Candidate Data Protection

1. Data Controller

The WhileResume platform (hereinafter “the Platform”), operated by Mirtillo EURL, 2 rue de la Hollau, 67540 OSTWALD, acts as the data controller for the personal data of candidates who create an account and upload their CV.

2. Data Collected

In the context of using the Platform, the following data may be collected and processed:

  • Identification information (first name, last name, contact details, email address, phone number);
  • Professional data (CV, work experience, degrees, skills, references, salary expectations if applicable);
  • Connection data (logs, IP address, cookies strictly necessary for the operation of the service).

3. Purpose of Processing

Personal data is collected for the following purposes:

  • Connecting candidates with partner companies and recruiters;
  • Enabling the creation, publication, and distribution of CVs;
  • Facilitating direct contact between candidates and recruiters;
  • Improving the functioning of the Platform and ensuring its security.

4. Legal Basis for Processing

Data processing is based on:

  • The candidate’s consent (Article 6.1.a GDPR), given when registering and uploading their CV;
  • The performance of a contract (Article 6.1.b GDPR) related to connections made via the Platform;
  • The legitimate interest of the Platform in ensuring the security and proper functioning of the service (Article 6.1.f GDPR).

5. Data Recipients

Data is accessible only to:

  • Recruiters and companies registered on the Platform, as part of their candidate searches;
  • Technical service providers involved in the operation of the Platform (hosting, maintenance), subject to strict confidentiality obligations;
  • Competent authorities, where applicable, in compliance with a legal obligation.

6. Data Retention

Candidate data is retained for as long as their account remains active.

In the event of 24 months of inactivity, the account may be deleted after prior notification.

Certain data may be retained to meet legal obligations or in the event of a dispute.

7. Candidate Rights

In accordance with the GDPR, each candidate has the following rights:

  • Right of access to their data;
  • Right to rectify inaccurate data;
  • Right to erasure (“right to be forgotten”);
  • Right to restrict processing;
  • Right to data portability;
  • Right to object to processing.

These rights may be exercised at any time by contacting [dedicated DPO or support email address].

8. Data Security

The Platform implements appropriate technical and organizational measures (encryption, access control, backups) to ensure the confidentiality, integrity, and availability of personal data.

9. Transfers Outside the European Union

Data is hosted within the European Union. No transfers outside the EU are carried out without ensuring an adequate level of protection in compliance with GDPR requirements.

10. Complaints

In the event of any difficulty regarding the management of their personal data, candidates may file a complaint with [DPO contact]. As a last resort, they may contact the competent supervisory authority (CNIL in France).