Privacy Notice for Employer Branding and Recruitment
Nordic Group Master - Sweden, Denmark, Norway and Finland
At Nobina Group, we manage employer branding and recruitment through our career site (the "Career Site") and related recruitment and applicant tracking systems. This Privacy Notice explains how personal data is processed in connection with recruitment activities in Sweden, Denmark, Norway and Finland.
Country-specific requirements are set out in Section 12. Where national law imposes stricter or additional requirements, those requirements apply in addition to this Privacy Notice.
This Privacy Notice applies if:
• you visit our Career Site (a "Visitor");
• you connect with us through the Career Site, create a profile and receive information about current or future job opportunities (a "Connected Candidate");
• you apply for a position through the Career Site or a third-party service (an "Applying Candidate");
• we identify your professional profile through permitted external sources because it may be relevant to current or future job opportunities (a "Sourced Candidate");
• we receive information about you from our employees or recruitment partners because they believe your profile may be relevant to current or future job opportunities (a "Referred Candidate"); or
• a Candidate lists you as a reference (a "Reference").
When we use the term "Candidate", we mean Connected Candidates, Applying Candidates, Sourced Candidates and Referred Candidates, unless otherwise stated.
1. About the processing of personal data
Personal data means any information that can be linked, directly or indirectly, to an identifiable individual. Examples include a name, email address, telephone number, professional history and IP address. Processing means any operation performed on personal data, including collection, creation, use, analysis, sharing, storage and deletion.
The main data protection framework for the processing described in this Privacy Notice is Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR"), as applicable in the EU/EEA together with relevant national legislation.
Who is the data controller?
Generally, the Nobina Group company that advertises the position, receives your application or otherwise conducts the recruitment process (the "Hiring Entity") is the data controller for that recruitment processing. The relevant Hiring Entity should be identified in the job advertisement, application flow or other recruitment communication.
Certain recruitment services, systems and Group functions may be provided centrally within Nobina Group. Where another Nobina Group company independently determines the purposes and means of a specific processing activity, that company may also be a controller for that activity. You may contact Nobina Group's Data Protection Officer at dpo@nobina.com if you want information about the relevant controller or controllers for your personal data.
2. What personal data do we process?
All individuals
• Device information - If you visit our Career Site, we may collect information about your device, such as IP address, browser type and version, session behaviour, traffic source, screen resolution, preferred language, approximate geographical location, operating system and device settings or usage.
• Technical and statistical data - If you visit our Career Site, we may collect technical and statistical data about your use of the site, such as the URLs you visit and your activity on the site.
• Communication data - We collect and store communications with us, including information you provide in those communications. This may include emails, messages, information added to your account, survey responses and, where applicable and lawful, video recordings.
• Contact details - Such as your name, email address, telephone number and postal address.
Candidates
• Interview, assessment and recruitment-process data - Such as notes from interviews, assessments and tests, salary expectations and other information generated during the recruitment process.
• Information in your application - Such as your CV, cover letter, work samples, references, letters of recommendation and education details.
• Information in your public professional profile - Subject to applicable national law and Section 12, this may include professional information available from sources such as LinkedIn or the website of your current employer.
• Information provided by references or referral sources - Information received from people you have listed as references, or from employees, partners or recruitment service providers who refer you to us.
3. Where do we obtain your personal data from?
All individuals
• From the Career Site. If you visit the Career Site, we collect technical and statistical information about how you use it, as well as information from your device.
• Directly from you. Most information we process about you is obtained directly from you, for example when you apply for a position, create or update a profile, connect with us, communicate with us or participate in a recruitment activity. You may choose not to provide certain information, although some information is necessary for us to process an application or provide a requested service.
References
• From the Candidate. If a Candidate lists you as a reference, we receive your contact details from the Candidate so that we can contact you.
Candidates
• From public or professional sources. Subject to applicable national law and Section 12, we may collect professional information about you from publicly available sources such as LinkedIn or an employer website. Where consent is required before collecting information from another source, we will obtain that consent.
• From referral sources. We may receive information about you from employees or partners, including recruitment service providers, when they believe your profile may be relevant to current or future vacancies.
• From your references. If you provide references, we may collect information about you from those references.
• Data created during the recruitment process. We may create information about your application and profile ourselves or together with you during the recruitment process, for example interview notes and assessment results.
4. For what purposes do we process personal data?
Protect and enforce rights and interests, including in connection with legal claims.
Individuals concerned: persons connected with the relevant legal matter.
Data used: any relevant categories described in Section 2.
Share personal data with recipients for the purposes described in Section 5.
Individuals concerned: depends on the purpose of the disclosure.
Data used: any relevant categories described in Section 2.
Collect information about use of the Career Site through cookies and similar technologies, as described in our Cookie Policy.
