Privacy Policy

Last updated: 2026-07-15

1. Who we are

This site is operated by Sivel Labs SRL, a Belgian limited liability company registered in La Hulpe, Belgium — BCE / VAT number: BE 1037.283.356. Sivel Labs SRL is the data controller within the meaning of the GDPR (Regulation (EU) 2016/679).

2. Data we collect

We process personal data only in the following cases:

2.1 Contact form

• Submitted fields: name, email address, subject, message.
• Technical metadata: Salted SHA-256 hash of your IP address (32-character prefix, never the clear IP ; salt rotated server-side via service_keys), User-Agent, displayed language.
• Retention: 90 days, then automatic deletion.
• Legal basis: your consent (art. 6.1.a GDPR) by submitting the form, plus legitimate interest (art. 6.1.f) for abuse prevention.

2.2 Job listings (browsing)

Merely browsing our open positions requires no personal data from you. If you apply to a position via the "Apply" form, the data described in section 2.4 is processed. No candidate or recruiter personal data is exposed by this section.

2.3 No tracking cookies

This site uses no third-party cookies and no analytics tracking tools (Google Analytics, Matomo, etc.). Only browser localStorage (a key-value storage area, distinct from cookies — not automatically sent to the server and exempt from the consent-banner requirement of ePrivacy art. 5(3)) holds a language preference key sl-lang. Internal links add a ?lang=fr|en|nl query parameter to the URL to propagate the chosen language: this parameter is visible in server logs (limited to the language value; no other PII).

2.4 Job applications and CV submission

When you apply to a position published on this site (the "Apply" form), the data controller is Sivel Labs SRL (BCE / VAT BE 1037.283.356, Avenue du Bois d'Hennessy 30, 1310 La Hulpe, Belgium), acting for its recruitment-agency activity Sivel Labs Talents.

• Purpose: processing your application and putting you in contact with the end-client companies for which the position is open.
• Legal basis: GDPR art. 6(1)(b) — pre-contractual measures taken at your request. The form's checkbox records that you have read this information; it is not the legal basis of the processing.
• Data categories: identity (name), contact details (email address, phone number where provided), your CV and its full contents (experience, education, skills), cover message.
• Proof of acknowledgement: when you submit the form, your IP address and user-agent are recorded in the proof of acknowledgement of this information (and, where applicable, in the proof of your AI-analysis consent or of the right-to-represent mandate) — the demonstrability obligation of GDPR art. 7. They are kept for the same duration as the proof itself (that of the consent or of the application concerned); where a proof has a validity period (e.g. the right-to-represent mandate), the IP address and user-agent are automatically redacted from it upon expiry.
• Optional AI analysis: a separate, optional checkbox lets you consent (GDPR art. 6(1)(a)) to the AI analysis of your CV (skill extraction and assessment), strictly as a tool assisting the human consultant. This consent can be withdrawn at any time via dpo@sivel-labs.be, without any consequence for your application.
• Recipients: the end-client companies for which the position is open, where applicable via their vendor management system (VMS) such as Connecting Expertise (operated by PIXID). This transmission only takes place after a right-to-represent mandate that you explicitly confirm via a secure link: the mandate is non-exclusive, free of charge, valid for 365 days (the duration is restated in the mandate document) and revocable at any time, with effect for the future.
• Sub-processors: the ATSIQ recruitment platform (published by Sivel Labs SRL), OVH SAS (hosting, France — data stays in the EU), Brevo SA (transactional emails, France).
• Retention: the application and the associated CV are erased 6 months (180 days) after the closure of the recruitment process concerned; an application that is still being processed is not deleted until that process is closed. The associated candidate profile (identity, contact details) is deleted at the same time if no application and no active mandate concerning it remain. Spontaneous expressions of interest ("Express your interest") are kept for at most 2 years (730 days) after your last activity, then automatically deleted.
• Your rights: access, rectification, erasure, restriction, objection, portability (GDPR art. 15 to 21), withdrawal of the AI consent at any time and complaint with the Belgian DPA (APD-GBA) — see section 6 for the procedure. Contact: dpo@sivel-labs.be.

3. Anti-bot — Cloudflare Turnstile

The contact form and the application form are protected by Cloudflare Turnstile (a privacy-respecting reCAPTCHA alternative). Turnstile may process your IP address and a browser fingerprint on Cloudflare's servers. More information: Cloudflare Privacy Policy.

