Key Definitions

Capitalised terms not otherwise defined in this Notice have the following meanings:

Personal Data means any information relating to an identified or identifiable living individual.

Sensitive Personal Data means any information relating to an individual’s racial or ethnic origin, political opinions, religious or other beliefs, trade union membership, criminal records/history or processing of genetic data or biometric data, data concerning health or data concerning a natural person’s sex life or sexual orientation. Depending on the country you are based sensitive personal data may also refer to personal information that, once leaked or illegally used, may cause harm to natural persons, including but not limited to information on specially designated status, financial accounts, individual location tracking, as well as the personal information of minors or information on social security, driver’s license, state identification, and passport numbers, precise geolocation, combination of email address, debit card, or credit card with security or access code, password, or other credentials allowing access to financial account.

Processing means the use of personal data including collection, recording, organization, structuring, adaptation or alteration, analysis, retrieval, consultation, providing or blocking access (including remote access) to, disclosure, dissemination, aligning, copying, transfer, storage, deletion, hosting, combination, destruction, disposal, or other use or handling of personal data.

Data Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. In our company, the ultimate data controller is Natura & Co., our holding company.

Job Candidate means an individual who have applied to be full or part-time employee of Natura &Co Group of Companies, including apprentices, student trainees, interns and trainees, and temporary workers (also referred to as “you”).

Third Party means any natural person or legal entity, public authority, agency or any other body other than Data Subject, Data Controller, any vendor, supplier or service provider who solely or jointly process personal data on behalf of the Data Controller and acts on the Data Controller’s instructions.

Data Subject means the identified or identifiable living individual to whom the Personal Data relates.

Natura &Co Group of Companies means Avon, Natura Cosmeticos, Natura &Co Pay and The Body Shop and the full listing can be found here

Personal Data we collect and process

We collect, store, and process your Personal Data in a number of ways, including when:

• You disclose to us such Data in the context of your application, including applications sent by job application platforms;
• We obtain such Data from recruitment agencies with which we engage;
• We obtain such Data through publicly accessible, professionally used and lawfully obtained social media for maintaining existing and making new business contacts.

In certain cases, we may also receive relevant Personal Data from risk management service providers which support us, to the extent necessary and legally permitted, in carrying out a pre-employment compliance check of your suitability for the desired position.

Categories of Personal Data	Examples of Personal Data
Basic Personal Data	Name, title, gender, address, e-mail, telephone number, address, date of birth.
Sensitive Personal Data	Disability, ethnicity, social Security, driver’s license, state identification, and passport numbers, precise geolocation, and any information relating to an individual’s racial or ethnic origin, political opinions, religious or other beliefs, trade union membership, or processing of genetic data or biometric data, data concerning health or data concerning a natural person’s sex life or sexual orientation.
Educational background Data	Information on education and professional training, skills, qualifications, certificates, language skills.
Professional background Data	Desired position, any professional membership(s), experience and work history, references provided by previous employers, current and/or historical compensation data and/or compensation expectations.
Immigration Data	Information about your right to work and copies of proof of right to work documentation.
Background check Data (only if applicable/required for the position)	National ID information, identification documentation, driving license, or other background check documentation, verification of your information on reported address, educational qualifications, financial circumstances, screening against relevant sanctions, terror and negative lists.

 

Please note that you are neither under any contractual nor legal obligation to provide us with your data. However, we may not be able to fully process your application if you do not provide the data necessary to process your application.

Recruitment of job candidates: we collect and process any Personal Data that you have published via job application platforms or publicly accessible and professionally used social media platforms, in order to contact you with regard to suitable job vacancies or upcoming opportunities. The legal basis for processing your Personal Data in this regard depends on the country you are based. Usually, it will be the necessity of the processing to safeguard our legitimate interest (where applicable and depending on the country you are based) in recruiting suitable job applicants for our company and making them aware of suitable roles, or otherwise as permitted by law.

