Important Information
About us
Source Up S.à r.l. («Source Up», «the company», «we», «us» or «our») is a company specialising in recruitment, sourcing, HR consultancy and technical and behavioural validation of candidates or employees, as well as HR consulting and outsourcing of HR services («services»).
Source Up is committed to respecting your privacy and protecting your personal data. This privacy notice, our Cookie Policy as well as our Terms of Use and any other documents referred to, inform you about how we collect and process your personal data, including through your use of our website, regardless of where you visit it from. This privacy notice also informs you of your privacy rights and how the law protects you.
Data Controller
The term “Data Protection Laws” used in this policy means the General Data Protection Regulation EU 2016/679 (GDPR) and any corresponding or equivalent national laws or regulations of the European Union (EU) or EU Member States that are applicable to the processing of personal data under this policy. The terms “Data controller”, “Personal data”, “Data subjects” and “processing” used in this notice shall have the same meaning as those prescribed in the Data protection Laws.
The company Source Up S.à r.l., with registered offices at 10A rue des Mérovingiens, 8070 Bertrange, Luxembourg, is data controller (i.e. the organisation which determines why and how to process personal data), within the meaning of and in accordance with applicable data protection laws, including but not limited to, the European General Data Protection Regulation 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the «GDPR»).
Data Subjects
Under the GDPR, data subjects mean natural persons whose personal data is being processed. For the purpose of this privacy policy, data subjects on whom Source Up collects and processes personal data may include, but are not limited to, the following categories of individuals:
- Clients (being individuals) or representatives, employees and contact persons related to companies being clients.
- Candidates who register with us for positions we manage on behalf of other employers or through our website, job boards, social media sites or other sources.
- Existing or potential suppliers and commercial partners, their representatives, employees and contact persons related to the services provided by Source Up.
- Users and visitors to our website.
- Any other individual having or who had interactions with Source Up.
(Collectively «you» or «your»)
Current and former employees, students or interns, consultants, or candidates in pre-contractual agreement to join Source Up or for whom the Client asked us to facilitate the engagement and process with the onboarding, do not fall in the scope of this privacy policy and are covered by the Employee Privacy Policy available with HR.
Type of data collected
Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include anonymised data.
We may collect, use, store and transfer different kinds of personal data about you depending on the relationship we have with you. We process the following categories of personal data (non-exhaustive list):
- Identification data: may include name, surname, username, name of your company (if client/supplier), gender, civil status, date of birth, nationality, picture of yourself (that you have provided to us), etc.
- Contact data: may include postal address, billing address, email, phone number, your preferred means of communication, business contacts, etc.
- Banking or Financial data may include salary expectations, bank account details (invoicing), VAT number, etc.
- Professional life data may include your job title, information from your CV (current position, benefits, education, former employers, trainings, diplomas, language skills, work location, etc.), link to your LinkedIn profile or other social media, information from past employers or references, interview data (questions about your career and drivers, notes, correspondences, results of assessments as part of the recruitment process, etc.).
- Technical/Device data: when you visit our site, we will automatically collect information about your equipment, IP address, browsing actions and patterns. We collect this information by using cookies and other similar technologies and from the communications we receive from your browser. Please see our Cookie policy for further details about how we use cookies and other similar technologies.
Sources of data collection
The Company collects this information in different ways:
- Directly from you: Most of the information we process about you, we receive directly from you, for example when you:
- apply for a position we do search for via our website or other means and send us your resume for this purpose.
- apply for or enquire about our services
- enter into any agreement with us
- participate to one of our trainings, coaching sessions, HR counselling, or any other service provided by Source Up
- create an account on our website or contact us through our website
- request marketing to be sent to you (e.g. newsletter)
- give us some feedback
- log-in to a secure area of our website (e.g. Candidate Area)
- otherwise meet or interact with somebody from our team and exchange contact details: you may give us your data by filling in forms or by corresponding with us by post, phone, email, chat, via a dedicated online form on our website, in person or otherwise.
- From your employer (being our client): for example, to provide our HR Services solutions, coordinate projects on behalf of your employer, send emails to the Staff, send material, answer to requests, etc.
- Third parties: We may receive information about you from our employees or partners (such as recruitment service providers), when they believe your profile is of interest for our current or future vacancies.
- Public sources: we may collect data from public sources, such as Facebook, LinkedIn, Editus, and other public sources.
Purposes of processing
- Processing and delivery of professional services such as:
- Recruitment & Sourcing services (analysis of your application file and search for a match with a job offer with our clients or open positions in our portfolio of offers).
