Applicant Privacy Notice
Applicant Privacy Notice
This privacy notice is aimed to inform how Premix Oy (“Premix”, “company” or “we”) collects and uses your personal data in regard to job applicants, potential candidates for employment and our optional recruiting programs and events, and selection procedures in view of potential recruitment and as part of our recruitment process. It provides you with certain information to be provided under the General Data Protection Regulation ((EU) 2016/679) (GDPR) and the local data protection law.
1 Controller
Premix Oy
Muovitie 4, 05200 Rajamäki
Phone: +358 987 8041
Email: [email protected]
2 Contact person for register matters
Mari Lippojoki
Muovitie 4, 05200 Rajamäki
Phone: +358 44 218 4400
Email: [email protected]
3 Purpose of and legal basis for processing of personal data
The purpose of processing personal data is actions concerning our recruitment and management of the recruitment process as well as the supporting of human resource allocation, managing the data regarding the application process of the applicants who have applied to Premix in order to ensure the possibility to contact them and the decision-making in hiring. If we decide to call you for an interview, we will use the data you provide to us at the interview to decide whether to offer you the role and may take up references and/or conduct other checks.
The processing of personal data is based on:
1) The compliance of the responsibilities and the specified rights of Controller and the applicant in the field of employment law;
2) To decide whether to enter into a contract with you
3) Our legitimate interest to manage the recruitment process and to decide whether to appoint you to the role since it would be beneficial to our business to appoint a suitable candidate to that role.
4) The consent of the applicant regarding the processing of his/her personal
4 Data we process
In connection with this privacy notice we process the following personal data of the applicants:
1. applicant's basic information such as *name, date of birth, gender, native language, username and/or other specifying identifier, password;
2. applicant's contact details such as private e-mail address, private phone number, private home address;
3. information related to the job in question such as job description, including information on the nature and type of employment, the person in charge of the recruitment process, desired salary and details regarding commencement of employment. Further details will be provided in the job advertisement;
4. information related to suitability for the job and other relevant details (background, etc.) that the applicant has provided during the recruitment process, such as photographs, information on education, profession, work history (such as employers, commencement and duration of employment, nature of tasks), language skills, other special skills, a description of personal characteristics, different certificates and appraisals, referees, links to online portfolios, profiles and other sources and references as well as person assessment and combability assessment and other information related thereto, which have been conducted with the consent of the applicant;
5. information regarding progress of the applicant's recruitment process such as upcoming follow-up interviews or recruitment process termination;
6. other possible information wilfully provided by the applicant during the application process or information otherwise published specifically for professional purposes, such as their LinkedIn profile or information collected separately by the controller with the consent of the applicant, including personality and aptitude assessments.
All personal data marked with an asterisk is required in order to carry out the recruitment process.
5 From where do we receive personal data?
The primary source for personal data is the applicant in question. Other sources may be used in accordance with law. If necessary, we may receive data from recruitment consultants. Applicants may also provide personal data of their referees and other person related to the applicant’s previous work history.
By applying for a job, the applicant permits collecting information from his/her public professional profile to the extent that is necessary for deeming the suitability for the job in question.
6 Transferring personal data outside of EU or EEA
We will disclose personal data according to applicable legislation to parties who have a legal and/or contractual right to receive data. We may also disclose personal data for other purposes in accordance with applicable law.
We utilise, when needed, subcontractors working on our behalf to process personal data. Premix Oy is the data processor for personal data within the Company's system and HR support services. Additionally, when needed, we use subcontractors to process personal data for the following services:
- Human resource and recruitment services
- Legal services
- IT system providers
Additional information regarding recipients of personal data can be provided upon request.
We have ensured protection of your personal data by making necessary contracts with the subcontractors regarding data processing.
Your personal data may be transferred outside the European Union and the European Economic Area (“EU/EEA”) to our service providers. In case your personal data is transferred outside EU/EEA, such transfers are either made to a country that is deemed to provide a sufficient level of privacy protection by the European Commission or transfers are carried out by using appropriate safeguards such as standard data protection clauses adopted by the EU Commission or the EU-U.S. Privacy Shield Framework. Additional information can be provided upon request.
7 Protecting and storing personal data
Databases containing personal data are restricted only to employees who have the right to process applicant data for the purposes of their work. Personal data is protected with the necessary technical and organisational precautions. Personal data is stored in databases that are protected with usernames, passwords, firewalls and other technical procedures. All persons processing the data are bound by professional secrecy. In addition, we limit access to your personal data to those employees and service providers who have an actual need-to-know basis regarding the recruitment process.
We will store personal data for as long as is necessary for the purposes described in the notice. As a rule, personal data will be stored maximum two (2) years. If an applicant becomes our employee, we will store information the applicant has provided during the application process as part of their employee profile in accordance to the privacy notice regarding employee data.
We assess the need for the storage of the data regularly, in accordance with the applicable legislation.
8 Your rights as an applicant
Each applicant has several rights under applicable data protection laws. As an applicant you have right to:
• access your personal data processed by Premix;
• obtain a copy of your personal data on request in a structured, commonly used and machine-readable format insofar as the processing is based on contract or consent, and insofar as you have provided personal data to us;
• require us to change any incorrect or incomplete personal data;
• under certain circumstances as set out in the applicable data protection laws, require us to delete or stop processing your personal data;
• object to the processing of your personal data where Premix is relying on our legitimate interests as a legal basis for the processing of your personal data or profiling. Please note that in relation with your request, the particular situation to which the objecting of processing is based, must be specified. We may deny fulfilling the request only based on compelling legitimate grounds. However, you may object to your personal data being used for marketing purposes at any time;
• if the processing of your personal data is based on your consent, you have a right to withdraw your consent at any time (the withdrawal does not affect the process based on consent before the withdrawal);
• under certain circumstances as set out in the applicable data protection law, ask us to restrict processing personal data.
Any requests concerning the matter should be addressed in person or in writing to the contact person listed in section 2.
After receiving all the required information of your request (incl. confirmation of identity), we will start the processing of your request. We will contact you at latest within a period of one month. If your request is denied, you shall be informed about the refusal in writing.
If you believe that Premix has not complied with applicable data protection laws when processing your personal data, you can lodge a complaint with a supervisory authority. In Finland, that is the Data Protection Ombudsman.
This privacy notice has been published on 4th of July 2019.