Introduction

Protecting your privacy and personal data is a priority for Smatchit.

This personal data protection policy (the “Policy ”) applies to all users of the website www.smatchit.io/ (the “Site”) and the Smatchit application (“you ”, “your ” or “yours ”), who are either candidates (the “Candidates”) or recruiters (the “Recruiters”).

The purpose of this Policy is to inform you clearly and fully about the processing of your personal data carried out by Smatchit, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (the “GDPR ”) and the French Data Protection Act No. 78-17 of January 6, 1978 in its latest version in force (together, the “Applicable Regulation ”).

For information purposes, “personal data” (the “personal data ”) refers to any information relating to an identified or identifiable natural person: an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to his or her physical, physiological, genetic, mental, economic, cultural or social identity.

This Policy may be updated at any time, following, among other things, legal, technical or commercial changes. We will inform you of any substantial modification. Nevertheless, we recommend that you consult this Policy regularly in order to be informed of its latest version in force.

Who is responsible for processing your personal data?

Smatchit, a simplified joint-stock company, whose registered office is located at 23 avenue de Breteuil, 75007 Paris, registered with the Nanterre Trade and Companies Register under number B 912 616 687 (“Smatchit ” or “we ”, “our”) is the controller of your personal data (i.e., the entity that determines the purposes and means of processing your personal data) carried out through the Site and the Smatchit application allowing you to access the different services offered by Smatchit (the “Application ”).

For what purposes and on what legal basis are personal data collected?

Smatchit ensures that it collects and processes relevant, adequate, non-excessive and strictly necessary personal data with regard to the purposes pursued.

Below, you will find a table listing the relevant information regarding the processing of your personal data and more specifically:

The different purposes pursued;
The personal data collected;
The legal basis on which we rely to carry out the processing; and
The period during which we retain your personal data.

