1. Contact details of the data controller for data protection matters

Data controllers

VAV Yhtymä Oy (company registration number 0640915-7) and its subsidiaries listed below, hereinafter referred to as the “data controller”

VAV Asunnot Oy

Contact details for data protection matters

Enquiries to the Data Controller’s Data Protection Officer and regarding all data protection matters may be sent using the following contact details:

email: tietosuoja@vav.fi

address: VAV Yhtymä Oy, Data Protection Matters, Veturikuja 7, 01300 Vantaa

2. Data subjects and the content of the register

The register contains the following personal data on the data controller’s job applicants (“data subjects”):

• basic details of the data subject, such as name, date of birth and personal identification number, if obtaining the data subject’s credit history is necessary for the job in order to assess the data subject’s reliability;
• the data subject’s contact details, such as email address, telephone number and postal address;
• information provided by the data subject to the data controller during the job application process that is relevant to their suitability, and other information about themselves, their background and so on, such as photographs, videos, information relating to studies and other education, profession, details of employment history (such as employers, start dates and durations of employment, and the nature of the work), language skills, driving licences, other specialist skills, a description of personal characteristics, various certificates and assessments, as well as references to information found on the internet or from other sources, and references;
• information concerning the progress of the data subject’s recruitment process, such as details of an upcoming follow-up interview or the suspension of the recruitment process;
• reports from personality and aptitude assessment tests, and occupational health reports on the jobseeker’s fitness for the role they are applying for;
• personal credit history data, in circumstances permitted by the Data Protection Act in the workplace, concerning a job applicant who has been selected to carry out duties requiring a high level of trustworthiness
• in certain circumstances, information relating to drug testing and details recorded on the drug test certificate provided by the job applicant, where the applicant has been selected to carry out duties requiring accuracy, reliability, independent judgement or good responsiveness.
• any other information for the collection of which the data subject has given their consent or which the data subject has voluntarily provided themselves during the recruitment process.

3. Legal bases and purposes of personal data processing

The purpose of processing personal data is to enable the data controller to assess and compare job applicants and carry out other recruitment-related measures, to manage the recruitment process, supporting human resources management, and managing data relating to the application process to enable necessary communications and to facilitate decision-making when filling vacancies.

The legal bases for the processing of personal data are:

1. the data controller’s legitimate interest, based on the relationship between the job applicant and the employer, in processing the personal data provided in or referred to in the data subject’s job application;
2. the data controller’s legitimate interest in proactively seeking and recruiting suitable employees and in processing data necessary for making contact, which data subjects may themselves have made generally available to employers on professional online services, e.g. LinkedIn and other similar sources, in accordance with their terms of service;
3. the statutory rights and obligations of the data controller and the data subject, e.g. assessing the data subject’s reliability in accordance with the Data Protection Act for the Workplace on the basis of credit information, and fulfilling equality obligations;
4. the consent of a job applicant selected for the post to the processing of information to be included in a certificate relating to a drug test
5. the data subject’s consent to the collection and processing of other personal data and to personality and aptitude assessment tests

4. Sources of data

Data for the register is normally collected directly from the data subject themselves, and, within the limits laid down by law and, where necessary, with the data subject’s consent, from the data controller’s recruitment consultant, companies providing personality and aptitude assessment services, public authorities, credit reference agencies, occupational health services, contact information service providers, professional online services such as LinkedIn, referees named by the jobseeker, and other similar reliable sources.

5. To whom is data disclosed or transferred

Data will not be disclosed to external parties without the data subject’s consent, except where this is necessary to fulfil the data controller’s statutory obligations, in connection with legal proceedings, at the request of public authorities, or as part of business arrangements.

The data controller has the right to use subcontractors for the processing of personal data in accordance with this privacy notice. In such cases, personal data may be transferred to subcontractors to the extent necessary for the subcontractor to perform its services. The data controller may use subcontractors for the following tasks:

• HR, recruitment and aptitude assessment services
• ICT: IT infrastructure, information security and user management, electronic messaging services

Subcontractors process personal data on behalf of and for the account of the data controller in accordance with the data controller’s instructions. Subcontractors are bound by agreements concluded with the data controller regarding the processing of personal data, including provisions on confidentiality and data security.

VAV and its subcontractors process personal data within the EU/EEA and in countries whose level of data protection has been recognised as adequate by the European Commission. If, in exceptional circumstances, personal data is processed in other countries, VAV ensures an adequate level of data protection by agreeing to the transfer using the standard contractual clauses approved by the European Commission

6. Principles governing the protection of the register and data retention periods

Only managers carrying out recruitment-related tasks, as well as employees of the HR department and the data controller’s subcontractors who, by virtue of their work, are authorised to process data from this register, are authorised to access the system containing personal data.

Manual records are stored in locked premises commensurate with the level of data protection required. Staff and subcontractors who process the data are bound by confidentiality obligations. The security of electronically stored data is based on access rights management, technical protection of databases and servers, physical security of premises, access control, data communication security and data backup. Access to the electronic data in the register by data processors is protected by personal usernames and passwords. Access rights and authorisation to process data are granted on the basis of job duties.

Certificates relating to drug tests, personal and suitability assessments, and occupational health reports are stored separately from other data.

The data of successful job applicants is retained as part of employment records. The personal data of other job applicants is retained following the recruitment decision for as long as is necessary to fulfil the rights and obligations relating to recruitment, but for at least two years from the date of the recruitment decision (the limitation period for bringing a discrimination claim under the Equality Act).

Data may also be retained for the data controller’s other potential recruitment needs, in accordance with the data subject’s consent.

7. The data subject’s rights to access, rectification and other rights

As a job applicant, you have the right to know for what purposes and in what ways we process your personal data. With this description of our data protection practices, we aim to provide a comprehensive overview of the processing of personal data in our recruitment procedures. However, if any aspect of the processing of personal data remains unclear, you may ask the Data Protection Officer for further clarification; their contact details are on the first page of this policy.

Data subjects have the right to inspect the data concerning them stored in the personal data register and to request the rectification or erasure of any data that is inaccurate, out of date, unnecessary or unlawful.

Data subjects also have the right to withdraw their previously given consent to the processing of their personal data at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal of consent.

If the data subject has provided their personal data to the data controller and the processing is based on consent or a contract, they have the right to receive this data in a structured, commonly used and machine-readable format, and the right to transfer the data to another data controller in accordance with applicable legislation.

Where the processing of personal data is based on a legitimate interest, the data subject has the right to object to the processing of their data on grounds relating to their particular personal circumstances. When making such a request, the data subject must specify the particular circumstances on which the objection is based.

In situations specified by law, the data subject may request that the processing of their personal data be restricted, for example, by suspending it wholly or partly, where the data subject considers there to be uncertainty regarding the accuracy of the data or its processing.

The data subject has the right to lodge a complaint regarding the processing of personal data with the Data Protection Ombudsman.