Privacy policy

1. Who is responsible for your data

The TalentsHotels website is operated by I.R.I.S. FORMATION CONSEIL, a French simplified joint-stock company with share capital of 1,000 euros, registered office at 9 rue des Colonnes, 75002 Paris, France, registered with the Paris trade and companies register under number 905 385 928, SIRET 90538592800015, intra-community VAT number FR74905385928.

This company is the controller for all the processing described below. The publication director is Mr Christophe Dumont, chairman.

For any question about your data, write to [email protected].

2. The processing operations, in a table

The table below lists every processing operation. It is drawn from how the site actually works, and the following sections explain whatever warrants it.

Deleting your account immediately erases everything attached to it, except invoices, which the law requires us to keep for ten years.

3. Your account

3.1 Candidate

We collect your first name, last name, email address, your password in hashed form, and, if you fill them in, your telephone number, postal address, town, postcode, country, region, date of birth, photograph, the job title you are looking for, your current employer and a free-text description.

Purpose: to maintain your account, to publish your profile according to the visibility you choose, and to let you apply.

Deleting your account, which you may request at any time from your settings, erases your account, your profile, your applications, your messages, your interviews, your files, your relay address, your unsolicited applications and your settings.

An account with no sign-in for twenty-four months is deleted. We warn you first by email, in your own language; deletion follows thirty days later if you have not signed in again. Simply signing in before that date cancels it. This warning cannot be switched off.

3.2 Employer or recruitment agency

We collect the company name, the first name, last name and job title of the contact person, the sign-in email address, the establishment's email address, the telephone number, the postal address, the SIRET number, the VAT number, and the presentation material provided: logo, banner, photographs, video, description.

An employer account is reviewed by our administration before it can be used. We keep the decision taken, its date, its author and, where an account is refused, the reason given.

3.3 Administration

Our administration has full access to accounts and logs. This access is necessary in order to approve accounts, handle reports and answer your requests; it is limited to those people in our company who need it.

4. Your documents and your applications

4.1 CVs, cover letters, attachments

You may upload a CV in PDF format, and one cover letter per application, as text, as a PDF file, or both.

These documents are not publicly accessible. They are passed on only to the employers to whom the privacy setting you have chosen opens them, and the file itself is served only after that setting has been checked.

4.2 Applications, progress and interviews

We keep the link between you and the advert, the date of your application, its status, and the full history of status changes with the date and author of each.

Where an employer offers you an interview, we keep the type of interview — on site, by telephone or by video call —, the place or the connection link, the time slots offered, the one you accept, the title and description written by the employer, the reason for a refusal or a cancellation, and which party cancelled. The employer and you may each add notes, which are visible only to their author.

The two-year period runs from the last activity, not from submission: it is the most recent of these four dates.

• the submission of the application
• its last status change
• the last message exchanged about it
• the last change to an interview

An application submitted three years ago but discussed last month is therefore not deleted.

5. Messaging and relay addresses

5.1 Messages

Messages exchanged between a candidate and an employer are kept with their subject, their content, their date and their author.

An employer may write to you without your having applied. The message then appears among your exchanges. We do not display the employer's email address: only the establishment's name is shown to you.

5.2 Incoming email in its raw form

Where an employer replies by email to an unsolicited application, we also keep the message as we received it, including technical headers, so as to be able to attach it correctly and to deal with any dispute about delivery.

This raw form is erased after thirty days. Only the subject and the parsed body are kept beyond that.

5.3 Your relay addresses

So that you do not have to disclose your personal address, the site assigns you a relay address of the form [email protected], and an address specific to each exchange of the form [email protected].

Messages reaching those addresses are forwarded to your real address, which the recipient does not see. This arrangement exists to reduce what we disclose, not to collect more.

5.4 The automatic collection of incoming email

Every fifteen minutes, a program collects the [email protected] mailbox, which receives mail addressed to the talentshotels.com domain and to the candidats.talentshotels.com domain. Each message is examined and, as the case may be, attached to an exchange and forwarded to the candidate concerned, or set aside.

The [email protected] mailbox receives delivery failure notices. It is opened read-only: nothing is ever written there, marked or deleted. Delivery failure notices that have been examined are recorded like other incoming email, and their raw form is erased after thirty days.

6. The unsolicited application

You may send your application to an establishment that is not registered on the site, where that establishment has published a recruitment address and confirmed it.

This sending rests on your consent, obtained for each individual sending by means of a box that we never tick in advance. We record the exact wording you consented to and the date on which you did so, in order to be able to evidence it.

The site limits those sendings.

• six months must elapse between two sendings to the same establishment
• five sendings per day at most
• three at most to any one unregistered establishment
• five megabytes per attachment, ten in total

Every sending carries a link allowing the establishment to stop receiving unsolicited applications. As soon as it exercises that link, no further sending to it is possible.

You may withdraw your consent for future sendings by making no more of them. A sending already dispatched cannot be recalled: it is in its recipient's inbox.

7. Your settings, and the proof of what you accepted

7.1 Privacy settings

You choose, item by item, who may see it: you alone, the employers you have applied to, all signed-in recruiters, or everyone. That setting applies everywhere: on your profile, in recruiters' screens, in the emails we send and in your documents.

Another candidate never sees your data, whatever your setting, apart from what you have made public.

We keep the history of your choices — previous level, new level, date — so as to be able to demonstrate what you decided and when. That history outlives your account by three years, because that is precisely what it is for.

7.2 Notification preferences

You decide, type by type, which emails you wish to receive. What you untick remains visible on the site; only the sending of the email stops.

Some emails cannot be configured and are always sent, because without them you would lose the use or the control of your account.

