Balanco Oy Job Applicant Register Privacy Notice
1. Controller’s contact details in data protection matters
| Controller | Balanco Oy, Business ID: 2699983-6 (“Company” or “Controller”) |
| Contact in all data protection matters | The Data Subject may contact the Controller in all matters concerning data protection as follows: Balanco Oy Address: Rubert Huberin tie 16 C, 01510 Vantaa Niia Ylilammi tel. 050 576 0333, tietosuoja@balanco.fi |
2. Personal data collected from job applicants
The Controller collects and processes the following information concerning its job applicants (“data subjects”, “Applicant”):
| Data category | Description | Data source |
| Basic information | For example, name, email address, telephone number, postal address; date of birth, gender, native language and personal identity code | Applicant |
| Job description | For example, description of work duties, nature and duration of employment, working hours and place of work, salary, information related to the commencement of employment | Controller |
| Public applicant information | Information that the data subject has themselves made generally available so that employers can contact them. | Information published by the Applicant in professional Internet services, such as LinkedIn and other similar services, in accordance with the terms and conditions of such services |
| Application information | For example, application and curriculum vitae (CV), photographs, application videos, competence, qualifications, skills, work experience and education, language skills, other special skills, certificates and other information voluntarily provided by the applicant during the recruitment process | Applicant |
| References | Recommendations and other career-related information | Previous employers and other third parties and sources referred to or named by the Applicant |
| Suitability assessments | Personal and suitability assessments and statements by occupational health care regarding the applicant’s ability to work | Controller’s occupational health care, recruitment consultants, other reliable providers of personal and suitability assessment services |
| Recruitment process information | Information on the progress of the recruitment process, such as information about an upcoming follow-up interview or the discontinuation of the recruitment process | Controller |
| Other information | Other information | Applicant |
3. Purposes and legal bases for processing personal data
The purposes and legal bases for processing the personal data referred to in section 2 are:
| Purpose of processing | Data categories processed | Legal basis |
| Proactive search for and contacting of suitable employee candidates | • Public applicant information | Controller’s legitimate interest as an employer (Data Protection Regulation, Article 1, point 6 f)) |
| Assessment of the applicant’s ability to work and suitability for the position applied for, as well as assessment of the possible need for training or other professional development | • Job description • Basic information • Application information • References • Suitability assessments | Applicant’s consent (Act on the Protection of Privacy in Working Life, section 13) |
| Assessment, on the basis of credit information, of the reliability of an applicant selected for a position requiring particular reliability | • Basic information • Job description • Credit information | Controller’s legitimate interest based on the relationship between the job applicant and the Controller (Data Protection Regulation, Article 1, point 6 f), Act on the Protection of Privacy in Working Life, section 5a) |
| Assessment and comparison of applicants and selection of an employee, management of the recruitment process and other measures related to the recruitment process | • All information defined in section 2 | Controller’s legitimate interest based on the relationship between the job applicant and the Controller (Data Protection Regulation, Article 1, point 6 f)) |
| Fulfilment of the rights and obligations of the applicant and the Controller, e.g. rights and obligations concerning equality between women and men, non-discrimination and protection of privacy | • All information defined in section 2, if necessary for fulfilling the obligations in each case | Compliance with obligations laid down in the Act on Equality between Women and Men, the Non-Discrimination Act and other applicable law, Data Protection Regulation, Article 1, point 6 c) |
4. To whom data is disclosed for transferred
Data is not disclosed to external parties without the consent of the data subject, except where it is necessary for the Controller to fulfil its statutory obligations, in connection with legal proceedings, at the request of authorities or as part of business arrangements.
The Controller has the right to use subcontractors in the processing of personal data in accordance with this privacy notice. In such cases, personal data may be transferred to subcontractors to the extent necessary for the provision of the subcontractor’s services. The Controller uses subcontractors for the following tasks:
- HR, recruitment and suitability assessment services
- ICT: IT infrastructure, information security and user management, electronic communication services
Subcontractors process personal data on behalf of and for the account of the Controller in accordance with the Controller’s instructions. Subcontractors are bound by agreements concluded with the Controller concerning the processing of personal data, including terms concerning confidentiality and information security.
Personal data may also be transferred for processing in a country outside the EU/EEA. Unless the European Commission has decided that the level of data protection in the country of processing is acceptable, the Controller ensures appropriate data protection by concluding written agreements with subcontractors using the standard contractual clauses approved by the European Commission or another lawful procedure. The standard contractual clauses are available on the European Commission’s website.
5. Principles of register protection and data retention period
Access to the system containing personal data is permitted only to supervisors performing recruitment-related tasks, employees of human resources administration and the Controller’s subcontractors who, by virtue of their work, have the right to process the information in this register.
Manual material is stored in locked premises corresponding to the level of protection required for the data. Personnel and subcontractors processing the data are bound by confidentiality obligations. The protection of electronically stored data is based on access rights management, technical protection of databases and servers, physical protection of premises, access control, protection of data communications and data backup. Access by persons processing the data to the electronic content of the register is protected by personal user IDs and passwords. Access and processing rights to the data are granted on the basis of work duties.
Personal and suitability assessments and occupational health care statements are stored separately from other information.
Information concerning selected job applicants is retained as part of employment information.
The personal data of other job applicants is retained after the recruitment decision for as long as necessary to complete the rights and obligations related to recruitment, however for at least two years from the recruitment decision (limitation period for a discrimination action based on the Act on Equality between Women and Men).
Data may also be retained for other possible recruitment needs of the Controller in accordance with the consent given by the data subject.
6. Right of access, rectification and other rights of the data subject
The data subject has the right to access the data concerning themselves stored in the personal data register and to request the rectification or deletion of inaccurate, outdated, unnecessary or unlawful data. The data subject also has the right at any time to withdraw consent previously given for the processing of their personal data. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal of consent.
If the data subject has provided their personal data to the Controller and the processing is based on consent or a contract, they have the right to receive this data in a structured, commonly used and machine-readable format and the right to transfer the data to another Controller in accordance with applicable legislation.
Where the processing of personal data is based on legitimate interest, the data subject has the right to object to the processing of their data on grounds relating to their particular personal situation. In connection with the request, the data subject must specify the particular situation on which the objection is based.
In situations defined by law, the data subject may request restriction of the processing of their personal data, for example complete or partial suspension where, in the data subject’s opinion, there is uncertainty regarding the accuracy of the data or its processing.
Requests must be submitted in person, by letter or by email using the contact details set out in section 1. If necessary, the Controller may ask the data subject to specify their request in writing and to prove their identity.
The data subject has the right to lodge a complaint concerning the processing of personal data with the Data Protection Ombudsman.