Privacy policy (job applications - Greenhouse)
Who are we?
Legend Biotech BV (incorporated under the laws of Belgium with registered offices at 9050 Gent, Gaston Crommenlaan 8, with enterprise number 0769.992.730) is part of the Legend Biotech group, a global clinical-stage biotechnology company developing and manufacturing innovative cellular therapies, dedicated to quality and excellence and committed to improving the lives of patients worldwide.
What is the purpose of this policy?
With our goal and commitment to improve patients’ lives we are always looking for people who can contribute to the strength of our team and to our shared values and are actively hiring across multiple functions and levels. In this process we require certain personal data of persons who would apply for a position in our company.
As we attach great importance to the protection of personal data, by this policy we intend to inform you about our processing activities with respect to your personal data and your rights. Please read this policy carefully with the understanding that we may modify it from time to time in the light of the feedback or changes to our processes or the legal or regulatory provisions. Any modifications will become effective upon posting of the revised policy on our website or in our platforms.
Under the applicable laws you acknowledgment of this policy is a necessary condition to be able to engage in the job application process with us. By transmitting your personal data to us, you accept this policy regardless any stipulations to the contrary in any document issued by you or any third party. In case of conflict between this policy and any terms and conditions issued by you or any third party, the former shall prevail, notwithstanding any stipulation to the contrary in the latter.
We highlight that in the event that your data is collected by us through third parties, privacy terms and policies and term of these third parties may apply, the present privacy policy however taking precedence over the said privacy terms and policies in the event of conflict.
What personal data do we collect and process?
We collect and process information provided by you in connection with your job application.
As such the collected and processed personal data includes information that is required to identify you (such as your name, address) and to contact you (such as telephone number, address and e-mail address). We also collect and process data required to assess the suitability of your profile for the job openings available in our organization such as previous work experience and education information, skills, work authorization status, professional and other work-related licenses, permits and certifications held, references, and professional memberships as well as information regarding your employment preferences and expectations such as willingness to relocate, current salary, desired salary. Finally, we also collect any other information that you provide to us in your CV, resumé, cover letter or otherwise or that is publicly available or legitimately made available by or through third parties (e.g. such platforms as LinkedIn, Facebook etc.)
For what purpose do we collect and process your personal data?
We collect your personal data for the purpose of the assessment of your possible recruitment. In more detail, we use your personal data to process your application, to assess your capabilities and qualifications for a job, to perform checks on the references you provided, if the job opening in question requires such references as indicated in the job vacancy description, to communicate with you about your application and to manage the recruitment and human resource processes. After the termination of a recruitment process for a specific job opening for which your data was collected, we may process your data to contact you to inform you about other possible job openings for which you could possibly qualify and that may be of interest to you.
In the event that we would enter into a contractual relationship with you, the collected data will become part of data processed for the purpose of the management of that contractual relationship under the applicable legal rules and internal rules of our organization as they apply to the category of personnel to which you would belong. In the event that at the end of the application process we would not enter into a contractual relationship with you, we may indicate or you may request us to keep your personal data on file for future job openings with us.
Naturally we also process your personal data to comply with the laws applicable to our activities.
Your personal data will be processed exclusively for the purpose for which it was collected and to the extent that is necessary to achieve that finality. This restriction applies both to the quantity of personal data and to the scope of processing, the retention period and the accessibility. If we would like to process your personal data for a different purpose than that for which they were initially collected, we will seek your free consent.
Please note that in the processing of your personal data we will not make decisions based solely on automated processing, including profiling, which would produce legal effects concerning you or similarly significantly affecting you.
What are the sources of the personal data?
We collect personal data from various sources including (i) your job application as provided to us offline or online through our website or platforms hosted for us by third parties, such as Greenhouse Software, Inc., a company with registered office is at 18 West 18th Street, 11th Fl., New York, NY 10011 USA, (ii) our contacts with you, such as (online or offline) interviews, meetings or telephone conversations, (iii) publicly available information sources, (iv) third party sources such as, LinkedIn or Facebook, and other (online or offline) (recruitment) agencies, (v) from references, prior employers and educational institutions, to the extent required for the job opening and provided we inform you of this fact, and (vi) through cookies and other tracking technologies. Please note that the collection from the latter source is governed by our Cookie Policy which you can find here.
