Personal data protection policy

December 22nd 2021

1. Introduction

2. General notions about personal data

3. Why does ASN process your personal data?

4. What categories of personal data does ASN collect?

5. Is all processing allowed?

6. Who are the recipients of your personal data?

7. International transfers of personal data

8. How long are your personal data stored?

9. What are your rights?

10. Mandatory nature

11. Contact details of the data protection officer

12. Identity and contact details of the controller

13. Your responsibilities

1 Introduction

Regulation (EU) 2016/679 (known as the "General Data Protection Regulation" or "GDPR") establishes a regime of protection of personal data. European Union member states have also adopted laws in this area. The GDPR, supplemented by applicable national laws, provides a frame of reference for the processing of personal data by ASN. Various other countries have also adopted laws in this area (for example, in the UK, the Data Protection Act 2018).

The purpose of this note is to provide you with information about how ASN processes your personal data in the context of recruitment. It specifies what kind of personal data ASN is likely to process, why these data are processed and what your rights are. This note applies to personal data processing, whether by automated or non-automated means (for example to paper file systems.

2 General notions about personal data

A number of key terms are used in this note:

• “Personal data” means any information relating to an identified or identifiable natural person.

• “Processing” means any operation performed on personal data, such as collection, consultation, alteration or storage..

• “Controller” means the person that determines the purposes and means of the processing.

• “Processor” means the person that processes personal data on behalf of a controller

• “Purpose of processing” means the reason for which personal data are processed.

• “Means of processing” means the methods and tools used to perform the processing.

• “Data subject” means the person to whom the personal data relate.

• “Sensitive data” means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership and genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

3 Why does ASN process your personal data?

Here is a list of the main purposes for which ASN processes your personal data:

• Recruitment management, including:
- The evaluation of your application;
- Background checks, such as previous jobs and degrees;
- Organisation of job interviews;
- Preparing your employment contract in case your application is successful; and
- Creation of a CV library.

When ASN decides to process personal data for a purpose other than that for which it was initially collected, it will inform you of this new purpose

4 What categories of personal data does ASN collect?

The categories of personal data that ASN may collect in the context of your application include

• Vital records and personal information, such as your name, home address, phone numbers, email address, date and place of birth, nationality

• Information about your professional life, such as your CV, career path, information about your education, training, qualifications and your skills certificates, third-party references and background checks.

• Your image, such as a photograph that you may have attached to your CV or CCTV images taken in ASN’s premises

• Financial information, such as your current salary and salary expectations

• Information of a technical nature, such as your user identifiers and passwords on the ASN recruitment site, information necessary for the establishment of a badge during a possible interview at an ASN site.

• Content you have generated, such as photos, videos, comments, news, newspaper articles and information about you or others published by you on the internet.

5 Is all processing allowed?

The GDPR does not allow all processing. In general, only processing that meets at least one of the conditions in the following list is allowed. We refer to this as the legal basis.

• The data subject has given consent to the processing.

• Processing is necessary for the performance of a contract to which the data subject is a party.

• Processing is necessary for compliance with a legal obligation to which the controller is subject.

• Processing is necessary to protect the vital interests of the data subject.

• Processing is necessary for the performance of a task carried out in the public interest.

• Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party.

In the context of recruitment, ASN bases the processing of your personal data on its legitimate interest in recruiting candidates corresponding to ASN's needs.

The GDPR prohibits the processing of sensitive data except in special cases that are specifically regulated. Indeed, these data are, by nature, particularly sensitive from the point of view of fundamental rights and freedoms and require specific protection since the context in which they are processed could create significant risks for these freedoms and rights

Other laws or regulations may also impose limits on the processing of certain types of personal data. For example, it may be necessary to ask for the data subject’s consent for the use of his image.

6 Who are the recipients of your personal data?

ASN ensures that your personal data are only accessible to people with an identified need to know them, by implementing access control measures.

Your personal data will be accessible to the HR staff in charge of recruitment as well as to the employees of the department that is recruiting.

