Privacy policy

What this policy covers

This policy explains how we collect and use personal data through the website ama-ec.com, in English, French and Dutch (the ‘site’), and in the exchanges that follow a request sent through it. We process your data in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679, the ‘GDPR’) and the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.

The site is a showcase: you can read it without an account and without giving us anything. It collects personal data in one place only, the contact form, in addition to the technical data any website needs to deliver its pages securely and, once you start using the form, the technical data that Google reCAPTCHA analyses to protect it against spam.

This policy does not cover the websites the site links to, such as ice-berry, LinkedIn or Google Maps, which have their own policies (see ‘Other websites’). Nor does it cover data processed under a contract with AMA, such as an assignment, employment or service contract: that contract and the information given to you when it is signed apply.

Cookies and similar technologies are described in our Cookie policy, linked at the bottom of every page. In short, the site sets no cookies of its own and uses no tracking; only once you start using the contact form may Google set or read its own cookies through reCAPTCHA.

The data we collect

Through the contact form, depending on the case you choose:

• In every case: your name, your email address, your phone number if you give it, and your message (optional when you are looking for a consultant or a job, required otherwise).
• ‘I need a consultant’: your company, the profile you are looking for, the desired start date and, if you attach it, a job description.
• ‘I am looking for a job’: your current or target job title and, if you attach it, your CV. When you apply from an offer, the message is prefilled with its title and place (‘Application: role — place’), which you can change.
• ‘I want to partner with AMA’: your company. ‘Something else’ asks for nothing more than the fields common to every case.
• With every request: the case you chose and the language of the page, so that we can route your request and answer you in your language, and the token provided by Google reCAPTCHA, so that we can check that the request does not come from an automated program (see ‘Google reCAPTCHA on the contact form’).

You can attach one file, in PDF or Word format and up to 5 MB: everything it contains reaches us as you sent it. The form sends your request over an encrypted connection (HTTPS) to a service hosted by Amazon Web Services, which forwards it to our team by email.

When you visit the site, automatically:

• Technical data that our hosting provider, its content delivery network and the form’s service may record, as any web server does: IP address, date and time, page requested, browser and operating system (user agent) and the page you came from.
• The language you choose with the EN / FR / NL switch, kept only in your browser (a local storage entry named ama-lang) and never sent to a server.

The site sets no cookies of its own and contains no analytics, advertising pixel or social media plugin; its fonts are served with the site itself. Its only third-party script is Google reCAPTCHA, which protects the contact form against spam and is loaded only once you start using the form (see ‘Google reCAPTCHA on the contact form’). We do not follow your browsing or build a profile from it.

When we answer and the exchange continues, by email, by phone or in a meeting, we also process what you tell us or send us then, for the same purposes.

Please send us only what your request needs. Do not include in your CV, your files or your message any sensitive data, such as information about your health, racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership or sexual orientation, criminal records, or your identity card, national register or bank account numbers. A photo is optional. If you send such data anyway, we do not use it and may delete it or ask you for a version without it.

You are responsible for the accuracy of the data you send us. If it includes data about someone else, such as a colleague or a reference, make sure that person has been told and does not object.

Why we use it and on what basis

We use your data only for the following purposes, each with its legal basis under the GDPR:

• To answer your request, which may include an email confirming that we received it, and to take the steps you ask for before any contract, such as proposing consultants, assessing your application or discussing a partnership: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR) and, when no contract is in view, our legitimate interest in answering the enquiries we receive (Article 6(1)(f)).
• To manage our relations with clients, candidates and partners, and to follow up the exchanges you start: our legitimate interest in running our business (Article 6(1)(f)).
• To keep your candidate file after your application in order to suggest other assignments, and to present your profile to a client: your consent (Article 6(1)(a)), given with the form’s checkbox and, for each client, when we ask you (see ‘If you apply for a job’).
• To secure the site and the form, prevent abuse, spam and fraud, in particular by checking with Google reCAPTCHA that a request sent through the form does not come from an automated program, and keep them running: our legitimate interest in protecting our systems, our business and the service the form offers you (Article 6(1)(f)).
• To keep evidence of our exchanges and to establish, exercise or defend our rights: our legitimate interest (Article 6(1)(f)).
• To comply with our legal obligations, for example in accounting, tax or employment matters, or when an authority lawfully asks us: legal obligation (Article 6(1)(c)).

The form asks you to tick a box before sending. In the ‘I am looking for a job’ case, the box reads ‘AMA can keep these details to answer me and suggest other assignments.’ Ticking it is the consent described above. In the other cases, it reads ‘AMA can keep these details to answer me.’ It confirms your request, which we then handle on the bases above.

Where we rely on our legitimate interest, we have weighed it against your interests and rights. You can object to it at any time (see ‘Your rights’).