On what grounds do we collect and process your personal data?
We collect and process your personal data when this is necessary (a) as a part of pre-contractual measures and, in the event that we enter into a contract with you, as a part of the performance of that contract, (b) to comply with our legal obligations, (c) to represent our legitimate interests or (d) if you explicitly consent with us processing such data. If the processing cannot be justified by one of the aforementioned legal grounds, we will seek your prior free consent.
If we would like to receive sensitive personal data about you (such as your race, religion, ethnicity, nationality or national origin, age, gender identity, sex life or practices or sexual orientation, marital status, medical or health information (including disability status), genetic or biometric information, biometric templates, political or philosophical beliefs, political party or trade union membership, judicial data such as criminal records or information on other judicial or administrative proceedings), we will not request you to provide such data and will not collect or process such data, unless it was manifestly made public by you or if the processing thereof is required by law. If we do request you to provide such sensitive data, the relevant job vacancy will indicate this fact as such and indicate that the provision of the data in question is optional. Otherwise, please avoid submitting information which may qualify as sensitive personal data.
Also, in the event that the provision of sensitive data is indicated as optional, the fact that you do not provide this information will not negatively impact your job application process or your chances to be selected as candidate.
Who has access to your personal data?
Your personal data will be treated as confidential and access thereto will be restricted.
Within our organization only our team members with a business need to know the information for the purposes described in this policy, such as those engaged in the recruitment management or approval process and IT-service personnel, will have access to your personal data.
We may also transfer your personal data to other companies of the Legend Biotech Group if you consent to such transfer or where such transfer, in terms of assessment of your candidature or the performance of the job in question, is naturally inherent to the specific job opening for which you apply. We may also transfer your personal data to group external (sub-)processors (such as suppliers of IT services, including services relating to software for processing and follow-up of personnel recruitment, such as such as Greenhouse Software, Inc., a company with registered office is at 18 West 18th Street, 11th Fl., New York, NY 10011 USA). In such events we shall have entered into a contract with the said companies of the Legend Biotech Group and group external (sub-)processors and shall ensure that they (i) comply with the applicable legal rules, (ii) provide sufficient guarantees with respect to the implementation of appropriate technical and organizational measures to ensure that the processing complies with the legal requirements in terms of the protection of your personal data and your rights and (iii) are bound, among other things, to respect the confidentiality of your personal data, to limit the processing to what is legally permitted and is in line with our instructions and cooperate in the exercise of your rights as granted by the applicable law.
Finally we may also be required by law to provide access to your personal data to public authorities.
Your personal data may be transferred to countries outside of the European Economic Area. In such event we shall however ensure that either such countries offer the protection that is at least equivalent to the protection within the European Economic Area or such required level of protection is achieved by other measures, such as binding corporate rules. You may obtain a copy of these measures by contacting us using the contact details indicated in this policy.
What measures do we take to protect your personal data?
We take appropriate measures to protect and secure your personal data to the maximum extent possible in order to ensure their confidentiality and to prevent them from being distorted, damaged, destroyed or disclosed to an unauthorized third party. The specific measures taken by us in this perspective (such as intrusion detection, firewalls, encryption, manual procedures and other) are described in the information security policy, a copy of which can be obtained by you using the contact details indicated in this policy.
In the event of a data breach and the associated violation of the availability, integrity or confidentiality of your personal data, we shall ensure that such breach is reported to the competent data protection authority within 72 hours of us becoming aware of it, unless it is unlikely that the breach poses any risk to your rights and freedoms. We will also report a personal data breach to you if it is likely that the breach will entail an increased risk for your rights and freedoms.
Whilst we do take appropriate technical and organizational measures to safeguard your personal data, it is highlighted that no transmission of data can ever be guaranteed absolutely secure, in particular the transmission of data through internet. We hereby disclaim, to the extent permitted by the applicable law, any liability for ourselves and our affiliates and contractors for any loss, misuse, illegal access or disclosure, alteration, destruction or lack of timely delivery to us of your personal data in the process of the transmission of your personal data to us. If you have reasons to believe that your interaction with us is no longer secure, please immediately notify us by means indicated below.
How long will we keep your personal data?
