Candidate data protection information notice

Last update: 08/06/2026

By applying for a position within the SQORUS Group, or because we have identified your profile and contacted you about an opportunity, personal data concerning you is collected and processed by the Group. The General Data Protection Regulation (GDPR) requires us to inform you precisely about this processing: its purposes, legal bases, recipients, retention periods, and the rights you have.

The present notice meets this obligation. It is brought to your attention at the time of your application, either via the online application form on sqorus.com, or via the Flatchr tool used by the Group to manage applications, or by direct e-mail if you have been sourced by the Group on a professional platform. It is also permanently accessible at sqorus.com/protection-donnees-candidats.

The notice is written in clear, accessible language. Should you nevertheless find any of the wording difficult to understand, or if you have any questions, please contact the Group’s Data Protection Officer (DPO) at dpo@sqorus.com.

1.1. Identity of the data controller

The person responsible for processing your personal data is :

If you are applying for a position in Côte d’Ivoire or Morocco, the employing legal entity will be SQORUS Côte d’Ivoire or SQORUS Morocco, which acts as the local data controller in coordination with the Group (see addenda A and B at the end of this notice).

1.2. Contact details of the Data Protection Officer

The SQORUS Group has appointed a Data Protection Officer (DPO) to act as a single point of contact for any questions or requests relating to your data:

1.3. Scope of the notice

This notice covers all processing of your personal data by the SQORUS Group as part of the recruitment process:

• Applications submitted via the online form on the sqorus.com website (article 13 GDPR – direct collection);
• Unsolicited applications submitted by e-mail to the recruitment address, or via any other direct channel (article 13);
• Applications submitted via Flatchr or equivalent tools (article 13);
• Active sourcing carried out by the Group’s HR teams or recruitment officers via professional platforms such as LinkedIn (article 14 GDPR – indirect collection) ;
• Applications submitted by recruitment firms or agencies appointed by SQORUS (article 14).

If your application leads to employment, your data will then be processed as part of the employment contract, which is the subject of a separate notice (NOT-GDPR-COLLAB v1.0) that will be given to you when you arrive.

2.1. Overview

This section presents all the processing of your data implemented by SQORUS as part of the recruitment process. Each processing operation is described according to a standardized framework: purpose, legal basis within the meaning of Article 6 of the GDPR, categories of data, retention period. Recipients are presented transversally in section 3, non-EU transfers in section 4.

The legal bases used for recruitment are mainly :

• Pre-contractual measures taken at your request (Article 6 §1.b GDPR) – for processing your application, interviews, any tests. This basis applies once you have submitted an application or responded to a sourcing exchange ;
• The Group’s legitimate interest (Article 6 §1.f GDPR) – for active sourcing (Article 14), for the use of the Flatchr tool and its operation, for limited and proportionate checks. A balance of interests test was conducted for each processing operation of this type;
• Your consent (Article 6 §1.a GDPR) – for retention in the talent pool beyond the end of the recruitment process, for reference checks that involve contact with former employers.

You do not provide any sensitive data within the meaning of Article 9 of the GDPR (health, political or religious opinions, sexual orientation, biometric data) in the context of recruitment. If you spontaneously communicate such information in your CV or during an interview, it will be deleted as soon as it is identified, unless it falls under a particular legal obligation (for example: disabled worker status for employment obligations).

2.2. Managing your application for an open position

Processing sheet no. 1 – Candidate study

2.3. Unsolicited applications and active sourcing (LinkedIn and other platforms)

There are two distinct cases:

• Unsolicited application – you contact us on your own initiative to propose your profile, without a job opening;
• Active sourcing – a SQORUS Group recruitment officer or manager identifies your profile on a professional platform (typically LinkedIn) and contacts you about an opportunity within the Group.

Processing form n°2 – Unsolicited application

Processing sheet no. 3 – Active sourcing (article 14 GDPR)

2.4. Flatchr – AI-assisted application management tool

The SQORUS Group uses Flatchr (published by Cegid), a SaaS application and recruitment management software. This tool centralizes all applications received, whatever their channel of origin, and integrates assistance functionalities using artificial intelligence: automatic classification of CVs, identification of keywords and skills, calculation of a relevance score in relation to a job description, suggestions for matching candidates to positions.

Processing sheet no. 4 – Flatchr tool and AI scoring

2.5. Talent pool and long-term retention

Processing sheet no. 5 – Talent pool

2.6. Assessment tests and interviews

Processing sheet no. 6 – Tests and interviews

No test based on personality, psychological profile or behavioral assessment is conducted without explicit prior information on its nature, methodology and interpretation. You are free to refuse a test; this refusal does not prejudge the rest of the process, but may prevent the test from being carried out if it is deemed essential to the assessment of the position.

