Privacy Policy

Last updated: 2026-09-23

1. Who we are

This site is operated by Sivel Labs SRL, a Belgian limited liability company registered in La Hulpe, Belgium — BCE / VAT number: BE 1037.283.356. Sivel Labs SRL is the data controller within the meaning of the GDPR (Regulation (EU) 2016/679).

2. Data we collect

We process personal data only in the following cases:

2.1 Contact form

• Submitted fields: name, email address, subject, message.
• Technical metadata: Salted SHA-256 hash of your IP address (32-character prefix, never the clear IP ; salt rotated server-side via service_keys), User-Agent, displayed language.
• Retention: 90 days, then automatic deletion.
• Legal basis: your consent (art. 6.1.a GDPR) by submitting the form, plus legitimate interest (art. 6.1.f) for abuse prevention.

2.2 Job listings (browsing)

Merely browsing our open positions requires no personal data from you. If you apply to a position via the "Apply" form, the data described in section 2.4 is processed. No candidate or recruiter personal data is exposed by this section.

2.3 Audience measurement with consent

Google Analytics 4 loads only after your explicit consent in the cookie banner. Before consent, no request is sent to Google. We send only page views whose URL is limited to the origin and path, standard GA4 technical session and engagement signals, and the HTTP success of contact and application forms. No name, email, CV, form content, user ID or job ID is sent. Advertising signals and personalisation remain disabled. You can withdraw consent at any time; see the cookie policy.

2.4 Job applications and CV submission

When you apply to a position published on this site (the "Apply" form), the data controller is Sivel Labs SRL (BCE / VAT BE 1037.283.356, Avenue du Bois d'Hennessy 30, 1310 La Hulpe, Belgium), acting for its recruitment-agency activity Sivel Labs Talents.

• Purpose: processing your application and putting you in contact with the end-client companies for which the position is open.
• Legal basis: GDPR art. 6(1)(b) — pre-contractual measures taken at your request. The form's checkbox records that you have read this information; it is not the legal basis of the processing.
• Data categories: identity (name), contact details (email address, phone number where provided), your CV and its full contents (experience, education, skills), cover message.
• Proof of acknowledgement: when you submit the form, your IP address and user-agent are recorded in the proof of acknowledgement of this information (and, where applicable, in the proof of the right-to-represent mandate) — the demonstrability obligation (GDPR art. 5.2 and art. 7). They are kept for the same duration as the proof itself (that of the application or of the mandate concerned); where a proof has a validity period (e.g. the right-to-represent mandate), the IP address and user-agent are automatically redacted from it upon expiry.
• AI analysis of your CV: the AI analysis of your CV (skill extraction and assessment), strictly as a tool assisting the human consultant, is carried out by default on the basis of legitimate interest (GDPR art. 6(1)(f)), with prior information (GDPR art. 13-14). You have a right to object (GDPR art. 21) exercisable at any time via dpo@sivel-labs.be, without any consequence for your application; an objection stops the analysis and deletes its results.
• Recipients: the end-client companies for which the position is open, where applicable via their vendor management system (VMS) such as Connecting Expertise (operated by PIXID). This transmission only takes place after a right-to-represent mandate that you explicitly confirm via a secure link: the mandate is non-exclusive, free of charge, valid for 365 days (the duration is restated in the mandate document) and revocable at any time, with effect for the future.
• Sub-processors: the ATSIQ recruitment platform (published by Sivel Labs SRL), OVH SAS (hosting, France — data stays in the EU), Brevo SA (transactional emails, France).
• Retention: the application and the associated CV are erased 2 years after the closure of the recruitment process concerned; an application that is still being processed is not deleted until that process is closed. The associated candidate profile (identity, contact details) is deleted at the same time if no application and no active mandate concerning it remain. Spontaneous expressions of interest ("Express your interest") are kept for at most 2 years (730 days) after your last activity, then automatically deleted.
• Your rights: access, rectification, erasure, restriction, objection, portability (GDPR art. 15 to 21), right to object to the AI analysis at any time and complaint with the Belgian DPA (APD-GBA) — see section 6 for the procedure. Contact: dpo@sivel-labs.be.

