Protection of strategic information belonging to our clients and NexaRH.
10.1 Scope and Issues
NexaRH does not directly process individual HR data in its usual mandates. However, we regularly hold highly strategic and sensitive information: technology roadmaps, HR process maps, organizational diagnostics, budgets, system acquisition plans, and internal audit results.
The non-disclosure of this information between clients is an absolute obligation. A client must never benefit, even indirectly, from another client's information.
10.2 Information Classification
-
Confidential (red): Information relating to a specific client: deliverables, diagnostics, exchanges, pricing data. Access strictly limited to the client's project team.
-
Internal (orange): NexaRH proprietary methods, tools, knowledge bases, business information. Access for NexaRH team only.
-
Unclassified (green): Generic, public or anonymized information that can be freely shared.
10.3 Non-Disclosure Obligations
Every member of the NexaRH team and every subcontractor must sign a Non-Disclosure Agreement (NDA) before any access to a client's information.
These obligations:
-
Persistent after the end of the mandate or collaboration (duration: minimum 3 years, depending on the jurisdiction).
-
They prohibit any use of a client's information to prepare a mandate with a direct competitor.
-
They cover digital, paper, verbal and all other media formats.
10.4 Compartmentalization between Mandates
NexaRH applies an informal separation principle: no deliverable, no tool specifically developed for a client, no information from a mandate can be reused in a competing context without complete anonymization.
10.5 Information Sharing and Operational Rules
-
No files containing customer information should be sent by email. Use only the secure collaborative spaces approved by NexaRH (see Policy 9).
-
Working documents containing customer information must be deleted from local devices after each mandate.
10.6 Shelf Life
Client deliverables and documents are kept for 5 years after the end of the mandate, then securely destroyed, unless otherwise required by law (Law 25, GDPR, applicable tax legislation).