• the validation of an address
• the resetting of a password
• the decision taken on your account
• the confirmation of its deletion
• the warning before deletion for inactivity
• invoices and payments
• the verification of a recruitment address
• the reminder before a subscription renews

We keep no copy of the emails sent.

7.3 The proof of your acceptance

When you accept the terms and conditions and this policy, we record the document accepted, its version — a date — and the time of your acceptance. For a candidate, the declaration of being at least eighteen years old is recorded in the same way.

We do not record your IP address with that acceptance: the sign-in log already carries it for the same period, and duplicating it would add no evidence.

8. The security of your sign-in

8.1 The sign-in log

On each sign-in, successful or not, we record the date, the IP address, the browser, the operating system, the device type and, where we have them, the country and town inferred from the IP address. Unsuccessful attempts are recorded too, and serve to limit the number of attempts.

That data can be consulted only by our administration. No other user, no page of the site and no downloadable document exposes it.

It is deleted automatically after twelve months.

8.2 The notice of a sign-in from a new device

We warn you by email where your account is used from a device we do not recognise.

To recognise it, we place in your browser the th_appareil cookie, which contains a randomly drawn number. We keep only its fingerprint, protected by hashing, a form of irreversible encryption: the number itself does not leave your browser, and anyone obtaining our database could not forge a valid one.

Where there is no cookie — you have erased it, or your browser refuses it — we consult a second, coarser mark: the browser family and the system family, "Chrome, Windows" for instance, likewise kept in hashed form. It does not distinguish two devices of the same configuration, and does not allow you to be tracked.

The IP address forms part of neither of those two marks, and does not appear in the email.

If neither recognises you, the notice is sent to you, and the device becomes known: the next sign-in from the same browser is silent. That notice can be switched off in your notification preferences.

9. Payments

Paid offers are settled through Stripe.

No bank card data is recorded by the site, nor does any pass through it: you enter it at Stripe.

We keep the billing identity you provide — company name, address, SIRET, VAT number, email address —, the invoices and credit notes issued with their amounts and their period, the corresponding PDF document, and the technical identifiers assigned by Stripe that allow us to match a payment to an invoice.

Accounting records are kept for ten years, as the law requires.

10. The other processing operations

10.1 Advert views

Where an advert is viewed, we record the advert concerned, the date, the visitor's IP address, their browser and the page they came from, in order to show the employer the number of views of their advert over seven and over thirty days.

The IP address and the browser are erased after thirty days. The row and the counter remain, because the display covers only seven and thirty days.

10.2 Public forms

The contact form, the demonstration request, the group quotation request and the newsletter sign-up collect the contact details you enter there. The quotation request also records your IP address and your browser.

The contact form itself records nothing in our database: it sends an email, and what remains of it is in our mailbox.

10.3 Content reports

Where a person reports content, we record the content concerned, the reason chosen, the explanation written, the date, and — if the reporter has provided them — their name and email address. Those contact details are optional: an anonymous report is examined like any other.

11. Who receives your data

Registered employers and agencies, within the limits of what your privacy setting opens to them, and of what you send them when you apply.

Our administration, under the conditions of point 3.3.

Our technical processors, at point 12.

We sell no data and pass none to any commercial partner.

12. Our processors and transfers outside the European Union

We call on third-party providers for hosting, payment, delivery and the running of the site. Some are established in the United States, which involves a transfer of data outside the European Union.

We make sure that each one provides a level of protection that complies with the General Data Protection Regulation: an adequacy decision of the European Commission, the EU–US Data Privacy Framework, or standard contractual clauses.

13. Cookies and storage in your browser

The site places three cookies, and three only.

All three are transmitted only over HTTPS, are inaccessible to JavaScript code, and are limited to the site.

These three cookies are strictly necessary for the site to work: your consent is not required, and no banner asks you for it.

The site uses no audience measurement, no advertising tracker, no pixel and no tag. It writes nothing in your browser's local storage. It loads no font from an outside service.

Two third-party services place their own cookies when they load: Stripe on the payment path, Vimeo on the profile of an establishment that has uploaded a video — when they load.

14. Minors

The service is not intended for minors. On registration, the candidate declares being at least eighteen years old; we do not ask for a date of birth and carry out no age verification.

Where it comes to our knowledge that an account belongs to a minor, we delete it, together with the data attached to it, and we inform the holder at the account's address.

If you find that an account belongs to a minor, report it to [email protected].

15. Your rights

You have the right to access your data, to have it rectified, to have it erased, to object to its processing, to request its restriction, to receive a copy of it in a reusable format, and to withdraw your consent where the processing rests on it.

Part of those rights is exercised directly from your account.

• the privacy settings determine who sees what
• the notification preferences determine what we send you
• deleting your account erases your data

For other requests, write to [email protected]. We reply within one month.

If our reply does not satisfy you, you may refer the matter to the French data protection authority, Commission nationale de l'informatique et des libertés, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr.

If data concerning you is published by another user, you may report it through the "Report" link present on every item of content, or write to [email protected]. We examine the report and promptly remove whatever is manifestly unlawful.

16. Security

Passwords are protected by hashing, a form of irreversible encryption: we cannot read them, and anyone obtaining our database could not read them either. The device fingerprint and the token of the th_appareil cookie are protected in the same way.

Exchanges with the site take place over HTTPS. CVs, cover letters and attachments are not accessible through a direct address: each download checks the session and the privacy setting. Forms are protected against forged requests, and the number of sign-in attempts is limited.

17. Changes to this policy

We state at the top the date of the version in force. Where a change alters the nature of a processing operation or adds a purpose, we inform account holders by email, and their acceptance is requested again at their next sign-in.