Applicant Privacy Notice

This notice explains how your personal data is processed when you apply for a position through the CGMLab recruiting portal, in accordance with the EU General Data Protection Regulation (GDPR) and Spanish data-protection law. 1. Data controller Comparative Genomics & Metagenomics Lab (CGMLab), CBGP (UPM–INIA/CSIC), Madrid, Spain Contact for any data-protection matter: [email protected] 2. What data we collect Data you provide when applying: your name, contact email, CV, your "about myself" introduction, up to three expertise keywords, your one-line statement of fit, your answers to the screening questions, and any links or supporting materials you choose to add. If you provide referees, we also collect their names and contact email addresses. 3. Purposes of processing To receive, evaluate and manage your application for the position you applied to, to communicate with you about it, and to administer our recruitment process. 4. Lawful basis Your explicit consent, given when you submit your application (Art. 6(1)(a) GDPR), and our legitimate interest in running a recruitment process (Art. 6(1)(f)). You may withdraw your consent at any time (see "Your rights"); withdrawal does not affect processing carried out before you withdrew. 5. Recipients and processors Your data is accessed only by members of the CGMLab recruiting / evaluation team. Confirmation and decision emails are delivered through our email provider, Amazon SES (AWS), whose servers are located in the EU (Ireland). We do not sell your data or use it for any purpose other than recruitment. 6. Storage location and transfers Your application and documents are stored on our own server in Spain. All processing, including email delivery, takes place within the European Union / European Economic Area. No transfer of your personal data outside the EEA takes place. 7. Retention period We keep your application data for 24 months after a final decision on the position, after which it is automatically and permanently deleted. If no decision is recorded, we keep it no longer than necessary for the recruitment process and then delete it. 8. Your rights You have the right to access, rectify, erase ("right to be forgotten"), restrict, and object to the processing of your personal data, and the right to data portability. To exercise any of these rights, or to withdraw your consent, email [email protected]. We will respond within the time limits set by the GDPR. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es). 9. References (third-party data) If you provide referee contacts, you confirm that you have their permission to share their details with us. In line with Art. 14 GDPR, we will inform any referee you list about how their data is used if and when we contact them. 10. Changes to this notice If we change this notice we publish a new version. The version you consented to at the time of your application is recorded with your consent.