PURPOSES OF THE PROCESSING	PERSONAL DATA COLLECTED	LEGAL BASIS FOR PROCESSING	PERSONAL DATA RETENTION PERIODS
On the Site
Allow you to access the Site and use the various features of the Site via the placement of strictly necessary cookies.	Data relating to the device used to access and use the Site: IP address, technical information concerning the characteristics and operating data of the user’s device, operator, operating system, device model, IP address, language choices, date and time of access.	Legitimate interest of Smatchit in being able to provide its users with a functional Site.	The cookies placed have a lifespan of 13 months, and the information collected through these cookies is retained for a period of 25 months.
Carry out anonymous statistical analyses on the Site’s performance so as to improve and optimize its features, content and your browsing experience. To do this, we place audience measurement cookies (see our Cookies Policy for more details).	The user’s IP address, visitor identifier.	Your consent.	The cookies placed have a lifespan of 6 months.
Process applications submitted online on the Site (including if the Site redirects, for its recruitment section, to another site)	First name, last name, email, postal address, telephone number, CV and educational and professional background, cover letter.	Performance of pre-contractual measures between you and Smatchit.	If you are not hired by Smatchit: If you agree, we keep your data for 2 years from the last contact with you. In the absence of your consent, the data is retained only for the duration of the recruitment process. However, in all cases, the data is archived for evidential purposes for a maximum period of 6 years. If you are hired by Smatchit: Your data is retained for 5 years from the end of your employment contract. We invite you to consult Smatchit’s internal policies in this context.
On the Application
Create and manage your account / allow you to access the Application	Email address, last name, first name, job title, photograph (optional).	Legitimate economic interest of Smatchit to allow access to the Application in accordance with the contract signed with its clients	If you create an account, your account information is kept until you close your account – it may however be deleted earlier in the event of inactivity (after 2 years).
Manage billing/accounting with Recruiters	Last name, first name, contact details, subscribed services.	Compliance with Katalyz’s legal obligations.	10 years following the close of the accounting period.
Use the matchmaking service and set up your Candidate profile	Location data (optional), professional experience, salary expectations, language level, human qualities, emotional qualities, relationship qualities, behavioral qualities.	Performance of the contract (general terms of sale) between candidates and Smatchit. Your consent for location data.	For the entire duration of the contract and up to 5 years after the end of the contract.
Carry out studies and statistics on the use of the Application by the various users	Connection logs.	Legitimate interest of Smatchit in being able to provide its users with statistics but also to better understand how users utilize the Application.	1 year from the connection.
Allow you to access the Application (and authenticate) and use the various features of the Application via the placement of strictly necessary cookies.	Data relating to the device used to access and use the Application: technical information regarding the characteristics and operating data of the user’s device, operator, operating system, device model, IP address.	Legitimate interest of Smatchit in being able to provide its users with a functional Application.	The cookies placed have a lifespan of 13 months, and the information collected through these cookies is retained for a period of 25 months.
Other purposes pursued by the Site and the Application
Provide you with commercial information about our offers, events, services: Smatchit may send you commercial emails if you have not objected, to the email address you provided when creating your account or by signing up for our newsletter.	Email address.	Your consent.	Until you withdraw your consent or 3 years following our last contact with you / the end of the concluded contract.
Conduct satisfaction surveys, take your comments on our services into account and create commercial statistics/indicators, on the use of our services to improve them	Name, first name, information related to subscribed services, your remarks and comments.	Smatchit’s legitimate interest , more specifically its commercial and economic interest in understanding customers’ expectations and improving its products and services accordingly.	1 year after conducting the surveys and statistics.
Respond to your questions and complaints (related to the operation of the Site or the Application and the features offered by Smatchit’s various services)	Depending on the subject of your request: name, first name, email address, phone number, billing address, services you have subscribed to, and any other information you provide to us directly and voluntarily in connection with your request.	Depending on the subject of your request, the legal basis is either: If your request is not related to a service already subscribed to with Smatchit: Smatchit’s legitimate interest, more specifically its economic interest in providing a quality customer service/support; If your request is related to a service already subscribed to with Smatchit: Performance of the contract between you and Smatchit.	If your request is not related to a product/service already purchased/subscribed to with Smatchit, we will keep your personal data for 5 years after the request is closed (except for very basic requests for which your personal data will not be stored). If your request is related to a product/service already purchased/subscribed to with Smatchit, we will keep your personal data for 5 years from the end of the contractual relationship.
Manage any dispute or pre-litigation	The type of data processed depends on the dispute, but it may potentially include all the data listed in this table.	Legitimate interest of Smatchit in protecting and defending its rights and interests.	5 years after the end of the contractual relationship and/or until the end of the procedure in the event of an ongoing dispute.
Manage data subject rights requests	First name, last name, contact details, any other personal data targeted by your request.	Compliance with Smatchit’s legal obligations.	With regard to proof of identity (if required): deleted once the request is processed (it may however be retained longer, for 6 years from the closure of the request, if there is a high risk of dispute). With regard to the data collected to process the request: until the request is processed/closed. With regard to the response that is provided to you: 6 years from the closure of the request. Note that if your request concerns the deletion of your data/opposition to its processing in the context of our marketing activities, we will keep your data for 3 years in order to maintain an up-to-date opt-out list.
Carrying out all types of capital operations (including, in particular, acquisitions, disposals, mergers, demergers, contributions, partial contributions of assets, universal transfers of assets, restructurings, or any other share transfer or corporate restructuring transactions), whether partial or total, at the level of Smatchit	The type of data processed depends on the legal nature of the proposed transaction.	Smatchit’s legitimate interest, more specifically its (social and economic) interest in carrying out the contemplated transaction.	Processing of the data from the opening of the legal due diligence phases (i.e., due diligence) until the completion of the contemplated transaction.

To whom do we disclose your personal data?

Smatchit undertakes to share your personal data only under certain circumstances and in accordance with the requirements of the Applicable Regulation. Smatchit thus only discloses your personal data to identified duly authorized recipients, as described below. All recipients who may process your personal data are subject to confidentiality obligations.

Thus, Smatchit transmits your personal data:

To the persons authorized internally who need to process your personal data for the purposes specified in section 2 of this Policy.

To external recipients of Smatchit and in particular:

Public authorities and agencies to which we must disclose some of your personal data to comply with legal obligations, to protect the rights and/or safety of Smatchit or of an individual;
Third-party service providers of Smatchit, including:

Training organizations whose training courses are offered on our Application. These training organizations act as separate data controllers. We therefore invite you to consult their privacy policies to learn more about the data processing they carry out.
Google Play and Apple Store

For users who are candidates, to recruiters when the candidates’ profiles match the recruiters’ search criteria and when candidates apply to recruiters.

In addition, your personal data may be shared with third parties for the following reasons:

In the context of the completion with such third party of all types of capital operations (including in particular acquisitions, disposals, mergers, demergers, contributions, partial contributions of assets, universal transfers of assets, restructurings or any other share transfer or corporate restructuring operations), whether partial or total, at the level of Smatchit; or
In response to a legal or administrative proceeding of any kind or to law enforcement measures requested by the competent authorities.

Do we transfer your personal data outside the European Economic Area?

Your personal data may be transferred to countries located outside the European Economic Area, depending on the countries in which the recruiters with whom you wish to apply are located, which do not have an adequacy decision from the European Commission (list available here).

Where your personal data is transferred to any of these countries, Smatchit undertakes to ensure an adequate level of protection through appropriate safeguards and measures.

You may obtain a copy of these safeguards at any time by contacting Smatchit using the contact details and methods specified in section 7 of this Policy.

What are your rights regarding your personal data?

In accordance with the Applicable Regulation, you have the following rights over your personal data:

If your personal data has been processed with your consent, you are entitled to withdraw your consent at any time without affecting the processing carried out before such withdrawal (see the table in section 2 of this Policy to find out which data processing is based on your consent).
You have the right to access the personal data we hold about you (provided the request is not manifestly unfounded or excessive, in particular due to its repetitive nature), and to obtain a copy.
You may request the rectification of your personal data if it is inaccurate or outdated and/or request that it be completed (provided the request is not manifestly unfounded or excessive, in particular due to its repetitive nature). If you have an account, it may be simpler to correct your own data via the “My Account” function.
You may request that your personal data be erased. However, this is not an absolute right, as we may be required to retain your personal data for legal or legitimate reasons.

You may exercise your right to erasure in the following cases: if you have validly objected to the processing of your personal data (see the box below) or have withdrawn your consent, when the personal data is not or no longer necessary for the purposes for which it was originally collected, or when the personal data is unlawfully processed by us.

You may request the restriction of the processing. This right means that the processing of your personal data that we carry out is limited, so that we may store those data, but we may not use or process them.

This right applies in specific circumstances, namely (i) if you dispute the accuracy of your personal data: processing is then restricted for a period enabling Smatchit to verify the accuracy of the data; (ii) where processing is unlawful and you object to the erasure of your personal data and request the restriction of its use instead; (iii) where we no longer need the personal data for the purposes mentioned above in section 2, but they are still necessary for the establishment, exercise or defense of legal claims; and (iv) where you have objected to processing based on the legitimate interests pursued by Smatchit, you may request that the processing be restricted while the period necessary to determine whether we can comply with your objection request is under review.

You have the right to data portability : you have the right to receive the personal data concerning you that you have provided to us, in a structured, commonly used and machine-readable format. This applies only where the processing of your data is based on your consent or the performance of a contract with Smatchit (see the table in section 2 of this Policy to find out which data processing is based on these legal bases).
You also have the right to send us instructions regarding the fate of your personal data in the event of death.

You may object to the processing of your data.

Where we process your personal data on the basis of Smatchit’s legitimate interests (see the table in section 2 of this Policy to find out which data processing is based on Smatchit’s legitimate interests), you may at any time object to the processing of your personal data for reasons relating to your particular situation, unless we can demonstrate compelling legitimate grounds requiring the continuation of the processing of such data or where such data are required for the establishment, exercise or defense of legal claims.

You may also object at any time to receiving our commercial communications (i) by clicking on the link at the bottom of such communications or (ii) by sending a message to the contact details provided below.

Finally, you have the right to lodge a complaint with the Commission Nationale de l’Informatique et des Libertés (hereinafter the “CNIL ”). However, we invite you to contact Smatchit at the contact details indicated below before lodging any complaint with the CNIL.

To exercise all of these rights, you can send a request by postal mail to the following address: 23 avenue de Breteuil, 75007 Paris or by email at: lucas@smatchit.io.

How to contact us?

For any questions, complaints, or comments regarding this Policy or our practices regarding the protection of personal data, please contact us by writing to the following postal address: 23 avenue de Breteuil, 75007 Paris or by sending an email to: lucas@smatchit.io