Privacy policy

1. Purpose of the policy

This policy describes the conditions under which APPM RH processes the personal data of persons who:

• ›respond to a job offer;
• ›submit a spontaneous application;
• ›request registration in APPM RH's CV database;
• ›take part in a recruitment process;
• ›request their referencing as a service provider, craftsperson, consultant, liberal professional, firm, company, cooperative or professional group;
• ›are proposed to APPM RH by a partner or client company.

It applies to applications received on APPM RH's website, by email, by physical submission, via an online form, by telephone or professional messaging, through a client company or authorized partner, or at a trade fair, recruitment campaign or referencing operation.

2. Data controller

The data controller is APPM RH — Address: Sangarébougou, Seydoubougou sector, street 110, gate 39 (or 05). Telephone: 76 40 49 44. Email: appm@groupeappm.com. Website: www.groupeappm.com.

For any question regarding the use of their personal data, the candidate or provider may contact APPM RH at the details above. APPM RH may appoint an internal officer responsible for data protection and confidentiality.

3. Principles applied by APPM RH

APPM RH undertakes to respect the following principles:

3.1. Fair and transparent collection

Information is collected clearly and transparently. The data subject is informed of the identity of the organization collecting their information, the reason it is requested, the use that will be made of it, the persons who may access it, the retention period and their rights over their data.

3.2. Specified purpose

Data is collected only for precise, explicit and legitimate professional purposes. It must not subsequently be used for a purpose incompatible with the one announced to the candidate or provider.

3.3. Data minimization

APPM RH requests only the information necessary to review an application, evaluate a professional profile, connect with a client company or reference a provider. Information unrelated to skills, experience, availability, qualification or the requirements of the position must not be requested.

3.4. Accuracy of information

APPM RH ensures, as far as possible, that the information retained is accurate and up to date. Candidates and providers are invited to report any change concerning in particular their contact details, professional situation, qualifications, availability, references and areas of operation.

3.5. Limited retention period

Data is archived or anonymized when it is no longer necessary for the purposes for which it was collected.

3.6. Confidentiality and security

APPM RH implements administrative, human, physical and IT measures to protect information against loss, destruction, alteration, unauthorized disclosure, theft, fraudulent access and misuse.

4. Categories of data collected

Depending on the nature of the application or referencing, APPM RH may collect the following categories of information.

4.1. Identification information

First and last name; date and place of birth where necessary; nationality only where the regulations or position justify it; professional photograph where it is useful and freely provided; identity document number only where its verification is necessary; signature.

4.2. Contact details

Residential address; municipality, region or country; telephone number; WhatsApp number; email address; emergency contact, only at an advanced stage where necessary.

4.3. Professional information

Curriculum vitae; profession or trade; area of expertise; specialization; professional experience; previous employers; positions held; professional references; achievements; availability; geographic mobility; salary expectations or professional rates; driving licence; professional accreditations or authorizations.

4.4. Training information

Diplomas; certificates; training certificates; institutions attended; languages spoken; IT skills; technical qualifications.

4.5. Information relating to companies and providers

For providers, firms, craftspeople or groups, APPM RH may request: company name; legal form; registered office address; name of the manager; RCCM; tax identification number; approval or operating authorization; workforce; material resources; professional references; certificates of satisfactory completion; areas of operation; catalogue or presentation of services.

4.6. Information from the evaluation process

APPM RH may retain interview and professional test results, evaluation reports, recruiters assessments, reference checks, the status of the application and correspondence exchanged with the candidate. These assessments must be objective, professional and directly related to the position or service sought.

5. Information that must not be requested without necessity

APPM RH refrains from systematically requesting excessive information or information unrelated to the job or service. Except for a legal obligation or a clearly justified particular necessity, APPM RH does not request:

• ›political opinions;
• ›trade union membership;
• ›religion;
• ›ethnic origin;
• ›detailed medical situation;
• ›information relating to private or sexual life;
• ›personal passwords;
• ›bank details at the initial stage of the application;
• ›criminal records unrelated to the requirements of the position;
• ›detailed information about family members;
• ›any other information unrelated to professional ability.

Any medical or judicial data that may be necessary must be collected only under the conditions provided by the regulations and with enhanced safeguards.

6. Purposes of collection

The data collected may be used to:

• ›receive and record applications;
• ›build and manage a CV database;
• ›identify profiles matching the needs of client companies;
• ›assess skills, qualifications and experience;
• ›organize interviews and tests;
• ›verify diplomas, certificates and professional references;
• ›propose a candidate to a client company;
• ›respond to recruitment or staffing requests;
• ›build a directory of providers, craftspeople, consultants and groups;
• ›request quotes or technical proposals;
• ›contact people when an opportunity matching their profile is available;
• ›handle the administrative follow-up of applications;
• ›prevent fraud and verify the authenticity of documents;
• ›produce anonymized internal statistics;
• ›comply with the applicable legal and regulatory obligations.