In addition, ASN may send your personal data to the following recipients:

• NOKIA Group companies and authorized third-party companies: ASN may share your personal data with other companies in the NOKIA group and with non-group entities that process personal data on behalf of ASN, provide services to ASN personnel or process personal data for their own use. In all cases, ASN ensures that there is an identified need to transfer your personal data.

Outside entities include, for example::

- Insurers;
- Provider of medical services;
- Security provider in charge of access to the ASN site, including CCTV and badges;

When ASN uses a processor, it enters into a contract with it to protect your personal data and in particular to prohibit any processing that has not been decided by ASN.

• Public authorities and bodies exercising a public-interest mission: ASN may be required by law to disclose your personal data to certain authorities or other third parties, for example labour, the police or other law-enforcement authorities acting within the scope of their duties

7 International transfers of personal data

ASN may sometimes transfer your personal data to countries outside the European Union. Some of these countries are recognized by the Commission of the European Union as ensuring an adequate level of protection of personal data, through an adequacy decision. When ASN transfers your personal data to a country that has not been the subject of an adequacy decision, it implements appropriate safeguards to provide adequate protection to your personal data. These safeguards may take the form of standard contractual clauses for the protection of personal data approved by the European Commission.

8 How long are your personal data stored?

ASN only keeps your personal data for the time necessary for the purposes for which they are processed. In most cases, the personal data will be kept during the recruitment process, then archived for the legally required period. They may also be kept if necessary for periods in accordance with industry standards or the recommendations of the competent data-protection supervisory authorities.

9 What are your rights?

Regarding the processing of your personal data, you have the following rights:

• Right of access: you have the right to request access to your personal data processed by ASN

• Right to rectification and erasure: You have the right to request the rectification and deletion of your personal data processed by ASN. You can help keep your personal data up-to-date by informing ASN if they change.

•Right to restriction: you have the right to ask ASN to restrict the processing of your personal data, meaning that your personal data held by ASN are marked to limit their future processing.

• Right to object: you have the right to object to ASN’s processing your personal data on grounds relating to your particular situation.

• Data portability: when ASN processes your data on the basis of your consent or a contract with you and by automated means, you have the right to receive the personal data you have provided to ASN in a structured, commonly used and machine-readable format and forward them to another controller and the right to have them forwarded directly by ASN when technically possible.

• Right to withdrawal of consent: when processing is based on your consent, you have the right at any time to withdraw that consent, without the withdrawal’s having retroactive effect.

• Right to lodge a complaint with a supervisory authority: if you consider that the processing constitutes a violation of the GDPR, you have the right to lodge a complaint with a supervisory authority. In the UK, the competent supervisory authority is the Information Commissioner’s Office (ICO).

If you intend to lodge a complaint with a supervisory authority, ASN would appreciate your first informing the data protection officer of your comments, questions or complaints (see section 11 below).

10 Mandatory nature

ASN will inform you whether the provision of your personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether you are obliged to provide the data and of the possible consequences of your failure to provide them.

11 Contact details of the data protection officer

You can access your data, ask questions about the management of personal data within ASN, obtain a copy of the safeguards mentioned in section 7 above and exercise most of your rights described above by contacting the data protection officer at privacy@asn.com or by mail at the following address :

Alcatel Submarine Networks

Legal and Compliance

Attention: Data Protection Officer

Route de Villejust

91620 Nozay

France

Before processing your request, ASN may need to identify you, for example by asking you for proof of identity. ASN will respond to your request as soon as possible and in any case within one month, but this period can be extended by two months, in view of the complexity and the number of requests.

12 Identity and contact details of the controller

The following table shows the identity and contact details of the entities in the ASN group that can act as a controller.

13 Your responsibilities

During the recruitment process, you may have access to personal data, such as the identity and contact details of your contacts at ASN. You must process these personal data in a confidential manner, for example by only disclosing them to persons who need to have access to them.

If you provide personal data about family members, beneficiaries or other third parties (e.g. for emergency contacts), ASN asks you to provide them with information about the processing carried out.