This policy explains how we collect, use and protect the personal data of candidates, temporary workers, clients, suppliers and other business contacts, referees, emergency contacts and dependants, website users, staff alumni and visitors to our premises. It does not cover Tessero's own staff or people applying for jobs at Tessero itself.
References to the GDPR include the EU General Data Protection Regulation (2016/679), Luxembourg data protection legislation and, where relevant, the UK GDPR.
1. Who we are and how to contact us
The data controller is Tessero Luxembourg S.à r.l. (for website users, and otherwise where it is the contracting party) or Tessero Travail Temporaire Luxembourg (where it is the contracting party, e.g. for temporary work). Both are located at 65, avenue de la Gare, L-1611 Luxembourg ("Tessero", "we", "us").
You can contact our data protection team at luxembourg@tesserogroup.com or by post at the address above (marked "c/o Data Protection Team").
Where Tessero entities jointly determine why and how personal data is processed, they act as joint controllers under Article 26 GDPR. You can exercise your rights against any of them using the contact details above.
2. Candidates
"Candidates" covers anyone we think may be interested in or benefit from our services, as well as applicants for roles we advertise, people who send us a speculative CV, and contractors, freelancers and supplier employees put forward for client roles. It includes people who want to become temporary workers.
Personal data we collect
- Identity and contact: Name, date of birth, national identification number, gender, photograph, marital status, nationality, contact details, emergency contacts and next of kin, ID document copy
- Education and employment: Education, employment history, job title, skills and languages, referees, work permit status, availability, current and past pay and benefits, hours worked once placed, job interests (including those inferred from your engagement with our emails and, if you have switched on marketing cookies, the pages you view on our website)
- Financial: Bank details; social security number and tax information; financial information where a financial background check is needed
- Special category data (only where lawful): Health and disability information (for adjustments and occupational health); diversity data (ethnic origin, sexual orientation, religion or belief, health); religious belief for annual leave entitlement; health or vaccination data where a role requires it; video recordings of training or meetings (with consent)
- Criminal record data: Only where required for the role (see the retention rule in section 6)
- Automatically collected: IP address, device, log and usage data, browsing data, email engagement, inferred location, account access data
- From others: References; client feedback; information from job sites and LinkedIn; referrals from clients, suppliers, other candidates and our staff; RPO/MSP providers; social media interactions (e.g. liking or following our pages)
Why we use it and our legal bases
- Pre-recruitment: identifying people who may benefit from our services, storing their details and contacting them (we will email you to tell you we hold your data). Legal basis (GDPR): Legitimate interests (Art. 6(1)(f))
- Recruitment: assessing you against vacancies, sending your details to clients, online applications and job alerts, interviews (including recorded video interviews), customer support. Legal basis (GDPR): Legitimate interests; contract (Art. 6(1)(b)); consent for video recordings
- Payroll, invoicing and contractual obligations to clients. Legal basis (GDPR): Contract; legitimate interests
- Ancillary services: online training, the Tessero app and interactive features. Legal basis (GDPR): Legitimate interests; contract
- Verification: references, qualifications, identity (including video ID checks) and right to work. Legal basis (GDPR): Legitimate interests; contract; legal obligation (Art. 6(1)(c))
- Criminal record checks where required for a role. Legal basis (GDPR): Explicit consent, or legal obligation where a check is legally required
- Psychometric and skills assessments, career development and coaching. Legal basis (GDPR): Legitimate interests
- Satisfaction surveys and market research (published only in anonymised form). Legal basis (GDPR): Legitimate interests
- Marketing our services by email, text and WhatsApp. Legal basis (GDPR): Soft opt-in based on legitimate interests (similar services, after you have engaged with us); otherwise opt-in consent
- Website analytics and marketing cookies: measuring how our website is used, linking the pages you view to your candidate record, and measuring whether our marketing campaigns lead to enquiries or applications (see the Cookies section). Legal basis (GDPR): Consent (Art. 6(1)(a))
- Featuring you in success stories on our website. Legal basis (GDPR): Explicit consent
- Equal opportunities monitoring (anonymised) and sharing diversity data with clients. Legal basis (GDPR): Legitimate interests where the law allows, otherwise consent; explicit consent for sharing with clients
- Health data for reasonable adjustments, occupational health and role-specific health requirements; religious belief or health data for annual leave. Legal basis (GDPR): Employment and social protection law (Art. 9(2)(b)) or health and social care purposes; consent where the law requires it
- Legal obligations: tax, employment law (e.g. working hours), right to work, court orders and regulators. Legal basis (GDPR): Legal obligation
- Legal claims and co-operating with law enforcement. Legal basis (GDPR): Legitimate interests; Art. 9(2)(f) for special category data
Profiling and automated decisions
If you switch on marketing cookies and we can recognise you as an existing candidate or contact (for example, because you clicked a link in one of our emails), we record which pages of our website you view and link this to your record in our recruitment system, so that we can suggest relevant roles and follow up with you. We rely on your consent for this.