Individuals concerned: Visitors.
Data used: Device information.
Maintain, develop, test and secure the Career Site and recruitment systems.
Individuals concerned: Visitors and, where relevant, Candidates.
Data used: Device information; Technical and statistical data; relevant account or security data.
Analyse use and performance of the Career Site and its content to generate statistics and improve operations.
Individuals concerned: Visitors.
Data used: Device information; Technical and statistical data.
Provide updates about job opportunities and maintain candidate connections or talent-pool relationships.
Individuals concerned: Connected Candidates.
Data used: Contact details; Communication data; profile information.
Review and assess profiles and applications, manage recruitment processes and communicate with Candidates.
Individuals concerned: Applying Candidates; Connected Candidates.
Data used: relevant categories described in Section 2.
Identify and evaluate professional profiles on our own initiative, where permitted by applicable law, and communicate with potential Candidates.
Individuals concerned: Sourced Candidates; Referred Candidates.
Data used: relevant professional, contact and communication data.
Contact Candidates about specific current or future job opportunities.
Individuals concerned: Candidates.
Data used: relevant contact, profile and recruitment data.
Record interviews were specifically agreed and lawful.
Individuals concerned: Candidates.
Data used: Communication data, including recording content.
Invite Candidates to participate in recruitment-related surveys.
Individuals concerned: Candidates.
Data used: Contact details and relevant communication data.
Contact References and evaluate information they provide about a Candidate.
Individuals concerned: References and relevant Candidates.
Data used: Contact details; Communication data; relevant reference information.
5. Who do we share your personal data with?
Our service providers. We share personal data with suppliers that provide services or functionality used in our employer branding and recruitment process, such as recruitment service providers, assessment providers and the provider of the Career Site or applicant tracking system. They may process personal data on our instructions or, where applicable, as independent controllers for their own processing.
Other Nobina Group companies. We share personal data within Nobina Group where this is necessary to provide central systems, recruitment support, Group functions or to consider a Candidate for relevant opportunities, subject to the applicable legal basis and access controls.
Companies providing cookies or similar technologies. If you consent where required, third parties may place cookies or similar technologies on the Career Site and process data in accordance with their own privacy information. More information is available in our Cookie Policy.
Authorities and other public bodies. We disclose personal data where we are legally required to do so.
Parties involved in legal proceedings. Where necessary to establish, exercise or defend legal claims, we may disclose personal data to public authorities, courts, advisers or other relevant parties.
Parties to corporate transactions. In connection with a potential merger, restructuring, financing, sale of assets or acquisition of all or part of a business, personal data may be shared with relevant parties subject to appropriate confidentiality and data protection safeguards.
6. What legal basis do we rely on to process your personal data?
We rely on one or more legal bases under the GDPR, depending on the processing activity and the country in which the recruitment takes place. The main legal bases are:
• Legitimate interests - for processing that is necessary to recruit suitable employees, manage and improve recruitment processes and systems, secure the Career Site, prevent misuse, maintain appropriate records of recruitment decisions, and establish, exercise or defend legal claims. Before relying on legitimate interests, we assess whether our interests are overridden by your rights and interests.
• Steps at your request prior to entering an employment contract - where processing of information you provide in an application is necessary to take steps in response to your application and prepare for a possible employment relationship.
• Consent - where processing is optional or where consent is required by law. This may include maintaining your profile for future opportunities, recording an interview, or collecting information from sources other than you where national law requires consent. You may withdraw consent at any time. Withdrawal does not affect processing already carried out lawfully before withdrawal.
• Legal obligation - where processing is necessary to comply with an obligation under applicable law.
Country-specific rules may affect which legal basis is available for a particular activity. See Section 12.
7. When do we transfer personal data outside the EU/EEA, and how do we protect it?
We aim to process personal data within the EU/EEA. However, some service providers or recipients may process personal data in countries outside the EU/EEA, including where a provider, parent company or subcontractor is established outside the EU/EEA.
Where personal data is transferred outside the EU/EEA, we use a transfer mechanism recognised under the GDPR, as applicable. These mechanisms may include:
• an adequacy decision adopted by the European Commission, including transfers to organisations covered by an applicable adequacy framework;
• the European Commission's Standard Contractual Clauses; and
• other lawful transfer mechanisms permitted under the GDPR, where relevant.
We also implement appropriate technical and organisational measures based on the circumstances and risks of the transfer. You may contact us for more information about the transfer mechanisms and safeguards relevant to your personal data.
8. How long do we retain your personal data?
We retain personal data only for as long as necessary for the purposes for which it was collected, considering applicable law, documented retention schedules and the need to establish, exercise or defend legal claims. Country-specific requirements may result in different retention periods.
All individuals
Where personal data is processed to protect or enforce rights or to manage a legal matter, it may be retained until the relevant matter, and any applicable limitation period have been resolved.
Visitors
We may retain relevant technical and security data from the Career Site for up to one (1) year for security purposes. Cookie retention periods are described in our Cookie Policy. Analytics data is retained only for as long as necessary for the relevant analytics purpose.
Candidates
Personal data used for a specific recruitment process is retained for no longer than necessary to complete and document that process and, where justified, to manage potential complaints or legal claims. The applicable period is determined under Nobina's retention schedule and national law.
If you are a Connected Candidate or have agreed that we may retain your profile for future job opportunities, we retain the relevant data for the period stated when you give your consent or until you withdraw that consent, whichever occurs first, unless another legal basis requires limited continued retention for a separate purpose.
If you are hired, information that is needed for the employment relationship may be transferred to the relevant HR records and processed under separate employee privacy information.
References
We retain reference data for no longer than necessary in relation to the Candidate and recruitment process for which you acted as a reference, subject to applicable retention requirements.
9. What rights do you have and how can you exercise them?
Your rights depend on the circumstances and the legal basis for the processing. Subject to the conditions in the GDPR, you may have the following rights:
• Right to information - to receive clear information about how your personal data is processed.
• Right of access - to know whether we process personal data about you and to receive a copy of that data together with relevant information about the processing.
• Right to rectification - to have inaccurate data corrected and incomplete data completed.
• Right to erasure - to request deletion of personal data in circumstances provided by the GDPR.
• Right to restriction of processing - to request that processing is restricted in certain circumstances, for example while the accuracy or lawfulness of processing is being assessed.
• Right to object - to object, on grounds relating to your situation, to processing based on legitimate interests.
• Right to data portability - where the legal requirements are met, to receive personal data you have provided in a structured, commonly used and machine-readable format and, where technically feasible, have it transmitted to another controller.
• Right to withdraw consent - where processing is based on your consent, to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
• Right to lodge a complaint - to lodge a complaint with the competent data protection supervisory authority. Country-specific authorities are listed in Section 12.
To exercise your rights, you can use the Data & Privacy functions available on the Career Site where provided, use your account settings where available, or contact us using the details in Section 10. We may need to verify your identity before responding to a request.
10. Where can you contact us with questions or requests?
For questions about this Privacy Notice, the identity of the relevant Nobina data controller, or the processing of your personal data, and to exercise your rights, you can contact Nobina Group's Data Protection Officer:
Email: dpo@nobina.com
Nobina AB (publ)
Box 6071, 171 06 Solna, Sweden
Telephone: +46 8 410 650 00
11. Updates to this Privacy Notice
We may update this Privacy Notice, when necessary, for example if our processing changes, if we introduce new recruitment functionality, or if changes are required to comply with data protection law. The current version and effective date will be published on the Career Site or otherwise made available to you.
Where changes materially affect how we process personal data, we will provide additional notice where required by law.
12. Country-specific information
This section supplements the general terms above. If there is a conflict between this section and another part of the Privacy Notice, the country-specific rule and applicable national law take precedence for recruitment in that country.
Sweden
For recruitment in Sweden, the GDPR applies together with Swedish supplementary data protection and employment law. Nobina may retain information from a completed recruitment process where this is necessary and proportionate to document the process or manage potential legal claims. If Nobina wishes to retain your profile for future recruitment opportunities, this is handled on the basis stated when you join or consent to the relevant candidate pool.
Supervisory authority: Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) - www.imy.se
Denmark
For recruitment in Denmark, if Nobina wishes to retain an unsuccessful application after the specific recruitment process has ended solely so that the Candidate can be considered for other future positions, Nobina will obtain separate consent for that future-opportunity purpose and will provide information about the relevant retention period. You may withdraw that consent at any time. This does not prevent limited retention under another lawful basis where necessary for a separate purpose, such as documenting the recruitment process or handling legal claims.
Supervisory authority: Datatilsynet - www.datatilsynet.dk
Norway
For recruitment in Norway, the GDPR applies through the Norwegian data protection framework together with relevant national employment and privacy rules. The general principles in this Privacy Notice apply, including data minimisation, purpose limitation, transparency and storage limitation.
Supervisory authority: Datatilsynet (Norwegian Data Protection Authority) - www.datatilsynet.no
Finland
For recruitment in Finland, the Finnish Act on the Protection of Privacy in Working Life applies to job applicants in addition to the GDPR. As a rule, Nobina will collect personal data primarily from you. If personal data is collected from another source, including a public or professional source, Nobina will obtain your consent before collecting the information unless a specific legal exception applies. If information about you has been collected from another source, you will be informed about the information before it is used in decision-making concerning you, as required by Finnish law.
Supervisory authority: Office of the Data Protection Ombudsman - tietosuoja.fi/en
