This privacy policy describes how we, Purmo Group Oy Ab, as the legally responsible data controller collect and process the personal data of our job candidates.
In case you have any questions or wish to exercise your rights in respect of your personal data, you may contact us at: [email protected].

The personal data we collect and process

We collect the following personal data concerning persons applying for a job with us or who we are recruit-ing:

Information you give us. When you apply for a job with us, we collect and process the personal information you give us as part of your job application, cv or resume, and your answers as part of interviews (which we may note down for our records).

Information obtained elsewhere. Generally, we base our hiring decisions on information you give us. In some cases, however, we may also obtain information about you from third parties, where applicable law permits this. This may include, e.g., credit checks, use of outside aptitude testing providers, contacting the persons you have designated as references, and the like.

If we obtain information from you from elsewhere, we will inform you of this separately. We will allow you to comment on such information obtained from third parties before making any decisions based on the infor-mation.

If you are selected for a job with us, we may ask you for further information to be used in setting up the employment relationship; we will inform you separately about how we use such employment-related infor-mation. If you visit our websites, e.g., to look up information about us as a prospective employer, certain information about you might also be collected as part of our ordinary website analytics; please refer to our general customer and marketing privacy policy for information on this.

Purpose and lawful basis for collecting and processing your personal data

Recruitment. We process the above data for the purposes of our legitimate interest to recruit and select appropriate candidates for employment.

Legal claims. We may also process the above information for the purposes of our legitimate interest in de-fending ourselves against legal claims in connection to the recruitment process. This may be relevant, e.g., if someone were to make an allegation that the recruitment process has been unfair or discriminatory or if we had reason to suspect that such an allegation might be made. In some cases, we might also need to use the information to make a claim ourselves (in connection to, e.g., fraudulent materials having been provided to us).

Consent for further retention. In the event we are not able to hire you at a specific point in time, we may also ask for your consent to keep your job application and its supporting materials on file in the event a new opportunity for which you would be suitable arises. You are under no obligation to give such consent, but if you do, we will keep your application on file as agreed.

Consent to get information from third parties. In some cases, we might also ask for your consent to obtain specific information or information from third parties. This might be the case where local law requires asking for your consent to, e.g., conduct an aptitude test or when we collect information from a third party. In these cases, we will inform you and ask for your consent separately.

We do not use your personal data for automated decision making.

Disclosures and transfers of your personal data; international transfers of data

In general, we do not give your information to third parties. In some cases, however, we might need to tell an outside party of your job application, e.g., to book an appointment for an aptitude test, order a credit check, or the like. If you have provided references, we might also contact those references, in which case the relevant person will know that you are seeking employment with us.

Finally, we may also provide your data to service providers acting on our behalf (as so-called data proces-sors). Such service providers include customary IT services providers and companies who provide us, e.g., marketing related services.

We may also use an outside recruiting firm in the recruitment process. The name of any relevant recruitment companies will be made clear to you during the process.

These service providers may in part also operate outside the European Union and European Economic Area (the “EU/EEA”), in jurisdictions where local law may not in itself offer a level of data protection that is equiv-alent to the level offered by law in the EU/EEA. Where we use a service provider that processes personal data outside the EU/EEA, we have generally entered into an agreement with the party in accordance with EU Commission’s model contract clauses that ensure safe data processing in third countries as well. In some limited cases, the international transfer of the data may also be a necessary part of performing our contrac-tual obligations or taking preparatory steps to forming a contract (this might, e.g., be the case where you yourself are an international candidate), in which case use of the model clauses is not required. We also ensure the safe and lawful data processing abroad by other means as well. If necessary, we can give you more detailed information on international data transfers.

Retention periods

We will process and store your personal data only for the period necessary to achieve the purpose of stor-age or as required or permitted under applicable laws. More specifically, we will retain your job application and supporting materials for two years after the relevant candidate is selected (irrespective of who that candidate is). If you are selected for the job, your information may also be retained for longer as part of your personnel records; you will be provided separate information on this if you are selected.

As noted above, we may also ask for your consent to store your job application and supporting materials for a longer time for the event that new a new opportunity for which you would be suitable arises. You are under no obligation to provide your consent, however.

When the mentioned storage period ends, your personal data will either be deleted or anonymised in such a way that it is no longer possible to identify you as an individual based on the data.

Your rights

Under European Union data protection law, you have at least the following rights in respect of your personal data that we collect or process:

• Right of access. You have the right to review the data we have collected on you. We can deny such request only on grounds provided for in applicable law. Exercising this right is generally free of charge.
• Right to request rectification, erasure or restriction of processing. You have the right to request that we rectify erroneous data about you. In some cases, you also have the right to request that we delete the data about you that we have. In some cases, you may also request that we temporarily cease processing your personal data until other related request by you has been dealt with.
• Right to data portability. Where we process your data based on your consent or for the perfor-mance of a contract with you, you also have the right to request that we provide you the data in structured, commonly used and machine-readable format or, in some cases, to have the data transmitted directly to another controller. This right does not apply where we collect or process the data for our legitimate interests (as explained above).
• Right to object. Where we collect and process personal data about you on the basis of our legiti-mate interests (as explained above), you may also object to such processing on the basis of grounds relating to your particular situation. If you object, we may only continue to process the data if we can demonstrate that there are overriding compelling legitimate grounds for the processing.
• Right to object to direct marketing. Nevertheless, you always have the right to object to direct mar-keting. If you object, we will no longer send you such marketing. Where we send marketing based on your consent, you may also withdraw your consent at any time.
• Right to withdraw consent. Where we collect and process personal data about you based on your consent, you may withdraw your consent at any time. Withdrawing your consent does not, however, affect the legality of any data processing measures already undertaken prior to that time.
• Right to lodge a complaint with a supervisory authority: You are entitled to lodge a complaint with the competent supervisory authority if you are of the opinion that we have not complied with our ob-ligations as a data controller.