Data must not be sold or used for commercial purposes unrelated to recruitment or professional referencing.

7. Basis and consent for processing

The data subject must receive clear information before or at the time their data is collected. Where processing is based on their consent, this must be free, specific, informed, expressed by a positive action and distinct from a mere absence of objection.

Consent may be obtained via an unchecked checkbox, a signature or an electronic validation. Refusing to authorize registration in the CV database does not necessarily prevent the review of an application for a specific position; in that case, the data is used solely for the relevant recruitment.

8. Proposed consent wording

The following wording may be placed at the bottom of the form: “I acknowledge that I have read APPM RH's privacy policy. I authorize APPM RH to collect, record and process the information in my file in order to review my application, verify my references and contact me about professional opportunities matching my profile.”

A second, separate and optional box should be provided for the CV database: “I agree that my profile may be kept in APPM RH's CV database and consulted for future professional opportunities.”

A third box may be provided for transmission to clients: “I authorize APPM RH to transmit my CV and relevant professional information to a client company interested in my profile. I understand that information unrelated to the opportunity must not be disclosed.”

9. Transmission to client companies

APPM RH may transmit certain information to client companies when an opportunity matches the profile of the candidate or provider. The transmission must be limited to the necessary professional data, in particular the CV, qualifications, experience, skills, availability, relevant references and contact details where their communication is necessary.

APPM RH must not unnecessarily transmit a full copy of the identity document, bank details, medical data, family information or confidential documents unrelated to the position.

The receiving client company must be informed of the confidential nature of the information received and must not use it for other purposes.

10. Reference checks

APPM RH may contact former employers, clients or referees indicated by the candidate or provider. This verification must relate only to professional matters, such as the positions held, the period of employment or engagement, skills, quality of work, adherence to commitments and the professional reasons for the end of the collaboration where their disclosure is lawful.

The candidate must be informed before contact is made with their references, in particular where their current employer is concerned.

11. Recruitment decisions

Recruitment decisions must not be based solely on automated or computer processing. Software, ranking tables or artificial intelligence tools may facilitate pre-selection, but human intervention must be maintained before any significant decision.

The criteria used must be objective, relevant, non-discriminatory, related to the position, understandable and regularly reviewed.

12. Retention period

The files of recruited candidates are transferred to their professional file and kept in accordance with the obligations applicable to personnel management.

For unsuccessful candidates:

• ›data relating to a specific application may be kept for a reasonable period necessary to close the recruitment;
• ›registration in the CV database may be maintained for a recommended initial period of two years from the last contact or the last update of the file;
• ›confirmation may be requested before renewing retention;
• ›the person may request the deletion of their file at any time.

For referenced providers, information may be kept for the duration of the referencing, subject to periodic verification or updating. APPM RH reviews files at least once a year in order to delete files that are no longer needed, identify inactive profiles, request an update, archive the necessary information and correct outdated information.

13. Recipients of the information

Access to the data is limited to persons who need it in the course of their duties, in particular:

• ›authorized staff of the recruitment department;
• ›APPM RH's management;
• ›human resources managers;
• ›authorized recruitment consultants;
• ›the client companies concerned;
• ›IT providers responsible for hosting or maintenance, within the limits of their assignment;
• ›legally authorized authorities, where an obligation requires it.

Everyone with access to the data is bound by a duty of confidentiality.

14. Database security

APPM RH implements measures proportionate to the nature and volume of the data processed.

14.1. Organizational measures

• ›designate the persons authorized to consult the files;
• ›limit access according to responsibilities;
• ›have confidentiality undertakings signed;
• ›train staff in data protection rules;
• ›keep a register of persons with access to the CV database;
• ›establish a procedure for creating and removing access;
• ›regularly review access rights;
• ›avoid the insecure sending of CVs to multiple recipients;
• ›bind external providers by confidentiality obligations.

14.2. IT measures

• ›protect accounts with strong passwords;
• ›use two-factor authentication where possible;
• ›regularly update software;
• ›install protection against viruses and fraudulent access;
• ›encrypt equipment or media containing sensitive data;
• ›make regular backups and keep them in a secure location;
• ›log important connections and changes;
• ›automatically lock inactive sessions;
• ›avoid keeping files on unsecured personal phones or computers.

