Last updated: May 11, 2026
Your personal data, collected for recruitment purposes, is processed by ROMA2S France, acting as data controller within the meaning of the General Data Protection Regulation (GDPR).
Company name: ROMA2S France — French simplified joint-stock company (SAS), share capital €5,000.
Registered office: 68 Avenue Louis Bréguet, 85180 Les Sables d'Olonne, France.
Registration: RCS 919 282 301 — Intra-EU VAT number FR48919282301.
Data protection contact: roma2s@gestal-group.com.
ROMA2S is committed to protecting your personal data when you visit our website and throughout the recruitment process, in compliance with the GDPR and the French "Informatique et Libertés" Act.
We apply the following principles:
— Purpose: your data is only used for explicit and legitimate purposes, detailed below.
— Minimisation: we only collect strictly necessary data.
— Limited retention: we only keep your data for as long as needed for these purposes, in line with CNIL recommendations.
When you apply via our site, we collect the following categories of data:
— Identity data: title, last name, first name.
— Contact details: email address, phone number, postal address, city, country.
— Professional background: experience, diplomas, languages, technical skills, certifications, soft skills.
— Documents: CV, cover letter and any attached document in PDF, DOC, DOCX, JPG or PNG format.
— Preferences: geographical mobility, salary expectations, free-text message.
Processing purposes
— Review your application for an open or upcoming position.
— Propose job offers matching your profile and criteria.
— Send you follow-up communications related to your application.
Legal basis
— Pre-contractual measures (GDPR art. 6.1.b): processing is necessary to review your application, at your request, with a view to a potential employment relationship.
— Consent (GDPR art. 6.1.a): you explicitly grant your agreement by ticking the dedicated box on the application form. You may withdraw this consent at any time (see "Your rights" section).
Your data is accessible, strictly within the limits of their duties, to the following persons:
— The Human Resources department of ROMA2S France.
— The line managers of the entity concerned by your application.
— Where applicable, HR subcontractors (website host, email service), bound by a confidentiality agreement.
Transfers outside the EU: no application data is transferred outside the European Union as part of the recruitment process.
Retention period
— During application review: your data is kept for the duration of the recruitment process.
— Unsuccessful application: your data is kept for a maximum of 2 years from the last contact, in line with CNIL recommendations, so that we may later offer you other opportunities. You may object to this retention at any time.
— Successful application: data is integrated into your employee file and kept for the duration of the contract, then according to the legal retention periods applicable to social and tax obligations.
ROMA2S implements appropriate technical and organisational measures to protect your data against loss, unauthorised access or disclosure: HTTPS encryption, validation of uploaded files, CSRF tokens on forms, per-IP submission rate limits, files stored under non-guessable names.
Cookies and local storage
— Session cookie (technical): required for the site to operate (form security, chosen language). No registration needed, exempt from prior consent under article 82 of the French "Informatique et Libertés" Act.
— Local storage (localStorage): used only to save the application form draft in your browser for 7 days. This data is never transmitted to ROMA2S or any third party.
— City → country autocomplete: when you enter your address, your browser queries the public Nominatim (OpenStreetMap) API, hosted in Europe, to suggest matches. Only the entered text is transmitted (no other form data), and usage is governed by OpenStreetMap's privacy policy.
— No advertising or tracking cookies: we use no Google Analytics, no third-party sharing buttons, no advertising networks.
In accordance with the GDPR and the French "Informatique et Libertés" Act, you have the following rights over your personal data at any time:
— Right of access: obtain a copy of the data we hold about you.
— Right to rectification: correct inaccurate or incomplete data.
— Right to erasure ("right to be forgotten"): request deletion of your data, subject to our legal retention obligations.
— Right to restriction: request that processing of your data be temporarily suspended (e.g. in case of dispute).
— Right to object: refuse all or part of the processing of your data on legitimate grounds.
— Right to data portability: receive your data in a structured, machine-readable format, or have it transferred to another controller.
— Right to withdraw consent: where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
How to exercise your rights
Send your request by email to: roma2s@gestal-group.com.
We undertake to respond within one month of receiving the request, in accordance with GDPR article 12. This period may be extended by two months for complex requests.
Proof of identity will only be requested in case of reasonable doubt as to your identity, in accordance with GDPR article 12; it will be destroyed immediately after verification.
Automated decisions and profiling
The processing of your application is not subject to any automated decision-making or profiling producing legal effects concerning you. All selection decisions are made by natural persons.
Complaint to the CNIL If, after contacting us, you consider that your rights are not respected, you may lodge a complaint with the French Data Protection Authority (CNIL) via the online form on cnil.fr.