During your job application: we process your Personal Data in the context of your application only to the extent necessary for the processing of your application (including if applicable performing pre-employment compliance checks) and for the decision on establishing an employment relationship with you. The legal bases for processing your Personal Data in such context will depend on the country you are based. Usually, it will be:

• The necessity of the processing for the decision on establishing an employment relationship with you, as well as to implement an employment relationship, where applicable;
• To comply with statutory and/or regulatory requirements and obligations, such as equality and immigration legislation;
• If necessary for pre-employment compliance checks, we may ask for your prior consent before processing your Personal Data, depending on the country you are based. You are free to refuse giving consent without any effect on your application process. If necessary, we may ask you in this case for further evidence enabling us to perform a full pre-employment compliance check.

If an employment relationship is established with you: we will include your relevant Personal Data obtained during your job application process in our personnel database and process it in accordance with our internal Global Privacy Notice for Associates, which will be shared with you during the onboarding process.

If no employment relationship is established: we will store your Personal Data for a period of 6 months after the end of the application process. The legal basis for storing the Personal Data will depend on the country you are based. Usually, it will be the necessity of the processing to protect our legitimate interests (where applicable and depending on the country you are based) in the establishment, exercise or defense of legal claim, or as otherwise permitted by law.

If we have received your application via a recruitment agency: we may further store limited Personal Data (in particular your name, the channel via which we received your application and the date of your application) for an additional 6 months (12 months in total after the end of the application process), to the extent necessary to be able to meet our contractual obligations to pay a recruitment fee to the recruitment agency in the event of a possible reapplication and recruitment of you within 12 months of your first application. The legal basis for storing the Personal Data will depend on the country you are based. Usually, it will be the necessity of the processing to protect our legitimate interests (where applicable and depending on the country you are based) in fulfilling our contractual obligations to recruitment agencies, or as otherwise permitted by law.

We may also contact you to ask if you would like to have your Personal Data recorded in a job applicant pool, always at your express consent, so that we can contact you again when filling any future vacancies aligned to your experience.  In this case, we will store your Personal Data in the job applicant pool in accordance with our retention periods determined as per the legal requirements in the country you are based.

Where you are asked to provide Personal Data for the purpose of monitoring equal opportunities (including Sensitive Personal Data), this will be voluntary and on the basis of your consent, unless a legal requirement to which we are subject requires us to collect this data.

How long we store your Personal Data

We store your Personal Data for the purposes stated in this Notice. To the extent storage of your Personal Data is no longer necessary for these purposes, your data will be deleted, unless your data is required for other purposes set out in this Privacy Notice, or further storage is mandatory by applicable laws and/or necessary to fulfil legal or regulatory obligations or to protect our legitimate interests (where applicable depending on the country you are based), including the establishment, exercise, or defence of any existing or potential legal claims. Our retention periods are being determined as per the legal requirements of the country you are based.

4 How we may share or transfer the data we collect

We may share your personal information with other companies in the Natura &Co group (for more information see https://naturaeco.com/); suppliers providing services to us in order to help us run our business, improve our services and the job applicant and employee experience; and government authorities. We use appropriate safeguards to protect personal information which is transferred to countries outside of the European Economic Area which are considered to provide a lower level of protection for personal information. European Commission-approved Standard Contractual Clauses and other legally acceptable transfer mechanisms are in place with our email system provider and IT support and IT system maintenance suppliers.
Where considered appropriate, personal information may be sourced from third parties to complete pre-employment background checks, and we will inform you in advance if we will carry out such checks on you. Any sharing of your personal information will be for the purposes set out above at paragraph 3 (including the engagement of third party service providers, who may act as controllers of your personal information) or to comply with specific legal obligations to which we are subject.

How we share and disclose your Personal Data

Your Personal Data will be kept strictly confidential and disclosed internally only to:

• The departments/employees that need to process your Personal Data for handling your application;
• To affiliated companies of the Natura &Co Group – to the extent necessary due to any international team and matrix structures, as well as the use of group wide integrated centralized HR functions and systems;
• To external service providers, for example providers of IT services (such as technical service providers for storing your data) and compliance review, who have been carefully selected and are contractually bound in accordance with applicable data protection legislation.
• Law enforcement and other government authorities. To do so, the authority requires an appropriate judicial order or warrant, for which they need to demonstrate that the disclosure of the requested or intercepted information is We reserve the right to challenge these requests.