14.3. Physical measures

• ›keep paper files in locked cabinets;
• ›restrict access to offices and archives;
• ›not leave CVs visible on tables, printers or public areas;
• ›destroy documents that are no longer needed using a shredder or a secure process;
• ›protect servers, computers and backup media against theft and damage.

15. Incident management

Any staff member who observes a loss, theft, destruction, disclosure or unauthorized access must immediately inform the person responsible for data protection at APPM RH. APPM RH must then:

• ›identify the nature of the incident;
• ›quickly limit its consequences;
• ›protect the accounts or equipment concerned;
• ›identify the data affected;
• ›keep a record of the incident;
• ›take the necessary corrective measures;
• ›inform the persons concerned and the competent authorities where the regulations require it.

Incidents must not be concealed.

16. Rights of candidates and providers

Any person concerned may, under the conditions provided by the regulations:

• ›ask whether APPM RH holds data about them;
• ›obtain access to the information held;
• ›request the correction of inaccurate or incomplete information;
• ›update their CV or contact details;
• ›request the deletion of their file when its retention is no longer justified;
• ›object to certain uses of their data;
• ›withdraw their consent to retention in the CV database;
• ›request that their profile no longer be transmitted to client companies;
• ›request explanations about the processing of their application.

The withdrawal of consent does not affect processing lawfully carried out before that withdrawal.

17. Procedure for exercising rights

The request may be sent to APPM RH – Data Protection Department. Address: Sangarébougou, Seydoubougou sector, street 110, gate 39 (or 05). Telephone: 76 40 49 44. Email: appm@groupeappm.com.

The request must allow the person to be clearly identified and must specify its purpose. APPM RH responds within a reasonable time and may request proof of identity where necessary to prevent a third party from fraudulently accessing the information. The copy of the identity document provided on this occasion must not be kept beyond the time necessary to verify identity, unless there is a contrary legal obligation.

18. Complaints

By adhering to the terms of use and this policy, the user acknowledges the framework within which APPM RH retains and uses the data, in compliance with the purposes described above.

19. Data received from a third party

When a CV is transmitted by a third party, APPM RH must ensure that the person concerned has been informed or has authorized this transmission. APPM RH must inform the candidate, within a reasonable time:

• ›of the receipt of their file;
• ›of the identity of the person or organization that transmitted it, where possible;
• ›of the intended use of their information;
• ›of their rights.

In the absence of agreement or a valid basis, the file must not be kept in the CV database.

20. Social media and online searches

APPM RH must not systematically collect personal information appearing on candidates' private social media. An online search may only be carried out where it is useful to the position concerned, limited to lawfully accessible professional information, proportionate to the objective pursued and free of discriminatory criteria.

Information relating to private life that has no connection with the position must not be used in the decision.

21. Subprocessors and hosting

When APPM RH entrusts the hosting, maintenance or management of its recruitment platform to an external provider, that provider must:

• ›act only on APPM RH's instructions;
• ›guarantee confidentiality;
• ›implement appropriate security measures;
• ›not use the data for its own purposes;
• ›return or delete the data at the end of the service;
• ›immediately report any security incident.

A written agreement must specify the provider's data protection obligations.

22. Transfer or hosting outside Mali

When data is hosted or accessible from another country, APPM RH must verify that its transfer complies with the applicable rules and offers a sufficient level of protection. Candidates must be informed when a hosting service or recruitment software results in an international transfer of their data.

23. Formalities with the APDP

Before bringing the CV database, the electronic form or a recruitment software into operation, APPM RH must examine the applicable formalities with the Personal Data Protection Authority. Depending on the nature of the processing, a declaration, an authorization request or another prior formality may be required. This policy does not replace the regulatory formalities or the support of a competent professional.

24. Undertaking of APPM RH staff

Any staff member involved in recruitment undertakes to:

• ›use files exclusively for professional purposes;
• ›not disclose data to unauthorized persons;
• ›not keep personal copies of CVs;
• ›not publish candidates' information;
• ›not use contact details for private or commercial purposes;
• ›protect passwords and means of access;
• ›report incidents;
• ›return files and delete copies at the end of their assignment.

The confidentiality obligation remains applicable after the staff member's departure.

25. Updating the policy

This policy may be amended to take account of changes in regulations, recommendations from the competent authority, changes in APPM RH's activities, the use of new recruitment software or tools, and changes in security measures. The updated version is published on APPM RH's website with its effective date.

26. Entry into force

This policy enters into force on September 30, 2026. Approved by: Sékou Diakité. Moustaph Diakité (Director).