws, such as standard contractual clauses adopted by the European Commission as per Articles 45, 46 and/or 49 of the GDPR. 

For further information with regard to the appropriate or suitable safeguards and the means by which to obtain a copy of them, the Data Subject can contact EDPR with the modalities as per this Privacy Notice and, specifically, contact the DPO at dataprotection@edpr.com.

9. Which Retention Period Applies to the Candidate's Personal Data?

Candidates' Personal data are stored for the period necessary to fulfil the purposes for which the data was collected as outlined in this Privacy Notice. In any case the following retention periods will apply to the processing of the Candidate's personal data for the purposes indicated below:

a) If your application for employment is successful and you commence employment with EDPR, your personal data will be maintained consistent with country specific retention periods according to applicable employment law.

b) If your application for employment is not successful, we will generally keep your personal data beyond the end of the selection process for a limited period of time specific to the country where the job is located (i) to meet recordkeeping requirements, and (ii) for potential use in legal proceedings. We will keep personal data for a period of up to 12 months to avoid unreasonable duplications of recruiting efforts, except when the retention of the data is necessary to respond or to file a legal action, upon request of the competent authorities or in compliance with the applicable laws.

c) If your job application is unsuccessful, we will keep and store your CV (including it, if applicable, in a Job Bank), in accordance with the consent previously given, in order to be able to call you back to other different processes that arise in the future based on the needs of EDP RENOVAVEIS, S.A. and its subsidiaries and require profiles that include your professional characteristics for a period of up to 24 months.

10. What Are the Candidate's Rights With Regard to Personal Data?

Without prejudice to any other right expressly provided for by the applicable local legislation, the Candidate, at any given time, can exercise the following rights, by sending an email to the following address of the DPO: dataprotection@edpr.com.

a) to obtain from EDPR confirmation of the existence of personal data and to access its content and source,

b) to verify its accuracy and request its integration, update or amendment;

c) request the erasure, anonymisation or restriction of the processing of personal data processed in breach of the applicable laws; 

d) to withdraw the consent to the processing of the data (if and to the extent such a consent is applicable), without prejudice to the lawfulness of previous processing;

e) request EDPR to limit the processing of the Candidate's personal data where:

  • the Candidate contests the accuracy of the personal data until EDPR has taken sufficient steps to correct or verify its accuracy;
  • the processing is unlawful but the Candidate does not want us to erase the Candidates' personal data; 
  • EDPR no longer needs the Candidate's personal data for the purposes of the processing, but the Candidate requires them for the establishment, exercise or defence of legal claims; or
  • The Candidate has objected to processing justified on legitimate interests, pending verification as to whether EDPR has compelling legitimate grounds to continue processing;

f) object to the processing of the Candidate's personal data in case of processing based on legitimate interest, unless EDPR demonstrates the existence of compelling legitimate grounds for the processing or for the establishment, exercise or defence of legal claims; 

g) receive an electronic copy of the Candidate's personal data, if the Candidate would like to port its personal data to itself or a different provider (data portability), when EDPR is relying upon the Candidate's consent or the fact that the processing is necessary for the provision of the Services and the personal data is processed by automatic means.

Additionally, the Data Subject may lodge a complaint with the relevant data protection supervisory authority should he or she considers his or her rights have been violated.

11. Updates

This Privacy Notice is valid from the date of effectiveness below. However, the Privacy Notice might be subsequently updated or integrated, also as consequence of changes in the relevant data protection laws and regulations. Changes will be notified in advance and in any case the Candidate will be able to consult the updated version of the Privacy Notice on the website www.edpr.com.
 

Last updated: July, 2021.


 

Annex I

The following list includes all the entities of the EDPR Group, which will manage recruitment processes and which, could be data controller of the processing of your personal data:

  • EDP RENEWABLES EUROPE S.L
  • EDP RENEWABLES POLSKA, SP Z.O.O.
  • EDP RENOVABLES ESPAÑA, S.L.
  • EDP RENOVAVEIS BRASIL S.A.
  • EDP RENOVAVEIS PORTUGAL
  • EDP RENOVAVEIS S.A.
  • EDP RENOVAVEIS SERVICIOS FINANCIEROS S.L.
  • EDPR FRANCE HOLDING
  • EDPR ITALY HOLDING
  • EDPR PT - PROMOÇÃO & OPERAÇÃO
  • EDPR ROMANIA SRL
  • ENERGIAKI ARVANIKOU M.EPE
  • VIENTOS DEL NORTE S.A.S
  • EDP RENEWABLES HUNGARY KFT
  • EDP RENEWABLES CHILE SPA 
  • EDPR CROSS SOLUTIONS, S.A 
  • EDPR SERVICIOS
  • ENERGOPARK
  • VENTO LUDENS LIMITED
  • EOLICA DE COAHULIA, S.A. DE C.V.
  • VIENTOS DE COAHULIA, S.A. DE C.V.
  • EDPR SERVICIOS DE MEXICO, S. DE R.L. DE C.V.
  • PARQUE SOLAR LOS CUERVOS S. DE R.L. DE C.V.
  • EDP RENEWABLES NORTH AMERICA LLC 
  • EDPR NA DISTRIBUTED GENERATION LLC 
  • OW NORTH AMERICA LLC 
  • EDP RENEWABLES CANADA LTD