2.7. Reference and diploma checks

Processing sheet n°7 – Professional checks

The Group does not conduct any morality tests or seek information about your private life. No information is collected from your current employer without your explicit prior consent.

3.1. Internal recipients

Within the SQORUS Group, access to your application data is strictly limited to those who have a role in the recruitment process:

• The Human Resources team (recruiting managers, HR managers) – for processing your application, interviewing you and making the final decision;
• The manager of the position to be filled – for the technical assessment and interview ;
• Employees taking part in interviews (e.g. future direct colleagues, managers for key positions);
• The Data Protection Officer (DPO) – for data protection issues ;
• General Management – for strategic recruitment.

Within the Group (including subsidiaries SQORUS Côte d’Ivoire and SQORUS Maroc), sharing may occur when a candidate is likely to be of interest to several Group entities, subject to transparent information.

3.2. Subcontractors

The Group relies on subcontractors to manage certain technical aspects of recruitment:

The complete and up-to-date list of subcontractors handling candidate data is kept by the DPO and is available on request at dpo@sqorus.com.

3.3. External third parties

No data concerning you is communicated to external third parties for commercial, advertising or canvassing purposes. The only cases of communication to third parties are :

• Your professional references, whom we contact with your explicit consent;
• Public and judicial authorities upon formal legal request.

Some processing operations involve transfers to countries outside the European Economic Area. These transfers are governed in accordance with the Group’s transfer policy (POL-GDPR-TRANSFERTS v1.0) :

All additional technical and organizational measures (encryption, access management, pseudonymization where possible) are implemented in accordance with EDPS recommendations.

The length of time your data is kept depends on the outcome of your application and your consent to storage in the pool:

Once the specified periods have expired, your data will be securely deleted. If you are in the pool and wish to be removed before the 2-year deadline, please contact the DPO: dpo@sqorus.com.

You have the following rights over your personal data, as provided for in Articles 15 to 22 of the GDPR:

7.1. Exercise channel

To exercise any of your rights, please send a request to the Group’s Data Protection Officer :

dpo@sqorus.com

7.2. Identification

For applicants, the use of the e-mail address you provided when applying for a job is in principle sufficient identification. In the event of doubt as to identity, or for requests concerning sensitive data or significant effects (total deletion in particular), the DPO may ask you for a copy of an identity document; this copy will be deleted within 30 days of the closure of your request.

7.3. Response time

The DPO will reply within one month of receiving your complete request. This deadline may be extended by two months if your request is complex or if the DPO is handling a large number of requests simultaneously. You will be informed of this extension and the reasons for it within the initial one-month period.

7.4. Right to lodge a complaint

If you feel that your rights have not been respected, you can lodge a complaint with the competent supervisory authority:

• For France: Commission Nationale de l’Informatique et des Libertés (CNIL), 3 place de Fontenoy, 75007 Paris – www.cnil.fr ;
• For Côte d’Ivoire: Autorité de Régulation des Télécommunications de Côte d’Ivoire (ARTCI) ;
• For Morocco: Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP).

You also have the right to take legal action before the competent court, in accordance with Article 79 of the GDPR.

Article 22 of the GDPR provides for the right not to be subject to a decision based exclusively on automated processing, including profiling, producing significant legal effects.

The SQORUS Group does not carry out any such processing in the context of recruitment. In concrete terms :

• The decision as to whether or not to accept a candidate is always taken by an identified member of the Group’s HR or management team, on the basis of a full examination of the application;
• The Flatchr tool offers a decision-support score: this score is indicative and consultative, and recruiters make their own decisions, examining each application in depth;
• Applications are not rejected solely on the basis of the AI score, without human examination;
• This configuration will be verified and documented by a Data Protection Impact Assessment (DPIA) prior to continued use of the scoring function [to be completed once the DPIA has been carried out].

If you feel that you have been the recipient of an unfavorable decision that you would like to contest or find out the reasons for, you can write to the Group’s DPO at dpo@sqorus.com. He or she will provide you with non-sensitive explanations and will ensure that a human review is carried out if necessary.

This section only applies to applicants whose data has been collected indirectly by the SQORUS Group, in accordance with Article 14 of the GDPR. If you have submitted an application yourself (Article 13), this section does not apply to you.

9.1. Sources used by the Group

The SQORUS Group actively sources candidates from the following sources:

• LinkedIn – the first source of active sourcing. The profiles consulted are those you have published on the platform for professional visibility purposes;
• Other equivalent professional platforms – depending on the profiles sought;
• Job fairs and professional events – when you have submitted your CV or contact details in this context;
• Recruitment firms appointed by SQORUS – who have identified you themselves and who will pass on the opportunity to you, provided that they comply with their own obligations to provide you with information.