We may share or transfer your Personal Data in the course of any direct or indirect reorganization process including, but not limited to, mergers, acquisitions, divestitures, bankruptcies, and sales of all or part of our assets. Your Personal Data may be shared following the completion of such transaction and/or during the assessment processing pending transfer (subject to confidentiality requirements). If transferred, your Personal Data will remain subject to this Privacy Notice or a policy that, at a minimum, protects your privacy to an equal degree as this Privacy Notice unless you otherwise consent.

International Data Transfers: We may transfer your Personal Data to our affiliates and subsidiaries or to other third parties, in accordance with applicable local law, depending on the country you are based. We may also transfer your Personal Data from your country or jurisdiction to other countries or jurisdictions in accordance with legal requirements.

• For international data transfers subject to EEA, UK and Swiss Law we primarily use European Union Commission Standard Contractual Clauses.
• For transfers between other jurisdictions, we may rely on other legal mechanisms for international transfers, as appropriate under the relevant law.
• We have also concluded and executed an Intra-Group Agreement to ensure safe and lawful transfers of personal data take place among entities within the Natura &Co Group of Companies and among different countries around the world, where such transfers are necessary in the course of business.

We carry out Transfers Impact Assessments to implement supplementary measures to ensure your Personal Data is processed under the standards that apply to your territory.

Your Sensitive Personal Data will not be used for any additional purposes that are incompatible with the purposes listed above unless we provide you with notice of those additional purposes.

We do not sell your Personal Data or your Sensitive Personal Data, nor do we share it with third parties for cross-context behavioural advertising.

How we protect your Personal Data

We implement comprehensive technical, physical and organizational measures to ensure a level of security appropriate to the risk to the personal data we process and to ensure compliance with applicable legal requirements. These measures are aimed at safeguarding the ongoing integrity and confidentiality of personal data. We evaluate and improve these measures on an ongoing basis.

Your rights in relation to the processing of your Personal Data

Depending on the country in which you are based, you may have some or all of the following rights:

• To obtain information on your Personal Data processed and to obtain a copy of such data (right of access);
• To obtain the rectification of any inaccurate data and, having regard to the purposes of the processing, the completion of incomplete data (right to rectification) (please let us know if and to what extent your data stored by us has changed, so that we can rectify or update the respective data);
• If there are legitimate reasons, to request the deletion of your data (right to erasure);
• To request the restriction of the processing of your data, if the legal requirements are met (right to restriction of processing);
• To withdraw your consent at any time, if the data processing is based on consent, provided that such withdrawal does not affect the lawfulness of the previous processing of your data (consent withdrawal);
• If the legal requirements are met, to receive the data provided by you in a structured, commonly used and machine-readable format and to transfer this data to another controller or, if technically feasible, to have it transferred by us (right to data portability); and
• Not to be subject to a decision based solely on automated processing which produces legal effects concerning you or significantly affects you in a similar way, if the legal requirements are not met, although please note that in the job application context, an automated decision-making process is not carried out by us (not to be subject to automated processing).
• To object, where applicable law provides, to the processing of your data (right to object):
• which is being processed for the purposes of our legitimate interests (where applicable and depending on the country you are based) unless such interests outweigh your individual rights and/or
• for direct marketing purposes, without any special reason.

In order to exercise your rights, including the withdrawal of your consent, please contact us here privacy@naturaeco.com .You may also designate an authorized agent to make a request on your behalf. In order to protect your data from unauthorized access or alteration by third parties, all requests regarding your personal information will be subject to verification of the identity of the requesting individual.  We endeavour to respond to a verifiable request within required time frames.

A Data Subject who feels that we are not adhering to this Notice or applicable data protection laws with respect to his or her Personal Data may contact us to register a complaint; submit requests for exercising rights; or address any other issue arising under this Notice. Complaints by any person may also be referred to the DPO team by email here.

Without prejudice to any other remedies, you also have the right to lodge a complaint with a supervisory authority at any time.

Changes we make

We may update this Notice periodically and will revise the date at the bottom of this Notice to reflect the date when such update occurred. If we make any material changes in the way we collect, use, and/or share the personal information that you have provided, we will endeavour to provide you with notice before such changes take effect, such as by posting prominent notice on the Company website.

In the event of any difference in interpretation or meaning between the English version and any other translation of this Privacy Notice, the English version shall prevail. Please see the English version of this Privacy notice here.

Effective Date, April 2023