- Human Resources Advising services
- Consulting services in Human Resources
- Management of administration and clients and supplier relationship, including:
- Proposals and contract drafting
- Follow-up and management of business relationship with clients, suppliers and subcontractors
- Fulfil contractual obligations to you
- Invoicing and payment of invoices
- Marketing, communication and public relations
- Prospecting purposes and to determine if you may be interested in our services and how we can help you.
- Compliance with regulatory, contractual and legal obligations:
- Protection of the premises, equipment, infrastructure and IT data
- Ensuring business continuity & risk management
- Processing of requests from data subjects
- Management of the website and its various related applications.
- Improve and personalize your experience when visiting our website.
- Defend our interests in legal proceedings.
- Communicate with you for any of the above listed purposes and respond to your inquiries.
Legal bases for processing
We will only use your personal data when legally permitted. The above-described purposes are based on at least one of the following legal bases:
- • The processing is necessary for the purposes of the legitimate interests pursued by Source Up or by a third party in conducting and managing our business (e.g. maintain up-to-date communication with all the data subjects as part of any current or potential business relationship).
- • The processing can also be necessary for the performance of a contract (or in the pre-contractual phase) to which the data subject is bound.
- • There may be specific circumstances when the processing is only performed if and when you provide your consent to the processing of their personal data for one or more specific purposes.
- • The processing is necessary for compliance with a legal obligation to which Source Up is subject.
Data retention period
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. We therefore will retain your personal data as a minimum for the duration of your relationship or contractual engagement with us or for a shorter period if your personal data is no longer necessary for the purpose for which it was collected or no longer accurate/up to date.
In certain cases, legal or regulatory obligations (for example in the case of tax related matters) require us to retain specific records for a set period of time, including following the end of your employment. In the case of tax/bookkeeping related matters we are for example obliged to keep data concerning your remuneration for at least ten (10) years.
We are using the following criteria to establish our retention period:
- as long as we have an ongoing employment relationship with you (or for a shorter period provided that the personal data is no longer necessary in relation to the purposes for which they were collected)
- as required by legal obligations to which we are subject (such as tax and accounting obligations)
- as advisable in light of our legal position in order to establish, exercise and defend against legal claims
- as necessary to meet our legitimate business needs (such as for forecasting, planning, follow-up etc).
In some circumstances we may anonymize your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.
Transfer of personal data
We may have to share your personal data with the parties set out below for the purposes set out in the contract we have with you or in paragraph 4 above.
- We may share with or give access to your personal data to our colleagues at Source Up and our sourcers in the European Economic Area (EEA), in compliance with the obligations applicable to the GDPR. Access to your personal data is limited to a restricted number of employees at Source Up: managers, members of the administrative department as well as the person(s) involved in the recruitment process.
- Professional advisers, including (but not limited to) lawyers, bankers, auditors, accountants, notaries, insurers and other consultants, business partners, suppliers and subcontractors acting as processors or controllers, in each case, based in Luxembourg or another EU country.
- Your employer or future employer or any person we have a contract with and that has requested, with your knowledge, that we perform services involving you such as HR services, training, coaching, etc. If you are a candidate, we share your personal data with our clients who have vacancies for jobs that interest you.
- Service providers:
- who provide IT, system administration and/or data hosting services.
- who provide recruitment support services such as: Teamtailor
- who provide personality and motivational questionnaires, ability tests, 360° feedback providers such as: Assess First, SHL, Insights Discovery (non-exhaustive list).
- Authorities, legal advisers, or any other similar entity when we are ordered to do so. We will share your personal data with authorities and other public actors when we have a legal obligation to do so.
- Parties involved in legal proceedings. If needed to protect or defend our rights, we share your personal data with public authorities or with other parties involved in a potential or existing legal proceeding. This can for example be in case of discrimination claims.
- To the new owners of the business and their advisors in the event of a reorganization, merger, sale, joint venture, assignment or other transfer or disposition of all or a portion of our business.
We only transfer Users' personal data to third parties that we trust. We carefully select our partners to ensure that the User's personal data is processed in accordance with applicable privacy laws. We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not knowingly permit our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.
We may share aggregated data with third parties. The aggregated data in these cases has been compiled from information collected through our services and may, for example, consist of internet traffic or geological location statistics in connection with the use of our services. Aggregated data does not contain any information that can be used to identify individual individuals and is therefore not personal data.
Transfer of personal data outside of the EU/EEA
As our company is based in Luxembourg and not part of a larger group, your personal data is stored and processed within the European Economic Area (EEA).
