1. Data Controller
The WhileResume platform (hereinafter “the Platform”), operated by Mirtillo EURL, 2 rue de la Hollau, 67540 OSTWALD, acts as the data controller for the personal data of candidates who create an account and upload their CV.
2. Data Collected
In the context of using the Platform, the following data may be collected and processed:
- Identification information (first name, last name, contact details, email address, phone number);
- Professional data (CV, work experience, degrees, skills, references, salary expectations if applicable);
- Connection data (logs, IP address, cookies strictly necessary for the operation of the service).
3. Purpose of Processing
Personal data is collected for the following purposes:
- Connecting candidates with partner companies and recruiters;
- Enabling the creation, publication, and distribution of CVs;
- Facilitating direct contact between candidates and recruiters;
- Improving the functioning of the Platform and ensuring its security.
4. Legal Basis for Processing
Data processing is based on:
- The candidate’s consent (Article 6.1.a GDPR), given when registering and uploading their CV;
- The performance of a contract (Article 6.1.b GDPR) related to connections made via the Platform;
- The legitimate interest of the Platform in ensuring the security and proper functioning of the service (Article 6.1.f GDPR).
5. Data Recipients
Data is accessible only to:
- Recruiters and companies registered on the Platform, as part of their candidate searches;
- Technical service providers involved in the operation of the Platform (hosting, maintenance), subject to strict confidentiality obligations;
- Competent authorities, where applicable, in compliance with a legal obligation.
6. Data Retention
Candidate data is retained for as long as their account remains active.
In the event of 24 months of inactivity, the account may be deleted after prior notification.
Certain data may be retained to meet legal obligations or in the event of a dispute.
7. Candidate Rights
In accordance with the GDPR, each candidate has the following rights:
- Right of access to their data;
- Right to rectify inaccurate data;
- Right to erasure (“right to be forgotten”);
- Right to restrict processing;
- Right to data portability;
- Right to object to processing.
These rights may be exercised at any time by contacting [dedicated DPO or support email address].
8. Data Security
The Platform implements appropriate technical and organizational measures (encryption, access control, backups) to ensure the confidentiality, integrity, and availability of personal data.
9. Transfers Outside the European Union
Data is hosted within the European Union. No transfers outside the EU are carried out without ensuring an adequate level of protection in compliance with GDPR requirements.
10. Complaints
In the event of any difficulty regarding the management of their personal data, candidates may file a complaint with [DPO contact]. As a last resort, they may contact the competent supervisory authority (CNIL in France).