Creation date

27/10/2020

Contact information

Nordic Business Group Oy (hereinafter “NBG”)
Kauppakatu 41 B 12
40100 Jyväskylä, Finland
info@nbgroup.fi

Data controller

The controller is Nordic Business Group Oy (2241358-6).

Global headquarters
Kauppakatu 41 B 12
40100 Jyväskylä, Finland
info@nbgroup.fi

Contact person in matters related to the filling system

Miriam Hautala, Kauppakatu 41 B 12, 40100 Jyväskylä, Finland, +358 40 158 8750, miriam.hautala@nbgroup.fi.

Name of filing system

Job applicant register.

Purpose of personal data processing

NBG may collect any personal data that is directly necessary for recruitment purposes and/or a possible employment relationship (either with NBG or with a private employment agency). This data is connected with managing the rights and obligations of the parties involved in the employment relationship, or related to the benefits possibly provided by NBG to the individual, or that which arises from the nature of the work concerned.

Processing of personal data is based on the following grounds of the EU’s General Data Protection Regulation (one or more grounds may apply simultaneously):

  1. Processing is necessary in order to take steps at your request prior to entering into a contract.
  2. Processing is necessary for the purposes of the legitimate interests pursued by NBG.
  3. You have given consent to the processing of your personal data.

The legitimate interests of NBG or third party referred to in point 3. above may include amongst others the following matters:

  •       maintaining log files of who has processed the personal data
  •       business development

In addition to the above, NBG uses individual data if it deems it necessary for security purposes or to investigate possible fraud or other violations of its agreements or this Privacy Policy.

Data content of filing system

Personal data filing system contains the following information: first and last name of the individual, personal identification number, email address, postal address, phone number, bank account number, the completed job application, email conversations and other conversation notes with the candidate, comments and notes made by the recruiter.

Content of NBG’s filing system may include the following types of data and changes made to these data types:

  1. Personal information
  • Last name, all first names, previous last name
  • Home address
  • Date of birth
  • National identification code
  • Gender
  • Nationality
  • Phone number(s)
  • Photo
  • Languages
  • Medical and drug test data (where applicable)
  1. Employment related information
  • Work history
  • Education
  • Cover letter and CV
  • Aptitude assessment results (e.g. via recruitment consultants)
  • Personality and aptitude assessment test results
  • Recruitment videos
  • Examples of previous work or presentations (e.g. portfolio of creative works)
  • Social media content (with consent)
  • Other information during recruitment interviews and reference checking
  • Work permit
  • Credit rating (where applicable)
  • Extract from criminal records (where applicable)
  • Use of your rights related to your personal data (such as right to access your personal data)
  1. Training, education and events information
  • Training courses and certificates you have completed
  • Education
  • Possible personal assessment profile and test results
  • Knowledge, skills, and expertise (e.g. language skills, education)

Regular data sources

Data stored in the filing system comes from the data subject and the recruiters’ notes.

NBG may gather personal data from third parties based on your consent, for example, from persons you have indicated as a reference and companies offering recruitment consultancy and personality and aptitude assessment tests to NBG.

Regular disclosure of data

NBG companies have a legitimate interest in transmitting personal data within the NBG group for internal administrative purposes.

NBG does not sell, lease or otherwise disclose your personal data to third parties outside of the NBG group unless otherwise stated below.

NBG may share your personal data with authorized third parties that perform services for NBG for the purposes described in this Privacy Policy within the limits of the applicable legislation. This may include, for example, providing services such as software services, managing and analyzing personal data and conducting research. Because NBG takes the responsibility to safeguard your personal data seriously, NBG does not allow those companies to use it for any purpose other than to perform those services, and NBG requires them to protect your personal data in a way consistent with this Privacy Policy.

NBG may share your personal data based on a valid order from a court or other official body with sufficient authority.

NBG may share your personal data as part of any merger, acquisition, sale of company assets or transition of service to another provider. This also applies in the unlikely event of an insolvency, bankruptcy or receivership in which your personal data would be transferred to another entity as a result of such a proceeding.