2.5 Sivel Labs Talents talent pool

The data controller for the pool of professional profiles described below is Sivel Labs SRL (BCE / VAT BE 1037.283.356, Avenue du Bois d'Hennessy 30, 1310 La Hulpe, Belgium), acting for its recruitment-agency activity Sivel Labs Talents, which builds it to fill the positions it manages.

• Sources: public professional profiles (LinkedIn), professional data providers (profiles and contact details), CVs submitted by the data subject.
• Purpose: identifying individuals who may match positions managed by Sivel Labs Talents and contacting them with a view to a recruitment introduction. Profiles are processed in the ATSIQ recruitment platform, published by Sivel Labs SRL: it first receives a pseudonymised version of the profile, from which the identity, contact details and LinkedIn URL fields are excluded, then, for only those profiles selected for a position, the identity, contact details, LinkedIn URL and CV. ATSIQ's own sub-processors and transfers are described in the ATSIQ privacy policy.
• Legal basis: legitimate interest (GDPR art. 6.1.f) — the agency's interest in identifying and contacting potential candidates for the positions it manages.
• Data categories: identity (first name, last name); LinkedIn profile URL; contact details where available (email, phone); career history (current title and company, location, profile headline and summary, skills, years of experience, languages, work experience, education); CV or PDF export of the LinkedIn profile, where applicable; profile provenance (source, date of collection, provenance and quality tags, origin of the contact details); profile history (transmissions to ATSIQ, contacts with their date and channel).
• Sub-processors: OVH SAS (hosting and backups of the talent pool, France — data stays in the EU).
• Retention: as long as the profile remains useful to the recruitment activity of Sivel Labs Talents, until your objection or a withdrawal decided by the agency. The profile content and CV are then erased; technical copies that still contain them (encrypted backups, pending delivery files) disappear within 30 days at most. A minimal trace then remains: an internal reference, the dated history of the profile (entry into the talent pool, transmissions to ATSIQ, contacts, withdrawal or objection) and hashes of the LinkedIn profile identifier, the email address and the phone number. It serves to prevent duplicates, to report the withdrawal or objection to ATSIQ, and to keep proof of transmissions and contacts. After a withdrawal decided by the agency, the LinkedIn profile identifier also remains readable; after an objection, no readable identifier is kept and these hashes serve to refuse any new collection under these identifiers.
• Right to object: you may object at any time to the processing of your data in the talent pool, and thereby request its withdrawal, by writing to dpo@sivel-labs.be (GDPR art. 21). Your profile content and CV are then erased, your identifiers are replaced by hashes that block any new collection under these identifiers, and the request is forwarded to ATSIQ; backups and the retained trace are described under "Retention". For your other rights (access, rectification, erasure, restriction, portability), see section 6.

3. Anti-bot — Cloudflare Turnstile

The contact form and the application form are protected by Cloudflare Turnstile (a privacy-respecting reCAPTCHA alternative). Turnstile may process your IP address and a browser fingerprint on Cloudflare's servers. More information: Cloudflare Privacy Policy.

• Data categories : visitor IP address, browser fingerprint (user-agent, language, timezone), cryptographic challenge result. No persistent third-party cookies — Turnstile may set at most a session-scoped cf_clearance technical cookie.
• Retention : Cloudflare retains Turnstile tokens and metadata for at most 24h (per Cloudflare policy). On the Sivel Labs side, the Turnstile verification itself only yields a boolean result (pass/fail). The IP address and user-agent transmitted when a job application is submitted are, however, kept in the proof of acknowledgement described in section 2.4 (GDPR art. 7).
• Legal basis : legitimate interest (GDPR art. 6.1.f) — bot protection is a necessary and proportionate security measure given the form's public exposure.
• Unavailability : if Turnstile is unavailable (Cloudflare outage, network block, browser extension), the interface may accept submission in degraded mode. The server remains the final authority: it validates Turnstile when configured and may reject the request if anti-bot verification fails.
• Outside EU transfer : Cloudflare operates from the USA but relies on Standard Contractual Clauses (SCCs) from the European Commission plus the Data Privacy Framework. Cloudflare's sub-processors are listed at cloudflare.com/gdpr.

