Privacy notice for job and office applicants

Profinder Privacy Notice for Job and Office Applicants

Last updated 09 April 2020

CONTROLLER AND CONTACT DETAILS

Leadventure Oy, Business ID 2828385-8 (“Leadventure”)

PERSON RESPONSIBLE FOR DATA PROTECTION / DATA PROTECTION OFFICER

Tero Järvinen

Email: tero.jarvinen@profinder.fi
Telephone: +358 50 467 7771

NAME AND PURPOSE OF THE REGISTER

The name of the register is the Leadventure Oy Job and Office Applicant Register.

The processing described in this notice and covered by the register concerns individuals who apply for employment or for the position of CEO or deputy CEO at Leadventure. In this notice, the term “individual” refers to all such natural persons.

Providing personal data to Leadventure in connection with recruitment is voluntary. If a job or office applicant does not wish to provide the personal data required by Leadventure for recruitment, Leadventure cannot consider that individual in the recruitment process.

Purpose and legal bases for processing personal data

Personal data is processed for the following purposes, and the legal bases for processing are as follows:

(a) Recruitment and assessment of qualifications during recruitment. The legal basis for processing personal data for these purposes is the individual’s consent.

(b) Compliance with and exercise of statutory obligations and rights. Processing for these purposes is necessary for compliance with Leadventure’s legal obligations.

(c) Security, information security and access control. Processing for these purposes is necessary for compliance with Leadventure’s legal obligations.

(d) Subject to the conditions laid down by law, personal data may be processed for the establishment, exercise or defence of legal claims, or where processing is necessary to protect the vital interests of the individual or another natural person, or where processing is necessary for the performance of a task carried out in the public interest.

(e) Processing may also be necessary for the purposes of the legitimate interests of Leadventure or a third party. In such cases, Leadventure has assessed that the interests or fundamental rights and freedoms of the individual requiring protection of personal data do not override such interests. In such situations, it is assumed that the individual can reasonably expect such processing.

(f) Where processing is based on the individual’s consent, the individual has the right to withdraw their consent. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Personal data processed

The register contains the following personal data:

(a) Contact and identification data:

first and last names
preferred name
home address
telephone number
email address
gender

(b) Security:

data on entry and exit from premises in connection with interviews or recruitment
data managed within recruitment IT systems concerning system usage by the individual

(c) Data on the individual’s career:

curricula vitae
job applications
education details
employment certificates
professional skills
information on previous employers
references
information on completed degrees or other training
notes from job interviews
performance assessments
reports on suitability assessments

SOURCES OF PERSONAL DATA

Personal data is collected from the individual themselves. Reports on suitability assessments are obtained from the party conducting the assessment. Information may also be obtained from referees, for example by telephone.

RECIPIENTS OR CATEGORIES OF RECIPIENTS OF PERSONAL DATA

Personal data may be transferred or disclosed to the following parties:

(a) Leadventure’s subcontractors, who process personal data only on behalf of Leadventure and only for the purpose of providing services to Leadventure, or who have a statutory right to process personal data. Current subcontractors include:

(i) providers of suitability assessments;
(ii) ICT and similar service and system providers.

(b) Authorities or other parties where required by law.

TRANSFERS OF PERSONAL DATA TO THIRD COUNTRIES

Personal data is not transferred outside the European Economic Area (EEA) or the European Union (EU) (“Third Country”).

RETENTION PERIOD OF PERSONAL DATA

Personal data is retained for the period required by law. Different types of personal data have different retention periods.

As a rule, personal data obtained in connection with recruitment is retained for two years from the date the recruitment decision is made. Retention continues in accordance with Leadventure’s HR privacy notice if the individual has been hired by Leadventure.

METHODS OF DATA PROTECTION

Personal data processed by Leadventure is protected using the following methods and principles:

(a) locks at Leadventure’s premises;

(b) electronic monitoring systems at Leadventure’s premises and on work equipment;

(c) firewall, antivirus and spam filtering systems in Leadventure’s networks, as well as other software and devices protecting network security;

(d) restricted access rights to HR management systems;

(e) required high-quality passwords;

(f) personal access rights that can be tracked in systems;

(g) a limited number of main users;

(h) the professional competence of Leadventure’s personnel;

(i) training of Leadventure’s personnel;

(j) the register is maintained in electronic form, except in temporary exceptional situations; and

(k) Leadventure’s policies and guidelines relating to personal data matters.