Candidates are allocated to "talent pools" by a fully automated process, which may involve bots. We may also use filtering, algorithms and machine learning to shortlist and rank candidates, in support of our consultants' work. These activities rely on our legitimate interests.
Where shortlisting amounts to a decision based solely on automated processing (Art. 22 GDPR), we only do this where it is necessary for pre-contractual steps you have asked us to take (e.g. filtering a large number of applicants for a popular role).
3. Other people we deal with
Temporary workers employed or engaged directly by us (in addition to candidate data)
- Personal data: Staff number, social security number; workplace; leave; travel; residence and work permits; performance, bonuses and promotions; grievances and disciplinary matters; sickness absence (health data)
- Purposes: Running the employment relationship: payroll and invoicing, terms of work, performance and feedback, absence management, and meeting statutory duties
- Legal basis (GDPR): Contract; legal obligation; legitimate interests. Health data: where required or permitted by employment law, otherwise consent
Clients and their employees
- Personal data: Name, job title and contact details; engagement with our website, emails and candidate profiles; information you give us; call recordings and video footage (with consent); ID documents where verification is required
- Purposes: Providing our services (candidates, RPO, MSP, consultancy, training for your employees); managing the relationship; B2B marketing; surveys and market research; candidate references; identity verification; investigations
- Legal basis (GDPR): Legitimate interests; consent (recordings, cookies, marketing where required); legal obligation
Suppliers and other business contacts (e.g. investors)
- Personal data: Name, job title and contact details; business bank details; identification number; information you or others give us; ID documents and video ID footage
- Purposes: Managing the relationship and payments; statutory checks; identity verification; investigations; legal claims
- Legal basis (GDPR): Contract; legal obligation; legitimate interests
Referees, emergency contacts and dependants
- Personal data: Name, contact details, date of birth, marital status; references; limited health data or data from which other sensitive information can be inferred, where needed for benefits
- Purposes: Obtaining references; contacting you in an emergency; administering employee benefits; marketing to referees only with opt-in consent
- Legal basis (GDPR): Legitimate interests; employment law obligations; consent (marketing)
Website users
- Personal data: Name and contact details (if provided); IP address, device, log, usage and location data; preferences
- Purposes: Providing services you sign up for (e.g. newsletters); security and fraud prevention; improving and personalising our websites
- Legal basis (GDPR): Legitimate interests; contract; consent (non-essential cookies and marketing); legal obligation
Staff alumni
- Personal data: Name, contact details, date of birth, gender, photograph, marital status, nationality; education and employment history
- Purposes: Running our alumni network and portal; newsletters, events, vacancies and opinion polls
- Legal basis (GDPR): Legitimate interests; consent (marketing)
Visitors to our premises
- Personal data: Name, date of birth, ID document, vehicle registration, email, job title, purpose of visit; CCTV images; guest Wi-Fi device data; health and travel information where needed for health and safety
- Purposes: Visitor management; security of our premises; guest Wi-Fi; protecting staff and visitors from infectious diseases
- Legal basis (GDPR): Legitimate interests; public interest in public health (Art. 9(2)(i)) for health data
4. General points
Sources. We collect data from you directly. We also collect it from your organisation; our candidates, temporary workers and staff; referees; clients; job sites and social media; RPO/MSP providers; background check, pension and benefits providers; tax authorities; medical professionals (in limited cases); market research and event delegate lists; and automatically through our websites, emails, CCTV and Wi-Fi.