9.2. Categories of data collected indirectly

The data collected via these sources is limited to the information made public by yourself on the relevant platform:

• Identity (surname, first name) ;
• Published business contact information (email, business phone) ;
• Professional background, training, declared skills ;
• Public recommendations.

No data of a private nature, restricted or subsequently deleted by you from the platform, is kept by the Group.

9.3. Information deadline

In accordance with Article 14 §3 GDPR, you are informed no later than the first contact we make with you. This notice (NOT-GDPR-CANDIDAT v1.0) constitutes this information and is communicated to you when you first contact us, by sending a direct link or clear reference to the address sqorus.com/protection-donnees-candidats.

The present notice is subject to change to take account of changes in regulations, developments in the tools used, or the addition or deletion of subcontractors. Information can be obtained as follows:

• Systematic versioning: each modification gives rise to a new numbered version (v1.0 → v1.1 → v2.0) with application date ;
• The current version is permanently accessible at sqorus.com/protection-donnees-candidats ;
• Any substantial modification (new processing, new purpose, new major recipient, change in legal basis, significant change in duration) is the subject of individual prior information, by email, to the persons whose data is being processed (active applications, candidates in the pool);
• A purely formal modification (typographical correction) is traced in the version history without individual information.

This addendum supplements the main notice for applicants for a position with SQORUS Côte d’Ivoire. It specifies applicable local conditions.

A.1 Identity of the recruiting entity

For job applications located in Côte d’Ivoire, the recruiting legal entity is SQORUS Côte d’Ivoire, which acts as the local data controller. The Group’s DPO remains your point of contact for any questions relating to data protection, at dpo@sqorus.com.

A.2. Applicable legal framework

The processing of your data is governed simultaneously by :

• Ivorian law no. 2013-450 of June 19, 2013 on the protection of personal data, and its implementing texts;
• The GDPR, when processing involves coordination with the Group in France (joint responsibility or intra-group transfers).

The competent supervisory authority for Côte d’Ivoire is the Autorité de Régulation des Télécommunications de Côte d’Ivoire (ARTCI). You can lodge a complaint with this authority if you feel that your rights have not been respected.

A.3 Practical details

• The channel for exercising rights remains dpo@sqorus.com (Group DPO). A local SQORUS Côte d’Ivoire representative may be appointed to act as a relay.
• Transfers to France (Group) are governed by the mechanisms provided for by Ivorian law and by European Standard Contractual Clauses accompanied by a Transfer Impact Assessment.
• The terms and conditions described in the body of the notice apply, with the exception of any local legal terms that may differ.

This addendum supplements the main notice for applicants for a position with SQORUS Maroc.

B.1 Identity of the recruiting entity

For job applications located in Morocco, the recruiting legal entity is SQORUS Morocco, which acts as the local data controller. The Group DPO remains your main contact at dpo@sqorus.com.

B.2 Applicable legal framework

The processing of your data is governed simultaneously by :

• Moroccan Act No. 09-08 of February 18, 2009 on the protection of individuals with regard to the processing of personal data, and its implementing regulations;
• The GDPR, when processing involves coordination with the Group in France.

The competent supervisory authority for Morocco is the Commission Nationale de Contrôle de la Protection des Données à Caractère Personnel (CNDP). You can lodge a complaint with this authority if you feel that your rights have not been respected.

B.3 Practical details

• The channel for exercising rights remains dpo@sqorus.com (Group DPO). A local SQORUS Maroc representative may be appointed to act as a relay.
• Transfers to France (Group) are governed by the mechanisms set out in Law 09-08 (prior authorization or CNDP notification depending on the case) and by European Standard Contractual Clauses accompanied by a Transfer Impact Assessment.
• The terms and conditions described in the body of the notice apply, with the exception of any local legal terms that may differ.

The short mentions below are intended to be integrated into the various collection points (web application forms, Flatchr, first sourcing email). They provide condensed information in line with the layered approach recommended by the EDPS (Transparency Guidelines 03/2017).

Version 1 – Mention for web application form (sqorus.com)

Version 2 – Mention for the Flatchr tool (configurable in the candidate interface)

Version 3 – Introduction to active sourcing (article 14)

To be used as the first paragraph of any contact message via LinkedIn or equivalent professional platform. Complies with the information requirement of Article 14 §3 GDPR (information no later than the first contact).

Version 4 – Explicit consent to the talent pool

To be used at the end of the recruitment process, by email, to unsuccessful candidates, to obtain their consent to join the talent pool: