Privacy Notice – Job Applicants
Data protection for employment seekers
1. Data Controller
VividWorks Oy (business ID 2012897-6) on behalf of itself and the companies belonging to the same group with it from time to time (hereinafter VividWorks)
Sepänkatu 20, 4th floor
FI-90100 Oulu, Finland
Tel. +358 290 800 810
2. Contact Information of the Data Protection Officer
Data protection officer of VividWorks
Sepänkatu 20, 4th floor
FI-90100 Oulu, Finland
In case of questions related to the processing of personal data and situations related to the exercise of the data subject’s rights, the data subject must contact the above [person / address] in writing.
3. Name of the Register
Recruitment and job application register
4. Purpose of and Legal Bases for Processing Personal Data
Personal data are processed for receiving and processing job applications, selecting job applicants and fulfilling the needs related to the recruitment process.
The processing of personal data is based on VividWorks’ legitimate interest to process personal data as required by the recruitment process in a relevant connection between VividWorks and the job applicant. In certain cases, the processing of personal data is also necessary for carrying out measures preceding the entering into an employment agreement between VividWorks and the job applicant and performing the employment agreement.
5. Data Content of the Register
- name
- date of birth
- address
- telephone
- e-mail address
- basic education and degrees with the dates of completion
- other completed education
- skills in using applications and software
- special skills
- language skills
- current duties (employer, title and job description)
- principal prior duties (employer, title and job description)
- referees
- other data disclosed by the job applicant to VividWorks
6. Regular Sources of Data
Personal data are collected from the data subject himself/herself via the job application form submitted online or the paper job application form (including attachments). Personal data can also be collected from the data subject’s referees.
7. Disclosure and Transfer of Data
As a rule, personal data are not disclosed outside VividWorks. Personal data can be disclosed, within the limits permitted and required by the legislation in force from time to time, e.g. on behalf of VividWorks to business partners carrying out debt collection as well as to parties that have the right to obtain data in accordance with the legislation, or if the establishment, exercise or defence of a legal claim requires that personal data are disclosed. Personal data can also be transferred to VividWorks service providers that process personal data on behalf of VividWorks under the obligation of confidentiality and a binding data processing agreement.
As a rule, data are not transferred outside the European Union’s Member States or the European Economic Area, unless it is necessary for the purposes of the processing of the personal data or the technical implementation of the data processing. In such cases, the requirements of data protection legislation concerning implementing suitable or due safeguards must be complied with, e.g. by using the European Commission’s standard contractual clauses, and otherwise in such a way that the processing of personal data is carried out in accordance with this privacy notice.
8. Storage Period of Personal Data
Personal data are processed during the recruitment process, and they will be stored for a period of 1 year after the recruitment process has been completed. With the consent of the data subject, personal data can also be stored for a period of time mentioned when giving the consent, e.g. for future recruitment processes. If VividWorks and the applicant enter into an employment agreement, the personal data will be transferred to the VividWorks personnel register.
Personal data can be stored for a longer period, if this is necessary to fulfil VividWorks’ obligations under acts, decrees or any other authority sources.
9. Protection of the Register
The databases and data networks used for the processing of personal data are protected by technical and organisational measures.
The manually maintained data sets are stored in locked premises to which only appointed persons who have signed a confidentiality agreement have access.
The electronically processed data included in the register are stored in a centralised manner in a locked and monitored data center which is protected with a firewall and other technical means. Only designated persons who have signed a confidentiality agreement have access to the data. These persons are required to use their individual user ID and password when logging into the system.
10. Rights of the Data Subject
Right to access data concerning you
The data subject has the right to obtain confirmation from VividWorks of whether personal data concerning him/her are processed and to know what personal data concerning him/her are stored in the register. The data subject has also the right to obtain a copy of the personal data being processed. The access request must be sent to VividWorks in accordance with Section 2, and it must be in writing and signed. The access request can also be made in person at a VividWorks office. The access request can be declined based on the grounds provided by law. The exercise of the right of access and the provision of a copy are usually provided free of charge; however, VividWorks may charge a reasonable fee based on administrative costs of taking the action requested, if the data subject requests copies repeatedly or the requests are manifestly unfounded or excessive.
Right to request rectification, erasure or restriction of processing of personal data
VividWorks will rectify, erase or complete any personal data in the register that is inaccurate, unnecessary, incomplete or obsolete for the purpose of the processing, either on its own initiative or at the request of the data subject (the data subject can contact VividWorks in accordance with Section 2). The data subject has also the right to demand VividWorks to restrict the processing of his/her personal data, for example, in a situation where the data subject is waiting for VividWorks’ response to the request concerning the rectification or erasure of the data.
Right to object to the processing of personal data in certain cases
The data subject has the right to object, on grounds relating to a particular personal situation, to processing of personal data by which VividWorks’ based on VividWorks’ legitimate interest. In that case the data subject should contact VividWorks in accordance with Section 2 and specify the grounds on which he/she objects to processing. VividWorks can deny the request on the grounds provided by law.
Right to withdraw consent
If personal data are processed based on the data subject’s consent, the data subject has the right to withdraw his/her consent by notifying VividWorks in accordance with Section 2.
Right to data portability
To the extent that the data subject has provided data to the register to be processed in order to perform a contract between VividWorks and the data subject or based on a consent given by the data subject, the data subject has the right to receive this data in a structured, commonly used and machine-readable format and has the right to transmit those data to another controller (if this is technically feasible).
Right to lodge a complaint with a supervisory authority
The data subject is entitled to lodge a complaint with the competent supervisory authority if VividWorks has not complied with the data protection regulations applicable to its operations.