Where we rely on your consent, you can withdraw it at any time by writing to operations@ama-ec.com. Withdrawing it does not affect what was done lawfully before.

You are under no legal or contractual obligation to give us your data, but the fields marked as required are needed to handle your request: without them, the form cannot be sent.

We do not add you to any newsletter, we do not sell your data, and we do not use it for purposes incompatible with those for which it was collected.

If you apply for a job

Every application is read by a recruiter, a person at AMA. We make no decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you.

Your profile is never sent to a client without your agreement for that client. Before any client sees it, we contact you about the assignment, and you decide.

By ticking the consent box of the ‘I am looking for a job’ case, you allow us to keep your file (the form and your CV) after the role you applied for, and to contact you about other assignments that match your profile, for the period set out under ‘How long we keep it’.

You can withdraw this consent at any time by writing to operations@ama-ec.com. We then stop suggesting assignments to you and delete your file, unless you ask us to continue with an application in progress or the law requires us to keep part of it.

If you become an AMA consultant, as an employee, a freelancer or under any other status, your data is then processed under your contract and the information given to you at that time.

Google reCAPTCHA on the contact form

To protect the contact form against spam and automated abuse, the site uses reCAPTCHA v3, a Google service provided in Europe by Google Ireland Limited. It is invisible: it asks you to solve nothing and works in the background.

How it works:

• When it is loaded: Google’s script is loaded only once you start using the contact form, the first time you click or tap in it, or press a key while you are in it. Until then, nothing is loaded from Google, even when a button or link takes you to the form. Once loaded, it stays active in that browser tab for the rest of your visit.
• What it analyses: technical data such as your IP address, information about your browser and device, and your interactions with the page, to tell people from automated programs. For this, Google may set or read cookies on its own domain and use Google cookies already present in your browser (see our Cookie policy).
• What AMA receives: when you send the form, reCAPTCHA provides a token, which the form sends to AMA with your request. To check it, our server sends Google that token only, without your IP address or the contents of your request, and receives in return a score of how likely the request is to come from an automated program. AMA keeps neither the token nor the score.
• The result: if the check fails, your request is not passed on to our team and the form tells you so; you can then write to us at operations@ama-ec.com.
• Google’s own use: according to Google, the information reCAPTCHA collects is used to improve the service and for general security purposes, and is not used for personalised advertising. That use is governed by Google’s Privacy Policy (policies.google.com/privacy) and Terms of Service (policies.google.com/terms).
• The notice: the floating reCAPTCHA badge that Google normally shows is hidden on the site. Instead, a notice under the form’s send button says that the site is protected by reCAPTCHA and that Google’s Privacy Policy and Terms of Service apply, with a link to each.

We rely on our legitimate interest in protecting the form, and the service it offers you, against spam and abuse (Article 6(1)(f) GDPR). If you do not want Google to be involved, do not use the form: write to us at operations@ama-ec.com instead, and we will handle your request in the same way. You can also object to this processing (see ‘Your rights’).

Who receives your data

We share your data only with:

• Authorised AMA staff who need it to handle your request (recruitment, sales, management), who are bound by confidentiality.
• Service providers who process it on our behalf and only on our instructions, under a contract that requires them to protect it: Amazon Web Services, which hosts the site and the form’s service, our email provider, and the IT and recruitment tools we use.
• Google, which provides reCAPTCHA (Google Ireland Limited and Google LLC): it receives directly from your browser the technical data that reCAPTCHA analyses once you start using the contact form, and from our server the token to check, and handles this information under its own terms, as described under ‘Google reCAPTCHA on the contact form’.
• Our clients: only a candidate’s profile, and only with that candidate’s agreement for that client.
• Public authorities, courts and regulators, when the law requires it, and our legal advisers when this is needed to establish, exercise or defend our rights.
• A buyer or successor, if all or part of our business is merged, sold or transferred; your data would then continue to be processed for the purposes set out in this policy.

We do not sell or rent your personal data, and we do not share it with anyone for their own marketing.

Transfers outside the European Economic Area

We host your data in the European Union. The contact form, for example, is processed in the Paris region (eu-west-3) of Amazon Web Services.

To load quickly, the site’s pages are delivered through Amazon CloudFront, a content delivery network that may serve them from servers close to you, including outside the European Economic Area (EEA).

Some of our providers belong to groups based outside the EEA, such as Amazon Web Services in the United States. Where their services involve a transfer of personal data outside the EEA, it relies on an adequacy decision of the European Commission (including the EU-US Data Privacy Framework, for certified companies) or on the standard contractual clauses adopted by the European Commission.

Google reCAPTCHA is provided in Europe by Google Ireland Limited. The data it collects may also be processed by Google LLC, a company based in the United States and certified under the EU-US Data Privacy Framework.

You can obtain information about these safeguards, and a copy of them, by writing to operations@ama-ec.com.