Certain clients, suppliers and service providers may have personnel or systems located outside of the EEA. In this context, your personal data may be transferred outside the European Economic Area (EEA) for the purposes set forth in this notice, to countries that may not offer a level of protection of personal data equivalent to that offered within the EEA.
Where third parties transfer your personal data outside of the EEA, we will take steps to ensure that your personal data receives an adequate level of protection, including by, for example, entering into data transfer agreements or by ensuring that third parties are certified under appropriate data protection schemes and where adequate safeguards are in place.
You have a right to request a copy of any data transfer agreement under which your personal data is transferred, or to otherwise have access to the safeguards used by contacting us.
Security
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. Only authorized personnel and third-party service providers have access to personal data on a need-to-know basis, and such employees and service providers are contractually obligated to treat such information confidentially.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so. We prioritize personal integrity and therefore actively work to ensure that users' personal data is handled with the utmost care. Therefore, we take steps that can reasonably be expected to ensure that the personal data of Users and other individuals is treated securely and in accordance with this Privacy Policy and the GDPR.
However, data transfers over the Internet and mobile networks can never be done without any risk, therefore, all transfers are made at the personal risk of the person performing them. It is important that Users also take responsibility for ensuring that their data is well protected. It is the User's responsibility to ensure that his/her login data remains secret.
Your rights
In this section, you will find information about the rights you have when we process your personal data. As described below, some of the rights only come into play when we process your personal data under a particular legal basis.
Right to be informed
You have the right to be informed about how we process your personal data. You also have the right to be informed if we plan to process your personal data for any purpose other than that for which it was originally collected.
We provide you with such information through this privacy policy, through updates on our website (see also Section 11 below), and by answering any questions you may have for us.
Right to access your personal data
You have the right to know if we process personal data about you, and to receive a copy of the data we process about you. In connection with receiving the copy of your data, you will also receive information about how we process your personal data.
Right to data portability
You can request a copy of the personal data relating to you that we process for the performance of a contract with you, or based on your consent, in a structured, commonly used, machine-readable format. This will allow you to use this data somewhere else, for example to transfer it to another recipient. If technically feasible, you also have the right to request that we transfer your data directly to another recipient.
Right to be forgotten
In some cases, you have the right to have us delete personal data about you. This is for example the case if it is no longer necessary for us to process the data for the purpose for which we collected it; if you withdraw your consent; if you have objected to the processing and there are no legitimate, overriding justifications for the processing. (For the separate right to object, see below.)
Right to object
You have the right to object to processing of your personal data, which is based on our legitimate interest, by referencing your personal circumstances.
Right to restrict processing
If you believe that the personal data, we process about you is inaccurate, that our processing is unlawful, or that we do not need the information for a specific purpose, you have the right to request that we restrict the processing of such personal data. If you object to our processing, as described just above, you can also request us to restrict processing of that personal data while we make our assessment of your request.
When our processing of your personal data is restricted, we will (with the exception of storage) only process the data with your consent or for the establishment, exercise or defence of legal claims, to protect the rights of another natural or legal person, or for reasons relating to an important public interest.
Right to rectification
You have the right to request that we rectify inaccurate information, and that we complete information about you that you consider incomplete.
Right to withdraw your consent
When we process your personal data based on your consent, you have the right to withdraw that consent at any time. If you do so, we will stop processing your data for the purposes you have withdrawn your consent for. However, it does not affect the lawfulness of processing that was based on your consent before it was withdrawn. The use of this right may also imply that the User will not be able to apply for a specific job or otherwise use our services.
Right to raise a complaint
If you have complaints about our processing of your personal data, you can raise a complaint with the data protection authority in Luxembourg. You can find their contact details here.
You can also lodge a complaint with your national data protection authority, which you can find listed here. if you are based in the EU. If you are based in the UK, you can lodge a complaint with the Information Commissioner’s Office, here.
Update & Contact
We update this privacy policy when necessary - for example, because we start processing your personal data in a new way, because we want to make the information even clearer to you, or if it is necessary to do so in order to comply with applicable data protection laws.
We encourage you to check this page regularly for any updates. This Policy was last updated on 1st March 2025.
The Company undertakes to provide the data subject with information on the measures taken following a request within 1 month of receipt of the request. No payment will be required to provide the information except in the case of manifestly excessive and/or unfounded requests.
If you want to contact us to exercise your rights, or if you have any questions, comments, or concerns about how we handle your personal data, you can reach us by sending an email to us directly at contact@sourceup.lu, or by using the below contact form: