Candidate privacy notice

1. Purpose of this privacy notice

The objective of this privacy notice is to provide greater transparency for all job candidates about their Personal Data, in particular, its collection and use during and after the recruitment process organized through the e-Resourcing site “ArcelorMittalCareers” in which the job candidates participate.

Personal Data at ArcelorMittal is processed in compliance with applicable data protections laws, including the European Union General Data Protection Regulation (“GDPR”) and the ArcelorMittal Data Protection Policy and the ArcelorMittal Data Protection Procedure that is also the Group`s Binding Corporate Rules (“BCR”) available on the corporate website of ArcelorMittal.

2. Definitions

“Data Controller” or “Controller” means the natural or legal person which alone or jointly with others determines the purposes and means of Processing of Personal Data.

“Data Subject” means any natural person whose Personal Data are processed in the context of a process falling in the scope of this Procedure.

“Consent” means any freely given, specific, informed and unambiguous indication of the Data Subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the Processing of Personal Data.

“Personal Data” means any information relating to an identified or identifiable natural person. An identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity.

“Processing” of Personal Data means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction.

“Processor” means a legal entity which processes Personal Data on behalf of the Data Controller. The word “Processor” has the same meaning as “Service Provider” as commonly used within ArcelorMittal.

 “Special Categories of Personal Data” or “Special Data” means Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic and biometric data for the purpose of uniquely identifying a natural person and data concerning health or sex life and sexual orientation.

3. Scope of this Privacy Notice

This privacy notice applies to all job candidates of the ArcelorMittal Group who use the e-Resourcing site “ArcelorMittalCareers”, including those who are already employees as well as those who are prospective employees of the Group.

4. The functioning of the e-Resourcing site “ArcelorMittalCareers”

The e-Resourcing site “ArcelorMittalCareers” can be consulted by any prospective candidate without providing any Personal Data. Also, a personal profile may be created on the e-Resourcing site “ArcelorMittalCareers” without any obligation to apply for a vacancy.

In case a candidate decides to apply for a position identified on the e-Resourcing site “ArcelorMittalCareers”, they will be required to provide Personal Data that will be processed by ArcelorMittal in line with the present Privacy Notice.

When applying for a position, the candidate grants their consent for their Personal Data to be used by HR professionals of ArcelorMittal around the world to match suitable candidates with open vacancies within their scope. This means that when Candidates give consent for their Personal Data to be processed through the “ArcelorMittalCareers” website, they agree to be contacted by recruiters concerning the vacancy they have applied to directly as well as in case it appears that their profile may be a match for another vacancy announced on the e-Resourcing site “ArcelorMittalCareers”. In the latter case, Candidates may decide whether they prefer to submit their candidacy for such additional vacancies.

Candidates may revoke their consent at any time by deleting their profile from the “ArcelorMittalCareers” website.

5. Data categories - The type of Personal Data that ArcelorMittal processes

ArcelorMittal will collect, store, and use certain categories of Personal Data about its job candidates in the context of the recruitment, including but not limited to the following, where deemed necessary and permitted under applicable law:

  • Identification data: Name, Image and photo, date of birth, gender, Electronic identification data;
  • Contact data: title, address, telephone number email address
  • Education, training and qualifications, Profession and job, Leisure and interests, copies of right to work documentation;
  • Employment records: Profession and job, Education, training and qualifications, Salaries, Professional Review, Affiliations and member situations work history, working hours, holidays, annual leave, disciplinary and grievance information;
  • Other data: Personal characteristics, Life and consumption habits, Security Camera Surveillance.

Information on whether Special Data may be processed at the specific location of the position for which the candidate applies can be found below.  

For more general information on processing of Special Data, please refer to point 10.

6. Collection of Personal Data

Personal Data relating to job candidates are primarily collected from them directly through the application and recruitment process, be it in the form of resumes/CVs, connected LinkedIn profile, completed company application forms or supporting documents provided or on an ongoing basis when the job candidates update their Personal Data. Based on local legal requirements, the content of application forms applied by then Company may be adapted to each geographical area.

Personal Data may also be collected from employment agencies or background check service providers where background checks are deemed necessary and permitted under applicable law. Personal Data may also be collected from third parties, as well, such as former employers, credit reference agencies etc. during the recruitment process, where deemed necessary and permitted under applicable law.

7. Legal grounds for the processing of Personal Data

ArcelorMittal processes Personal Data of its job candidates on the legal ground that the Candidates gave their consent to the Processing, the Processing is necessary in order to take steps at the request of the job candidate prior to entering into an employment contract or an employment contract for a different role within the Company, or Processing is necessary in the legitimate interest of ArcelorMittal or a third party (for example, in the course of a lawsuit).

8. How the Personal Data is processed

ArcelorMittal processes its job candidates’ Personal Data in a transparent, fair and lawful way in accordance with the principles for processing set out in the ArcelorMittal Policy on Data Protection and ArcelorMittal Data Protection Procedure that is also the Group`s Binding Corporate Rules.

ArcelorMittal processes the Personal Data of its job candidates only based on one of the legal grounds set out in point 7 above. Personal Data are processed in connection with the decision-making relating to hiring. Personal Data may also be collected in connection with access control and security including camera surveillance, where deemed necessary and permitted under applicable law.

If the Personal Data has to be used for another purpose, ArcelorMittal will notify the job candidates concerned with details of the purpose of the processing and the legal ground justifying the processing.

ArcelorMittal may process Personal Data of the job candidate, where this is required or permitted by law.