Right of access to personal data

The individual has the right to obtain confirmation from Leadventure as to whether personal data concerning them is being processed.

If personal data is processed, Leadventure shall, upon request, provide the individual with a copy of the personal data being processed and the following information:

(a) the purposes of processing;
(b) the categories of personal data concerned;
(c) the recipients or categories of recipients to whom the personal data has been or will be disclosed;
(d) the envisaged retention period;
(e) the individual’s right to request rectification or erasure of personal data or restriction of processing, or to object to such processing;
(f) the right to lodge a complaint with a supervisory authority and the contact details of that authority;
(g) available information on the source of the personal data; and
(h) the existence of automated decision-making based solely on automated processing (such as profiling) that produces legal effects or similarly significantly affects the individual, as well as meaningful information about the logic involved and the significance and consequences of such processing. Profiling refers to automated processing of personal data used to evaluate certain personal aspects relating to an individual, in particular to analyse or predict aspects concerning work performance, economic situation, health, personal preferences, interests, reliability, behaviour or location.

If the individual requests more than one copy of their data, Leadventure may charge a reasonable fee as permitted by law.

Right to data portability

If personal data processing by Leadventure is based on the individual’s consent or on a contract and the processing is carried out by automated means, the individual has the right, upon request:

(a) to receive the personal data concerning them that they have provided to Leadventure in a structured, commonly used and machine-readable format; and

(b) to transmit such data to another controller, where technically feasible.

Right to rectification and right to lodge a complaint

The individual has the right to request that Leadventure rectify inaccurate and incorrect personal data concerning them without undue delay. Taking into account the purposes of processing, the individual also has the right to have incomplete personal data completed, including by providing additional information.

If Leadventure does not take action on the individual’s request, it shall inform the individual without undue delay and at the latest within one (1) month of receiving the request of the reasons for not taking action and of the possibility of lodging a complaint with a supervisory authority and seeking other remedies. The time limit may be extended by up to two (2) months where necessary, taking into account the complexity and number of requests. Leadventure shall inform the individual of any such extension within one (1) month of receiving the request, together with the reasons for the delay. Please note that the matter may also be referred to the Data Protection Ombudsman.

The individual has the right to lodge a complaint with the competent supervisory authority, the Data Protection Ombudsman. The contact details of the Data Protection Ombudsman are: https://tietosuoja.fi/etusivu

Right to object to processing

The individual has the right to object, on grounds relating to their particular situation, to the processing of personal data concerning them where the processing is based on (i) legitimate interests of Leadventure or (ii) the protection of the individual’s vital interests. Leadventure shall no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing that override the interests, rights and freedoms of the individual, or if processing is necessary for the establishment, exercise or defence of legal claims.

Right to restriction of processing

“Restriction of processing” refers to marking personal data so that its processing is limited.

Leadventure shall restrict the processing of personal data at the request of the individual in the following situations:

(a) the individual contests the accuracy of the personal data, for a period enabling Leadventure to verify its accuracy;

(b) the processing is unlawful and the individual opposes the erasure of personal data and requests the restriction of its use instead;

(c) Leadventure no longer needs the personal data for the purposes of processing, but the individual requires it for the establishment, exercise or defence of legal claims;

(d) the individual has objected to processing pending verification whether Leadventure’s legitimate grounds override those of the individual.

In the above situations, Leadventure shall process personal data only:

(a) with the individual’s consent or for the establishment, exercise or defence of legal claims;
(b) for the protection of the rights of another natural or legal person;
(c) for reasons of important public interest of the EU or a Member State; or
(d) for storage of the data.

Right to be forgotten

Leadventure shall erase personal data concerning the individual upon request if one of the following grounds applies:

(a) the personal data is no longer necessary for the purposes for which it was collected or otherwise processed;

(b) the individual withdraws the consent on which the processing is based and there is no other legal basis for processing;

(d) the personal data has been processed unlawfully;

(e) the personal data must be erased to comply with a legal obligation applicable to Leadventure under EU or Member State law.

However, Leadventure is not obliged to erase personal data if processing is necessary:

(a) for exercising the right of freedom of expression and information;

(b) for compliance with a legal obligation or for the performance of a task carried out in the public interest;

(d) for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes; or

(e) for the establishment, exercise or defence of legal claims.

Use of automated decision-making and profiling

Leadventure does not currently use personal data for automated decision-making, including profiling.