Skip to main content

Borenius

Privacy notice for job applicants

1 Introduction

Your privacy is very important to Borenius Attorneys Ltd. With this Privacy Notice, we want to make you aware of how we collect and process your personal data as a data controller. This Privacy Notice describes how we process the personal data of job applicants applying to Borenius.

2 Data controller

Borenius Attorneys Ltd
Eteläesplanadi 2
00130 Helsinki
Finland
Tel:. + 358 20 713 33

Contact Person
GDPR Team
Eteläesplanadi 2
00130 Helsinki
Finland
Email: gdpr@borenius.com.

3 Legal basis and purposes for processing your personal data

We process job applicants’ personal data in accordance with all laws that apply to the protection of personal data, including the GDPR, i.e. the European Union’s General Data Protection Regulation 2016/679 and the Finnish Act on Protection of Privacy in Working Life (759/2004).
Processing of personal data must always be based on a legal basis set forth in the GDPR. For us, processing of job applicants’ personal data is necessary in order to take steps at the request of the data subject prior to entering into an employment contract. We also process job applicants’ personal data in order to fulfil our legal obligations. You may also give your consent for the processing of your personal data for one or more specific purposes. In some cases our processing of job applicants personal data is based on our legitimate interest, such as protecting our property, ensuring and improving data security or the security of premises and data network or preventing and investigating suspected fraud or misuse.
We process job applicants’ personal data for the purposes of recruiting, including receiving and processing applications, conducting personal and aptitude assessments, maintaining our CV database as well as for communication with you, for instance, when informing you whether you were selected to the position or not.

4 How do we collect personal data?

We primarily collect personal data directly from you when you apply for a job with us. In addition, we may collect personal data also from other permitted sources, such as from data systems to which your personal data is recorded in connection with your use of such data system. In addition, we may collect data from other sources based on your consent.

5 What types of personal data do we process?

We may process personal data of the following categories:

  • Basic identifying data, including name, personal identity code and contact details (such as address, email address and telephone number)
  • Information relating to suitability to the position, such as information on work experience, qualification data and information relating to education or results of personal and aptitude assessment or other suitability assessment data. Those candidates that are, on the basis of the first interview, suitable for the position, may be required to participate to a personal and aptitude assessment. A person who is to be evaluated is always provided with a copy of the statement given.
  • Other information obtained from you, including job application and possible appendices of the application
  • Other information accumulated during the recruitment, such as notes made by the interviewers and communications between us
  • Data collected through technical monitoring, including data collected from your use of our recruitment systems or data relating to camera surveillance and other electronic surveillance recordings

In addition to the categories of personal data presented above, we may process special categories of personal data or personal data that is otherwise sensitive as follows:

  • Personal credit data in so far as legislation permits such processing in order to establish the employee’s reliability
  • Drug test certificate or data included in it to the extent permitted in applicable legislation in order to establish the employee’s performance and ability to work

6 Where do we store your personal data?

We primarily process personal data on servers located within the EU/EEA.
However, we may need to transfer your personal data from a location within the EU/EEA to a third country. With regard to transfers of personal data to countries where the local data protection legislation does not provide an adequate level of data protection, we will implement appropriate safeguards under the GDPR to ensure that your personal data remains protected and secure. Such international transfers of personal data will be based on the standard contractual clauses approved by the European Commission. To learn more about the appropriate safeguards we use, please contact our GDPR team at gdpr@borenius.com.

7 Do we transfer or disclose your personal data to third parties?

We will not disclose personal data to any third parties unless we are required to do so under applicable laws, to prepare for legal proceedings or to defend a claim.
We use partners and service providers in connection with our recruitment process that require the processing of personal data, and as such, personal data will be transferred to and processed by third-party providers (data processors) that provide services to us. All of these partners and third-party service providers must comply with our written data processing agreements, and they must implement appropriate technical and organisational measures to ensure the protection of your personal data. Furthermore, they may not process any personal data transferred to them for any other purposes than for providing services to us. The only employees with access to your personal data will be those employees who need to process your personal data.

8 How long do we retain your personal data?

We retain the job applicants’ personal data in accordance with the applicable legislation only for as long as the retention of data is necessary for processing purposes specified in this Privacy Notice. When we no longer need your personal data for the specified purposes, the data will be deleted from our data systems and other files.
The general maximum retention period of personal data of job applicants is one year from the relevant recruitment decision, based on the limitation period for raising discrimination change under the Gender Equality Act (609/1986).

9 What are your rights regarding your personal data?

The GDPR ensures that the data subject has a number of rights and that the data subject can exercise these rights in many cases to govern the processing of their personal data. The extent of the data subject’s rights is subject to the legal basis provided for processing the relevant personal data, and the data subject must provide identification in order to exercise the said rights. Where we have reasonable doubts concerning the identity of the natural person making the request referred to below, we may request you to provide additional information that we require to confirm your identity. You can use your rights or ask any questions regarding the processing of your personal data by contacting the contact person mentioned in section 2 of this Privacy Notice.

  • Right of access: You have the right to request access to the personal data relating to you. This includes e.g. the right to be informed of whether or not personal data about you is being processed, what personal data is being processed, and the purpose of the processing.
  • Right to rectification: You have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you. You may also request the completion of any incomplete personal data relating to you.
  • Right to object: You are entitled to object to certain processing of your personal data, and we may be obliged to comply with your request unless we can demonstrate compelling legitimate grounds for further processing of such personal data.
  • Right to erasure: You may request the erasure of your personal data, and we are obliged to comply with your request e.g. in the event that the relevant personal data is no longer required for the purposes for which it was collected, or where we have unlawfully processed the relevant personal data.
  • Right to restrict processing: Under certain statutory situations, we may be obliged to restrict the processing of your personal data.
  • Right to withdraw your consent: In cases where we have been processing your personal data based on your consent, you have the right to withdraw your consent to such processing at any time.
  • Right to data portability: In certain cases, you have the right to receive any personal data we process in a structured, commonly used and machine-readable format, where this is technically feasible.

10 Changes to this Privacy Notice

This Privacy Notice was updated in May 2018. We may update and amend this Privacy Notice from time to time. Unless otherwise provided in mandatory applicable legislation, we may not personally notify the data subjects of any changes we make to this Privacy Notice. We kindly ask that you review this Privacy Notice from time to time for possible changes.