9. Automated Decision-Making

Automated decision-making takes place when an electronic system uses Personal Data to make a decision without human intervention.

As a general rule, ArcelorMittal will not make decisions that will have a significant impact on job candidates based solely on automated decision-making unless there is a lawful basis for doing so and job candidates are notified.

ArcelorMittal may use automated decision-making in the following circumstances:

  • when it is necessary to enter into a contract with job candidates and appropriate measures are in place to safeguard his/her rights
  • in limited circumstances, with the explicit written consent of the job candidate and where appropriate measures are in place to safeguard his/her rights.

10. Processing of Special Data

ArcelorMittal may use special categories of Personal Data in such ways as set out below:

  • in connection with employment laws for ensuring health and safety in the workplace;
  • in connection with social protection laws, for ensure meaningful equal opportunity monitoring and reporting by using Personal Data collected with the consent of the job candidate relating to race or national or ethnic origin, religion, philosophical or moral beliefs, sexual life or sexual orientation;  
  • In connection with the establishment, exercise or defense of legal claims;
  • In connection with preventive or occupational medicine, to assess the job candidate`s fitness to work and to provide appropriate workplace adjustments

ArcelorMittal may from time to time process Special Data made public by job candidates.

In the event that ArcelorMittal requires to process any Special Data for purposes other than those set our above, the consent of each job candidate will be obtained.

11. Personal Data transfer

ArcelorMittal may transfer Personal Data to third parties, including third-party service providers and Subsidiaries.

11.1 Transfers to Third Parties

ArcelorMittal may from time to time engage the services of third-party service providers to undertake processing of job candidate Personal Data in connection with the various activities that ArcelorMittal is required to undertake to manage the recruitment relationship. In connection therewith, ArcelorMittal will share Personal Data of its job candidates with these third parties to enable them to undertake the service as required or where it has legitimate interest to do so.

All third-party service providers are required by ArcelorMittal to take appropriate security measures to protect Personal Data in line with ArcelorMittal`s policies. ArcelorMittal permits third-party service providers to process Personal Data for specified purposes and in accordance with its instructions.

In order to ensure a high level of security of Personal Data, in particular if the data is being transferred outside of Europe, ArcelorMittal has put in place standard contractual clauses based on the EU Commission’s standard contractual clauses and approved by the Luxembourg Data Protection Authority, which seek to ensure that Personal Data is treated by third parties in a way that is consistent with the EU data protection laws. A copy of such clauses can be made available upon request at [email protected].

ArcelorMittal may need to share Personal Data with a regulator or to otherwise comply with the law such as tax authorities, immigration bodies and pensions regulators.

11.2 Transfers Within the Group

ArcelorMittal has adopted a group-wide Data Protection Procedure setting out standards of protection for Personal Data in case of data transfers to Subsidiaries located outside of the EU. The Group`s Binding Corporate Rules also called ArcelorMittal Data Protection Procedure were approved by various Data Protection Authorities in Europe as one that provides a protection similar to that afforded under applicable EU regulation. The BCR has been amended in accordance with the GDPR and is awaiting approval of the Luxembourg Data Protection Authority.

Based on the BCR, ArcelorMittal is allowed to transfer Personal Data of its job candidates within the Group, outside the territory of the EU. This transfer might happen for data hosting purposes, to execute the regular reporting activities on company performance, to ensure that prospective candidates are informed about vacancies in other locations that may be of interest for them, in the context of a business reorganization or group restructuring exercise, for system maintenance support and benchmarking.

12. Security measures

ArcelorMittal has put in place appropriate technical and organizational measures to prevent Personal Data from accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise processed. Employees, contractors and third parties have access to Personal Data only if it is needed for the performance of their duties and processing shall take place in accordance with the instructions of ArcelorMittal.

13. Data breaches

In addition to the organizational and technical measures implemented by ArcelorMittal, it has also detailed the actions that need to be implemented in the event of an actual or suspected breach in its BCR. This has been further developed in the ArcelorMittal Breach Reporting Procedure which is in compliance with the GDPR. This procedure details how ArcelorMittal will deal with any suspected data security breach and notify its job candidates and any applicable regulator of a breach under certain conditions. The Procedure also details the obligations and expectations of ArcelorMittal employees to report suspected data breaches.

14. Data retention

ArcelorMittal shall retain job candidate Personal Data for as long as it is required or in accordance with the legal requirements in the countries in which the Data is processed. Subsidiaries may have data retention policies that define the data retaining periods for various data held. Information on the specific data retention policies in a given region can be found below.

In case a candidate is hired by an entity of the ArcelorMittal Group, they will be requested to remove their personal data from the central “ArcelorMittalCareers” database.

In case of one year of inactivity of the candidate, their profile on the e-Resourcing site “ArcelorMittalCareers” will be automatically deleted.

15. Data Subject Access Requests

ArcelorMittal job candidates may exercise their right of access by submitting a request here.

ArcelorMittal job candidates are expected to inform ArcelorMittal about changes in the Personal Data processed by it.

16. Group Data Protection Officer

Henk Scheffer has been appointed as the ArcelorMittal Group Data Protection Officer and can be contacted at [email protected].

Any ArcelorMittal job candidate can direct questions regarding this Privacy Notice to him at  [email protected].

17. Changes to this privacy notice

ArcelorMittal may update this privacy notice as required from time to time.

All Policies referred to in this Privacy Notice are available at the website of ArcelorMittal.