Unless at the end of the application process we enter in a contractual relationship with you, your personal data will be kept for the duration of no more than 735 days after the termination of the job application process. After this period, unless agreed otherwise with you, we will delete your personal data or take measures to ensure that your personal data no longer qualifies as personal data under the applicable privacy laws. As such, we may further use any data you provided to us in aggregate and non-person identifiable formats.
What are your commitments?
Any information you submit to us and any transmission thereof must be true, complete, not misleading and in compliance with the applicable laws. It is also your responsibility to ensure that the data you transmit to us and their transmission do not violate any third party’s rights. If is your responsibility to obtain any required third party consents prior to transmitting any information to us, in particular if you would provide us with personal data related to third parties.
Submitting information contrary to what is set out above may lead to a rejection of your application during the application process or, in the event that we enter into a contractual relationship with you, disciplinary action, including immediate termination of such relationship.
Please also note that it is also your responsibility to take all measures to protect your personal data by necessary confidentiality protection mechanisms, including with respect to IDs and passwords, such as those that may be issued to you during the job application process or thereafter.
What are your rights?
You may exercise any of the rights indicated below at your discretion, to the extent permitted by applicable law. Please note however that the exercise of the said rights, may result in us being unable to further process your job application or, if we engage in a contractual relationship with you, to consider your later career opportunities with us.
Right to withdraw consent. If the processing is based on consent only, you shall at all times have the right to withdraw this consent, without such withdrawal of the consent affecting the legality of the processing that took place before the withdrawal.
Right of access. You may at any time inspect its your personal data and any information relating to the processing of your personal data.
Right to rectification. You will be entitled to have your personal data that is incorrect or incomplete, corrected, insofar as this is legally possible.
Right to erasure. Unless processing is necessary for the assertion, exercise or substantiation of a legal claim or for compliance with a statutory obligation resting upon us, you will be entitled to have your personal data erased if (a) your personal data are no longer necessary for the purposes for which they were collected or processed, (b) the consent, insofar as the processing is solely based on it, is withdrawn, (c) you object to the processing and there are no compelling justified grounds for us to continue it, (d) your personal data have been unlawfully processed by us on our behalf or (e) your personal data must be erased in order to comply with a statutory obligation. If the request for erasure forms part of objection to processing for reasons relating to your specific situation, we will erase the data, subject to compelling justified grounds for processing that outweigh your interests and rights or that relate to the assertion, exercise or substantiation of a legal claim.
Right to restriction of Processing. You have the right to obtain from us the restriction on processing of your personal data if (a) the accuracy of your personal data is disputed by you, (b) the processing is unlawful and you object to the erasure of your personal data, (c) you need your personal data for the assertion, exercise or substantiation of a legal claim while we no longer need it for processing purposes or (d) you have objected to processing on the basis of the justifiable grounds as provided by the applicable law.
Right to data portability. You are entitled to obtain your personal data in a structured, customary and legible form and to transfer your personal data to another processor if (a) the processing is based on consent or (b) the processing is necessary for the execution of an assignment following our contractual relationship with you.
Right to object. In case you believe that the processing is unlawful, you are entitled to submit a complaint with respect to the collection or processing of your personal data by us or on our behalf to the data protection supervisory authority of your habitual residence (in Belgium: the Belgian Data Protection Authority (Autorité de protection des données – Gegevensbeschermingsautoriteit, Drukpersstraat 35, 1000 Brussels, +32 (0)2 274 48 00, contact@apd-gba.be (www.privacycommission.be)).
Does this policy cover third-party websites?
This policy does not address, and we are not responsible for, the privacy, information or other practices of any third parties, including any third party operating any website or service to which our websites or platforms link, except of those parties who are operating as our (sub)processor. The inclusion of a link on our websites or platforms does not imply endorsement of the linked site or service by us or our affiliates.
How can you contact us?
If with respect to our collection and processing activities regarding your personal data you have questions, inquiries or complaints or if you wish to exercise the rights granted to you by the applicable law, please contact us via the following means:
LEGEND BIOTECH BV
Gaston Crommenlaan 8
9050 Gent
Belgium
e-mail: jobseurope@legenbiotech.com
Because email communications are not always secure, please do not include sensitive information in such communications to us.