Required data. Some data is required by law (e.g. a social security number for payroll) or by contract. If you do not provide it, we may be unable to work with you.
Legitimate interests. We rely on our interests in running and developing our recruitment business: matching candidates with roles, maintaining relationships, providing relevant services, keeping our premises and systems secure, and handling claims. You can object at any time (see section 7).
Consent. Where we rely on consent, you can withdraw it at any time. This does not affect processing carried out before you withdraw it.
5. Who we share your data with
- Tessero group companies and colleagues, including in other countries
- Candidates: prospective employers, other recruitment agencies, job boards and aggregators, MSP suppliers, and clients' auditors (where contractually required)
- Temporary workers: the client you work for, prospective employers (for references) and, in limited cases, medical or occupational health professionals
- Service providers acting for us: IT, cloud and document storage, marketing technology, background and reference check providers, assessment tools, and our alumni portal operator
- Professional advisers and auditors, and tax and other authorities where required by law
- A buyer or prospective buyer, in the event of a merger or acquisition
Some providers process data as independent controllers for their own purposes (e.g. security, legal compliance or anonymised product improvement) under their own privacy policies.
6. International transfers and retention
When we transfer data outside the EEA, we rely on an adequacy decision, the EU Standard Contractual Clauses, another approved mechanism, necessity for a contract in your interest, or your consent.
- Candidates: Up to two years from collection or our last meaningful contact with you. Meaningful contact means a positive action by you, such as submitting a CV, taking part in training, discussing roles with us or clicking through from our emails; simply opening an email does not count. If you are supplied through a third-party company, contact with that company counts. If you ask us not to keep your data, we delete it unless we must keep it for legal reasons
- Criminal record data (candidates): Destroyed immediately if it is decided not to enter into an employment contract with you, and in any event no later than one month after an employment contract is concluded
- Temporary workers: For the employment relationship and afterwards for as long as required by law (e.g. tax) or needed for references or potential claims
- Clients, suppliers and business contacts: While we provide or receive services, or market relevant services to you. Deleted if you tell us you are not interested, unless we must keep it for legal reasons
- Website data (IP address and operating data): 365 days
- All other data: As long as needed for the purpose for which it was collected, unless a longer period is required by law or for legal claims
At the end of the retention period, data is put beyond use. It is permanently deleted from archives once all statutory retention periods have expired (currently expected to be seven years).
7. Your rights
You have the right to:
- access your data;
- have it corrected;
- have it erased;
- restrict processing;
- data portability;
- withdraw consent;
- object to processing based on legitimate interests (we will stop unless we have compelling legitimate grounds or need the data for legal claims); and
- object to direct marketing (we will always stop).
Contact luxembourg@tesserogroup.com. We will respond within one month and may need to verify your identity. Access is free unless a request is manifestly unfounded or excessive. You can unsubscribe from job alerts and marketing via your profile or the link in any marketing email.
You can complain to the National Commission for Data Protection (CNPD), Service des plaintes, 15, Boulevard du Jazz, L-4370 Belvaux, tel. (+352) 26 10 60-1, or via its online form at cnpd.public.lu.
8. Cookies
Our website uses cookies and similar technologies. Strictly necessary cookies are always on. Analytics and marketing cookies are set only if you switch them on, and you can reject them as easily as accept them. You can change your choice at any time through the Cookie Preferences link on every page. The Cookies section of our group privacy page, Privacy at Tessero, explains each cookie we use, what it is for, who sets it and how long it lasts. If you use several devices, you may need to set your preferences on each one.
9. Security, third-party sites and changes
We use appropriate technical and organisational measures to protect your data, including procedures for handling suspected data breaches. Please tell us immediately if you suspect misuse. Please also keep us informed if your personal data changes.
We are not responsible for third-party websites or services linked from ours.
We may update this policy and will publish changes on this page.