Privacy policy for the job applicant register

1. Data controller

Kaarea Oy (2925981-7)
PL 180, 20101 Turku, Finland
Other contact details: www.kaarea.fi, tel. switchboard +358 20 764 9850

2. Contact person for matters concerning the register

Mirva Keto
Postal address: PL 180, 20101 Turku, Finland
Visiting address: Lemminkäisenkatu 48, 20520 Turku, Finland
Email: mirva.keto@kaarea.fi, tel. switchboard +358 20 764 9850

3. Name of the register

Kaarea’s job applicant register

4. Purposes and legal basis for processing personal data

The recruitment register has been established for the purpose of recruiting employees for Kaarea. Kaarea has the right to use subcontractors to handle the recruitment process. In such cases, personal data may be transferred to subcontractors to the extent necessary for the provision of services (e.g., for the storage of data on a server managed by a third party on behalf of Kaarea).

The processing of personal data is based on the data controller’s legitimate interests, the necessity to perform a contract to which the data subject or the data subject’s company is a party, actions taken at the request of the data subject or their company prior to entering into a contract, or the data subject’s consent for processing personal data for one or more specific purposes. Consent is requested from the applicant at the time they choose to submit their application for processing.

5. Legitimate interests of the data controller or a third party

The controller has a legitimate interest in retaining application data for two years after the application process ends, for example, for the purpose of processing requests for rectification.

6. Data content of the register

Job applicants’ names, contact details (phone number, email address, postal address), information related to job applications and resumes, such as work experience, education, skills, and positions of trust, information related to interviews and tests, and any other information provided by the job applicant. The Kuntarekry system and email server are used for employee recruitment.

7. Regular sources of information

Personal data stored in the register primarily comes from the job applicant. In addition, the information consists of data recorded during the recruitment process. Other sources of information are used within the limits set by law. Providing
personal data is a requirement for job seekers in order to enter into an employment contract.

8. Recipients of personal data

Kaarea’s own personal data processors who require access to personal data to perform their tasks. In addition, data may be disclosed to service providers who process personal data on behalf of Kaarea in accordance with confidentiality obligations and contractual data protection obligations. Personal data may also be disclosed within the limits permitted and required by applicable law, for example to authorities that have the right to access the data.

9. Transfers to third countries and related safeguards

No data will be transferred outside the EU/EEA.

10. Data retention period and applicable retention criteria

The personal data will be stored in the register for two years after the job application has been submitted, after which it will be anonymised.

11. Principles of data protection

Access to the register’s data is restricted to certain individuals to the extent required by their duties. All individuals who use the job applicant register’s data have signed a confidentiality agreement and are bound by confidentiality obligations.

The data processed in information systems is protected from external use by means of information network access rights and user-specific access rights regulations.

Manually processed data is retained under supervision in files or filing systems and stored in locked cabinets with restricted and monitored access.

12. Rights of the data subject

Right of access: In accordance with Kaarea’s privacy policy. Right
to rectification: In accordance with Kaarea’s privacy policy. The
data subject may, at any time and on grounds relating to their particular situation, object to the processing of personal data concerning them. Requests for objection must be addressed in writing to the contact person for the register.

13. Automated decision-making and profiling

The register does not involve automated decision-making. The recruitment process involves an assessment of the personal characteristics of job applicants and therefore includes profiling.