Candidate Data Protection

1. Data controller

The WhileResume platform (the “Platform”), operated by Mirtillo EURL, 2 rue de la Hollau, 67540 Ostwald, acts as the data controller for the personal data of candidates who create an account and upload their CV.

2. Data collected

The following data may be collected and processed when the Platform is used:

• identification details (first name, last name, contact details, email address and telephone number);
• professional data (CV, work experience, qualifications, skills, references and any salary expectations);
• connection data (logs, IP address and cookies strictly necessary for the operation of the Service).

3. Purposes of processing

Personal data is collected for the following purposes:

• connecting candidates with partner companies and recruiters;
• enabling candidates to create, upload and distribute their CV;
• facilitating direct contact between candidates and recruiters;
• improving the operation of the Platform and ensuring its security.

4. Legal basis for processing

Data processing is based on:

• the candidate’s consent, given when registering and uploading a CV (Article 6(1)(a) GDPR);
• performance of a contract relating to connections made through the Platform (Article 6(1)(b) GDPR);
• the Platform’s legitimate interest in ensuring the security and proper operation of the Service (Article 6(1)(f) GDPR).

5. Data recipients

The data is accessible only to:

• recruiters and companies registered on the Platform when searching for candidate profiles;
• technical service providers involved in operating the Platform, including hosting and maintenance providers, who are subject to strict confidentiality obligations;
• the competent authorities, where applicable, pursuant to a legal obligation.

6. Retention period

Candidate data is retained for as long as the candidate’s account remains active.

If the account is inactive for an extended period of 24 months, it may be deleted after prior notice.

Certain data may be retained to comply with legal obligations or in the event of a dispute.

7. Candidates’ rights

Under the GDPR, each candidate has the following rights:

• the right to access their data;
• the right to rectify inaccurate data;
• the right to erasure (the “right to be forgotten”);
• the right to restrict processing;
• the right to data portability;
• the right to object to processing.

These rights may be exercised at any time by contacting contact@whileresume.com.

8. Data security

The Platform implements appropriate technical and organisational measures—including encryption, access controls and backups—to protect the confidentiality, integrity and availability of personal data.

9. Transfers outside the European Union

Data is hosted within the European Union. No data is transferred outside the EU without ensuring an adequate level of protection that complies with GDPR requirements.

10. Complaints

If candidates encounter an issue concerning the management of their personal data, they may submit a complaint to contact@whileresume.com and, as a last resort, to the competent supervisory authority (the CNIL in France).