• Data categories : visitor IP address, browser fingerprint (user-agent, language, timezone), cryptographic challenge result. No persistent third-party cookies — Turnstile may set at most a session-scoped cf_clearance technical cookie.
• Retention : Cloudflare retains Turnstile tokens and metadata for at most 24h (per Cloudflare policy). On the Sivel Labs side, the Turnstile verification itself only yields a boolean result (pass/fail). The IP address and user-agent transmitted when a job application is submitted are, however, kept in the proof of acknowledgement described in section 2.4 (GDPR art. 7).
• Legal basis : legitimate interest (GDPR art. 6.1.f) — bot protection is a necessary and proportionate security measure given the form's public exposure.
• Unavailability : if Turnstile is unavailable (Cloudflare outage, network block, browser extension), the interface may accept submission in degraded mode. The server remains the final authority: it validates Turnstile when configured and may reject the request if anti-bot verification fails.
• Outside EU transfer : Cloudflare operates from the USA but relies on Standard Contractual Clauses (SCCs) from the European Commission plus the Data Privacy Framework. Cloudflare's sub-processors are listed at cloudflare.com/gdpr.

4. Sub-processors

• OVH SAS (France) — infrastructure hosting; data remains in EU.
• Brevo SA (France) — transactional email delivery (contact-form receipt notification, application acknowledgements, right-to-represent mandate emails).
• Cloudflare Inc. (USA) — Turnstile anti-bot; standard contractual clauses.

Audience measurement and navigation replay: no third-party sub-processor. These processing operations run on tools self-hosted on the infrastructure listed above (data never leaves our servers). See the cookie policy for details (opt-in, retention periods, technical safeguards).

5. Scope of AI processing

Data collected via this site (contact form, technical metadata — excluding job applications, see section 2.4): no artificial-intelligence processing. No automated scoring, no AI spam classification, no profiling, no automated decision-making within the meaning of GDPR Article 22. Received messages are read exclusively by a human senior consultant at Sivel Labs Talents and any selection of items included in the recruitment workflow remains under explicit human control.

Data collected outside this site, after a recruitment mandate begins: if you become a candidate or client of the Sivel Labs Talents recruitment section operated by Sivel Labs SRL, the subsequent processing of your data (CV, candidate file, exchange history, mission brief) may rely on the CareerToolbox.AI platform (assisted candidate identification, job-description drafting assistance, CV analysis) — strictly as a tool assisting the human consultant, never as an autonomous decision-maker. This use is governed by a separate contract (recruitment mandate OR candidate consent) detailing the AI's role, the DPIA conducted, the applicable EU AI Act safeguards (Article 50 transparency + Article 26 user obligations if high-risk classification), and the candidate's right to human intervention.

Clear boundary: as long as you have neither submitted a job application (section 2.4) nor entered a contractual recruitment relationship with Sivel Labs SRL, NONE of your data crosses this boundary. By applying, you request pre-contractual measures: your application file is then processed in the ATSIQ platform (see section 2.4), and the AI analysis of your CV only takes place if you ticked the optional box provided for that purpose.

5b. AI crawlers and public-content indexation

Public content on this site (agency descriptions, job openings exposed via the public API /api/public/v1/orgs/sivel-labs-talents/jobs, legal pages) is explicitly opt-in for AI crawlers (GPTBot, ClaudeBot, Google-Extended, PerplexityBot, CCBot…) via our robots.txt and llms.txt. This is a deliberate choice: we want AI answer engines to correctly answer queries like "which recruitment agency in Belgium?". No visitor personal data is exposed via these entry points: neither contact form contents (which remain private and encrypted), nor IP fingerprints, nor User-Agent headers. Only marketing copy and publicly-available job listings are indexable. If you operate an AI crawler and would like our site removed from your index, contact dpo@sivel-labs.be — we will adjust the robots.txt to your request within a reasonable timeframe.

6. Your rights

You have the right to access, rectify, erase, object, restrict, and port your data. To exercise these rights, write to dpo@sivel-labs.be with a proof of identity. Response within 30 days max.

If we don't respond, you may file a complaint with the Belgian Data Protection Authority (APD-GBA).

7. Security

All transfers are encrypted with TLS 1.2 or higher (nginx config : TLSv1.2 + TLSv1.3 accepted ; legacy clients on TLSv1.0/1.1 are rejected). Received messages and application files are stored on our protected infrastructure (database and file storage), accessible only to the management team of Sivel Labs SRL and the senior consultants assigned to the file. Your data is never sold or rented and is never disclosed for commercial purposes; the transmission of your application to the end-client companies (where applicable via their VMS platform), described in section 2.4, is not a commercial disclosure — it is strictly limited to the processing of your application and to the right-to-represent mandate you confirmed.

8. DPO contact

Email: dpo@sivel-labs.be
Postal address: Sivel Labs SRL, Avenue du Bois d'Hennessy 30, 1310 La Hulpe, Belgium