Privacy notice
Glaston Oyj’s (“Glaston”) personal data processing of job applicants
1 Data controller
Glaston Oyj Abp
Vehmaistenkatu 5
PO Box 25
33731 Tampere
2 Contact information on matters of data protection
Data Protection Issues
Glaston Oyj
Email: privacy@glaston.net
Address: Vehmaistenkatu 5, PL 25, 33731 Tampere
3 Personal data subject to processing
Glaston receives personal data about applicants through an online application form or by receiving applications via email. The applicant can decide for himself or herself whether or not to share their data.
It is mandatory to fill out the following information on the online application:
• Name, email address, where you heard about the vacancy
Additionally, the following information may be filled out in the form:
• Postal address
• Link to LinkedIn profile
• Free text field filled by the applicant
• Applicant’s willingness to travel on business
• Information about past working experience
• Education and degrees
• IT skills
• Salary request
• Language skills
• Job application and CV
Glaston may also process information from the applicant’s references, information concerning the recruitment process and possible qualification procedures, and notes and other information concerning aptitude tests and interviews.
4 The purpose of processing personal data
Personal data is used for global recruitment and recruitment procedures of Glaston Corporation.
Individuals may, at their own consent, submit data to the Glaston Oyj CV database for use in all Glaston group’s recruitments.
5 Legal grounds for processing of personal data
5.1 Legitimate interest
Glaston’s right to process personal data of the data subject or applicant is partially based on legitimate interest because the applicant submits his or her personal
data to Glaston for recruitment purposes and is aware that Glaston processes personal data. Glaston has carried out an interest assessment and came to the conclusion that data processing is allowed in this instance.
5.2 Contract
Glaston also processes personal data to prepare and implement a work or service contract.
5.3 Consent
Personal data may also be processed on the grounds of consent to the extent that the applicant agrees to disclose his or her application and all related personal data to companies belonging to the same group as Glaston.
Insofar as the processing of personal data is based on the consent of the data subject, the data subject has the right to withdraw consent to the processing of personal data at any time.
6 The recipients or categories of recipients of the personal data
Personal data shall be disclosed within the limits permitted and required by current legislation. Personal data shall be disclosed to companies belonging to the same group as Glaston for recruitment purposes.
Processing of personal data has been outsourced to the following service providers who process personal data on behalf of the controller:
• Teamtailor Ab – the service provider of the electronic recruitment system.
7 Transfers of personal data to third countries
Personal data shall be transferred to countries outside the EU and EEA to companies belonging to Glaston Corporation.
For the transfer of personal data, the standard contractual clauses of the European Commission or other transfer mechanisms in accordance with applicable laws will be applied to ensure an adequate data protection level.
8 Period for which personal data is stored
Personal data shall be stored for as long as it is necessary for the purpose of the processing of personal data or to comply with the statutory obligations of the controller. The time period for which data is stored takes into account, for example, the time limitations allowed by law and the obligations of Glaston.
• Glaston stores open applications for six (6) months from the submission of the application.
• The time limit for bringing an action for annulment is one year from the announcement of the recruitment decision; therefore, Glaston retains the personal data of the applicants who have responded to job advertisements for at least one (1) year after making a recruitment decision. Open job applications are also stored for one year from the moment of their arrival.
9 Rights of the data subject
The data subject may utilize the below mentioned rights by contacting privacy@glaston.net or Data Protection Issues, Glaston Oyj, Vehmaistenkatu 5, PO Box 25, 33731 Tampere.
The controller may request the provision of additional information necessary to confirm the identity of the data subject.
9.1 Right of access of the data subject
The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her is being processed, and, where that is the case, obtain access to the personal data and other data specified in the General Data Protection Regulation.
The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs.
9.2 Right to rectification
The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
9.3 Right to erasure
The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay, where one of the following grounds applies:
• the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
• the data subject withdraws consent on which the processing is based and where there is no other legal ground for the processing;
• the data subject objects to the processing on the grounds of his or her particular situation and there are no overriding legitimate grounds for the processing of personal data;
• the personal data have been unlawfully processed;
• the personal data have to be erased for compliance with a legal obligation to which the controller is subject.
9.4 Right to restrict processing
The data subject shall have the right to obtain from the controller restriction of processing by which the personal data shall, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person where one of the following applies:
• the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
• the processing is unlawful, and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
• the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject to retain the data for the establishment, exercise or defense of legal claims;
• the data subject has objected to the processing of his or her personal data on a basis specific to his or her personal situation and expects to find out whether or not there are overriding legitimate grounds for the controller to refuse to terminate the processing.
9.5 Right to data portability
The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller, where:
• the processing is carried out by automated means
• the processing is based on consent or the processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
The right to data portability shall not adversely affect the rights and freedoms of others.
9.6 Right of the data subject to object to the processing of personal data
The data subject shall have the right to object, on grounds relating to his or her particular situation, or where there are no overriding legitimate grounds for the processing of personal data.
10 The right of the data subject to lodge a complaint with a supervisory authority
The data subject shall have the right to lodge a complaint with a supervisory authority if the data subject considers that the processing of personal data by Glaston relating to him or her infringes the General Data Protection Regulation or the rights of the data subject as dictated by the General Data Protection Regulation.
11 Origin of personal data other than from the data subject
Glaston collects personal data primarily directly from the data subject. Additionally, Glaston may collect data from systems where information about employee activities is stored.
Data may also be collected from the data subject’s references and recruitment consultant.
12 Security of personal data processing
Personal data in electronic format is protected in the data security industry by generally acceptable technical methods, such as firewalls and passwords.
The manual forms containing personal data are located in locked premises where unauthorized access is denied.
Only employees identified by Glaston and other parties working on its behalf have access to personal data through the personal user privileges granted by Glaston.
***
Datenschutzerklärung