Transferring data outside the EU or the EEA

NBG’s services may be provided using resources and servers located in various countries around the world. Therefore NBG may transfer your personal data outside the country where you use our services, including to countries outside the EU and EEA that do not have laws providing specific protection for personal data or that have different legal rules on data protection.

In such cases, NBG ensures that a legal basis for such a transfer exists and that adequate protection for your personal data is provided as required by applicable law, for example, by using standard agreements approved by relevant authorities (where necessary) and by requiring the use of other appropriate technical and organizational information security measures.

Filing system’s principles of protection A: Manual material

All data related to the filing system is only kept in electronic format and is only processed electronically.

Filing system’s principles of protection B: Electronically processed functions

Access to the data stored in the filing system is given only to such persons and in such scope that is required for the purposes of the job application/recruitment process. The protection of all data in the filing system is carried out in accordance with the applicable Personal Data legislation, the regulations and principles of the applicable Information Society Code, regulatory provisions, and good data processing practices.

Duration of data processing

NBG may process your data in its job applicant system for until the end of the third year following your application year (for example application 1 August 2020 => 31 December 2023).

Based on your consent NBG may process your personal data for as long as the consent describes.

NBG may process your personal data based on legal requirements for as long as the applicable legislation allows.

Exercising of different rights

All rights can be exercised by contacting NBG by using the contact details issued at section 1 above. NBG will then give further instructions on how to exercise a specific right. Where NBG has reasonable doubts concerning the identity of the person making the request, NBG may request the provision of additional information necessary to confirm your identity.

NBG will provide information on action taken on a request to you within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests.

  1. Right to access your personal data

You have the right to obtain from NBG confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, receive information about your personal data.

  1. Right to rectification

You have the right to obtain from NBG without undue delay the rectification of inaccurate personal data concerning you.

  1. Right to erasure (‘right to be forgotten’)

You have the right to obtain from NBG the erasure of personal data concerning you without undue delay where one of the following grounds applies:

(a) your personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

(b) you withdraw consent on which the processing is based and where there is no other legal ground for the processing;

(c) you object to the processing and there are no overriding legitimate grounds for the processing;

(d)  your personal data have been unlawfully processed;

(e) your personal data have to be erased for compliance with a legal obligation in Union or member state law to which NBF is subject;

(f) the personal data have been collected in relation to the offer of information society services.

However, you do not have the right or erasure if the processing is necessary:

(a) for exercising the right of freedom of expression and information;

(b) for compliance with a legal obligation which requires processing by Union or member state law to which NBG is subject; or

(c) for the establishment, exercise or defense of legal claims.

  1. Right to object

You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you which is based on legitimate interests pursued by NBG, including profiling. NBG shall no longer process the personal data unless NBG demonstrates compelling legitimate grounds for the processing which override your interests, rights, and freedoms for the establishment, exercise or defense of legal claims.

Where personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing.

Please be aware that you cannot opt out of receiving service messages from NBF, including but not limited to security and legal notices.

  1. Right to data portability

You have the right to receive the personal data concerning you, which you have provided to NBG, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller where:

(a) the processing is based on consent or on a contract; and

(b) the processing is carried out by automated means.

Cookies

Nordic Business Group uses cookies. Our cookie policy is available at https://www.nbforum.com/cookies/

Decision making with automated means and profiling

NBG does not make decisions based solely on automated processing which produces legal effects concerning you or similarly significantly affect you.

NBG does not carry out job applicant profiling in a way meant in the GDPR.

Applicable law

The processing of personal data in NBG’s filing system is governed by the European Union’s applicable data protection legislation as well as national laws of countries where NBF is established.

Updates to this Privacy Policy

NBG may modify this privacy policy, and if we make material changes to it, we will provide notice on our intranet or by other means, to provide you the opportunity to review the changes before they become effective and binding.

We have updated our privacy policy on 27 October 2020.