How long we keep it

We keep your data only as long as the purposes above require:

• Requests from companies and partners, and other requests: as long as needed to handle them, then 3 years after our last contact. If a contract follows, for its duration, then for the legal limitation and accounting retention periods.
• Candidate files (form and CV): 2 years after our last contact, unless you ask us to delete them earlier or withdraw your consent. If you become an AMA consultant, the rules of your contract apply.
• Technical logs: at most 12 months.
• reCAPTCHA: AMA keeps neither the token nor the score returned by Google. Google keeps the data reCAPTCHA collects under its own policies.
• Your language choice (ama-lang): in your browser, until you clear it.

At the end of these periods, your data is deleted or anonymised. We keep it longer only where the law requires it, or for as long as needed to establish, exercise or defend our rights in a dispute.

Security

We take appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access, disclosure, alteration or destruction. The site and the form are served only over encrypted connections (HTTPS), access to your data is limited to the people who need it, and we choose our providers for the safeguards they offer.

No transmission over the internet and no storage system is completely secure. We therefore cannot guarantee the absolute security of the data you send us and, to the extent permitted by law, we are not liable for an interception or intrusion beyond our reasonable control. If you think your data has been compromised, tell us at once at operations@ama-ec.com.

If a personal data breach is likely to result in a risk to your rights and freedoms, we notify the Belgian Data Protection Authority and, where the GDPR requires it, inform you.

Your rights

Under the GDPR, you have the right to:

• Access your data and obtain a copy of it.
• Have inaccurate or incomplete data corrected.
• Have your data erased, where the conditions of the GDPR are met.
• Restrict the processing of your data, for example while we check a point you dispute.
• Receive the data you gave us in a structured, commonly used and machine-readable format, and have it sent to another controller, where the processing is based on your consent or a contract and carried out by automated means.
• Object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest, and object at any time, without giving a reason, to any use of your data for direct marketing.
• Withdraw your consent at any time, without affecting the lawfulness of the processing carried out before.
• Not be subject to a decision based solely on automated processing that significantly affects you. We make no such decisions.

To exercise these rights, write to operations@ama-ec.com, stating which right you wish to exercise and, if possible, which request or application it concerns. If we have reasonable doubts about your identity, we may ask for the information needed to confirm it, and we use it for that purpose only.

We answer within one month of receiving your request. This period may be extended by two further months for complex or numerous requests; if so, we tell you within the first month and explain why.

Exercising your rights is free. For manifestly unfounded or excessive requests, in particular because of their repetitive character, we may charge a reasonable fee or refuse to act on them, as the GDPR allows.

Some rights have limits set by law: for example, even after a request for erasure, we may keep the data we need to meet a legal obligation or to defend our rights. We then tell you what we keep and why.

Complaints

If you think we are not handling your data properly, please write to us first at operations@ama-ec.com: we will do our best to settle the matter with you.

You also have the right to lodge a complaint with the Belgian supervisory authority:

• Belgian Data Protection Authority
• Rue de la Presse 35, 1000 Brussels, Belgium
• Phone: +32 (0)2 274 48 00
• Email: contact@apd-gba.be
• Website: www.autoriteprotectiondonnees.be

You may also lodge a complaint with the supervisory authority of the EU Member State where you live or work, or where the alleged infringement took place, or bring the matter before the competent courts.

Other websites

The site shows AMA’s latest job offers published on ice-berry (ice-berry.com), a recruitment platform and AMA’s partner. They are fetched when the site is built: showing them sends no data about you to ice-berry.

In the future, your browser may refresh this list directly from ice-berry’s servers (api.ice-berry.com). In that case, ice-berry receives your IP address and technical data about your browser, as with any request on the web, without cookies and without any data from the form.

Clicking an offer, ‘See all open roles’, ‘Post a job on ice-berry’ or the job search takes you to ice-berry. If you apply or create an account there, ice-berry acts as a separate controller, under its own terms and privacy policy, and AMA is not responsible for that processing. Where an application made on ice-berry reaches AMA, we handle it as described in this policy.

The site also links to our LinkedIn page and to Google Maps for our address. After you send the form, a button may open your webmail (Gmail, Outlook, Yahoo Mail, iCloud Mail or Proton Mail): the site only opens its address and sends nothing to these providers.

We do not control these websites and are not responsible for their content or for how they handle personal data. Once you are there, their own policies apply: please read them.

Children

The site is intended for professionals and job seekers of working age. It is not intended for people under 16, and we do not knowingly collect their data. If we learn that we have received data from a person under 16, we delete it. If you are a parent or guardian and think this has happened, write to us at operations@ama-ec.com.

Changes to this policy

We may update this policy, for example when the site, our services or the law change. The date at the top of this page shows the current version, which applies from its publication.

If a change significantly affects how we use data we already hold, we will tell you where appropriate, for example by email or with a notice on the site, and ask for your consent again where the law requires it.