Privacy Notice – Job Applicants
General
This document describes the processing of personal data in Abloy Oy’s sales and customers management. This privacy notice provides the data subject and the supervisory authority with the information required by the European Union’s General Data Protection Regulation (GDPR) (679/2016).
Controller and contact details
Name: Abloy Oy
Postal address: Wahlforssinkatu 20, 80100 Joensuu, Finland.
Telephone (exchange): +358 20 599 2501
Business ID: 0774324-5
Email address: privacy@abloy.com
This email address is to be used only for addressing matters related to data protection. For all other matters, the correct contact information can be found from www.abloy.com.
Whose data is processed?
Persons who have applied for vacancies at Abloy Oy or who have left an open application for recruiting are data subjects.
What is the purpose and legal basis for processing personal data?
The processing of personal data is based on the consent of the data subject and on the legitimate interest of the controller. The data controller is responsible for ensuring the legality of data processing based on the rights of the data subject and meeting reasonable expectations.
Personal data groups of the data subject | Purpose of processing a data group | Basis of data processing |
Person’s basic data and supplemental data according to the job description. | Information required to determine the applicants suitability for the applied job is processed during the recruitment process. | Data subject’s consent, the data controller’s legitimate interest to recruit needed and qualified personnel |
The data controller does not use automatic decision making or profiling.
What personal data is processed?
Personal data group | Data content |
Basic data | Name and surname, date of birth, address, postal code and address, phone number, e-mail, nationality, photograph |
Training and work experience data: | Training, language skills, work experience, possible special skills, |
Other data provided by the applicant | Possible recommendations and the applicant’s expectations: industry, location, position, time of employment and terms (e.g. full-time/part-time, day job), expectation on wages and other data provided by the data subject |
Suitability evaluation | In case a suitability evaluation is done, this evaluates the applicant’s functional and social suitability for the position. The evaluation report is submitted to both the applicant and Abloy Oy. |
Background information | A background check is conducted as suitable for the company’s industry and the specific position. This can include e.g. verification of identity, medical status determination, credit check, basic security check, and is part of the recruitment process. The background check is always subject to the data subjects consent. |
How is personal data collected?
Data provided directly by the data subject is processed. Data is collected from the application form (open or position specific), education, work and/or other certificates, during a possible interview with the applicant and/or data provided during the employment relationship.
If required, personal data is supplemented with information from compiled personal evaluations, background check information and references, if the applicant has consented to this according to the Act on the Protection of Privacy in Working Life (759/2004).
However, consent is not required if authorities provide Abloy with information required to fulfil legal obligations, or if the employer collects personal credit data or information extracted from criminal records for purpose of evaluating trustworthiness. If personal data is collected for the evaluation of trustworthiness, Abloy will notify the data subject in advance.
If data has been collected from other sources besides the data subject, Abloy will notify the data subject before using such data in decision making.
Who will the data be transferred to?
Personal data may be processed by human resources personnel responsible for Abloy’s recruiting operations and specifically appointed foremen responsible for recruitment.
Recipient | Purpose of the disclosure | Grounds for the disclosure |
Providers of recruitment services | Recruitment
| Agreement between the data controller and the service provider |
Providers of suitability evaluations | In case a suitability evaluation is used for recruitment purposes, Abloy may disclose the employee’s name and contact details to the relevant provider responsible for suitability evaluations. | Agreement between the data controller and the service provider
|
Providers of background checks | Conducting a background check (medical status check, credit check, basic security check) | Data subject’s consent, legal obligation or right |
Service providers | Maintenance and support of IT systems
| Agreement between the data controller and the service provider |
ASSA ABLOY group | Approval of recruitment regarding specific positions
| Agreement between the data controller and the group company |
ASSA ABLOY company | Place of work at another ASSA ABLOY company | Agreement between the data controller and the group company |
Is personal data processed outside the European Union?
The data subject’s personal data is not transferred outside the European Union or the European Economic Area, unless the position is located outside the EU or EEA. If transferring data outside the EU or EEA, we use the standard contractual clauses adopted by the Commission in order to protect the data.
What are the storage periods for personal data?
The data collected in the register will be kept for as long as necessary, and to the extent necessary, for the fulfilment of the original or compatible purposes for which the personal data was collected.
Applications | Storage time |
Open applications | The applicant may choose if we store the application for 6 or 12 months after submission, after which the applicant’s data is deleted from the applicant’s database. |
Specific applications | The applicant may consent to the use of the application regarding other vacant positions. He/she may choose if we store the application for 6 or 12 months, after which the applicant’s data is deleted from the applicant’s database. The applicant may also not consent to using the application regarding other vacant positions, by specifying the storage time as zero (0) months. |
What are data subject’s rights?
Right of Access
The data subject is entitled to obtain confirmation from the controller as to whether the personal data of the data subject is being or has been processed.
If the data controller processes the personal data of the data subject, the latter is entitled to the information of this document, as well as to a copy of the personal data that is being or has been processed.
If a data subject makes a request electronically and has not requested any other form of delivery, the data will be provided in a generally available electronic format that is compatible with secure delivery of the data.
Right to Correct or Delete Data
The data subject has the right to ask the controller to correct or delete his or her own personal data.
Under certain circumstances, data subjects have the right to request processing of their personal data to be restricted, or to otherwise object to the processing of data. In addition, data subjects may request the transfer of data submitted by the data subjects themselves in a machine-readable form based on the General Data Protection Regulation.
The right to withdraw consent
If the personal data is processed based on the consent of the data subject, the data subject has the right to withdraw their consent at any time, without this affecting the lawfulness of the data processing that has taken place before the data subject withdrew their consent.
Before giving consent, you will be informed about your right to withdraw the consent. If required, you can withdraw your consent by e-mailing privacy@abloy.com.
How can data subjects exercise their rights?
In all matters involving the processing of personal data, data subjects have the right to contact the controller.
All requests mentioned in the present document must be submitted to the above mentioned contact point of the controller.
Data subjects also have the right to file a complaint with the supervisory authority if their personal data is or has been processed unlawfully.
How is personal information protected?
Abloy Oy processes personal data safely and in compliance with the applicable legislation. Protection of personal data by Abloy Oy is adequate both technically and organisationally.
The data is stored in locked premises that are accessible only to authorised persons. Personal data stored in the systems is accessible only to pre-designated persons who need the information for work-related tasks. IT environments are protected by adequate firewalls and other forms of technical protection
With regard to the processing of personal data, Abloy Oy’s employees and other persons must abide by their obligation of secrecy and must handle personal data confidentially.
Updating Privacy Notice
We will update and change this privacy notice when necessary. We will notify you of such changes at Abloy’s www-site.
This privacy notice has been made: 21st May 2018.