4. Sub-processors

• OVH SAS (France) — infrastructure hosting; data remains in EU.
• Brevo SA (France) — transactional email delivery (contact-form receipt notification, application acknowledgements, right-to-represent mandate emails).
• Cloudflare Inc. (USA) — Turnstile anti-bot; standard contractual clauses.
• Google Ireland Limited — Google Analytics 4 audience measurement only after consent; advertising signals disabled.

The public site no longer sends audience measurement to PostHog. Google Analytics 4 receives data only after consent and under the minimisation described in the cookie policy.

5. Scope of AI processing

Data collected via this site (contact form, technical metadata — excluding job applications, see section 2.4): no artificial-intelligence processing. No automated scoring, no AI spam classification, no profiling, no automated decision-making within the meaning of GDPR Article 22. Received messages are read exclusively by a human senior consultant at Sivel Labs Talents and any selection of items included in the recruitment workflow remains under explicit human control.

Data collected outside this site, after a recruitment mandate begins: if you become a candidate or client of the Sivel Labs Talents recruitment section operated by Sivel Labs SRL, the subsequent processing of your data (CV, candidate file, exchange history, mission brief) may rely on the CareerToolbox.AI platform (assisted candidate identification, job-description drafting assistance, CV analysis) — strictly as a tool assisting the human consultant, never as an autonomous decision-maker. This use is governed by a separate contract (recruitment mandate; for candidates, legal basis: legitimate interest — Art. 6(1)(f) — with the right to object under Art. 21) detailing the AI's role, the DPIA conducted, the applicable EU AI Act safeguards (Article 50 transparency + Article 26 user obligations if high-risk classification), and the candidate's right to human intervention.

Clear boundary: as long as you have neither submitted a job application (section 2.4) nor entered a contractual recruitment relationship with Sivel Labs SRL, NONE of your data crosses this boundary, except where your profile is in the Sivel Labs Talents talent pool described in section 2.5. By applying, you request pre-contractual measures: your application file is then processed in the ATSIQ platform (see section 2.4), and the AI analysis of your CV is carried out there by default under legitimate interest (GDPR art. 6(1)(f)), with information and a right to object (GDPR art. 21) exercisable at any time.

5b. AI crawlers and public-content indexation

Public content on this site (agency descriptions, job openings exposed via the public API /api/public/v1/orgs/sivel-labs-talents/jobs, legal pages) is explicitly opt-in for AI crawlers (GPTBot, ClaudeBot, Google-Extended, PerplexityBot, CCBot…) via our robots.txt and llms.txt. This is a deliberate choice: we want AI answer engines to correctly answer queries like "which recruitment agency in Belgium?". No visitor personal data is exposed via these entry points: neither contact form contents (which remain private and encrypted), nor IP fingerprints, nor User-Agent headers. Only marketing copy and publicly-available job listings are indexable. If you operate an AI crawler and would like our site removed from your index, contact dpo@sivel-labs.be — we will adjust the robots.txt to your request within a reasonable timeframe.

6. Your rights

You have the right to access, rectify, erase, object, restrict, and port your data. To exercise these rights, write to dpo@sivel-labs.be with a proof of identity. Response within 30 days max.

If we don't respond, you may file a complaint with the Belgian Data Protection Authority (APD-GBA).

7. Security

All transfers are encrypted with TLS 1.2 or higher (nginx config : TLSv1.2 + TLSv1.3 accepted ; legacy clients on TLSv1.0/1.1 are rejected). Received messages and application files are stored on our protected infrastructure (database and file storage), accessible only to the management team of Sivel Labs SRL and the senior consultants assigned to the file. Your data is never sold or rented and is never disclosed for commercial purposes; the transmission of your application to the end-client companies (where applicable via their VMS platform), described in section 2.4, is not a commercial disclosure — it is strictly limited to the processing of your application and to the right-to-represent mandate you confirmed.

8. DPO contact

Email: dpo@sivel-labs.be
Postal address: Sivel Labs SRL, Avenue du Bois d'Hennessy 30, 1310 La Hulpe, Belgium