Privacy notice

Processing of the personal data of job applicants of Eversheds Attorneys Ltd. (“Eversheds”)

Data processing in a nutshell

Eversheds processes the personal data of job applicants to prepare an employment contract on the applicant’s request.

Personal data is collected primarily from the applicants themselves.

Eversheds only processes such data which are necessary for the purposes defined by Eversheds.

Personal data may accessed only by such representatives of Eversheds who need to process the information to perform their working duties.

The Data Subject can influence how Eversheds processes their personal data. This notice describes the rights of the data subjects and how the rights can be exercised.

Controller

Eversheds Attorneys Ltd. (Business ID:  2556202-6)
Fabianinkatu 29 B
FI-00100 Helsinki
Finland

Contact information for data protection matters

Communications concerning data protection:

Eversheds Attorneys Ltd.
Data protection matters
Fabianinkatu 29 B
FI-00100 Helsinki
Finland

privacy@eversheds.fi

Processed personal data

The controller processes the following information concerning job applicants:

• Basic information, such as name, date of birth, home address and other contact information;
• Job application and other information related to the job application process, such as language skills, information on education and qualifications, information on personal assessment and aptitude tests, credit information if permitted or required by law;
• Information of referees stated by the job applicant;
• Information related to the progress of the recruitment and possible selection process

Purposes of the processing of personal data

Personal data are used for the preparation of an employment contract on the data subject’s request and for related recruitment measures and assessment of the suitability of the employee.

Legal basis for the processing

The controller processes personal data for preparing and executing an employment or service contract.

The controller’s right to process the personal data of the data subject, i.e. the applicant, is based partly on the legitimate interests arising out of the recruitment process.

Personal data may also be processes on the basis of consent insofar as required under legislation, for example for conducting personal and suitability assessment.

Recipients or categories of recipients of personal data

The applicants’ personal data are not regularly disclosed to third parties. Personal data are disclosed only to the extent permitted and required under applicable legislation.

The processing of personal data has been outsourced to the following service providers who process personal data on behalf of the controller:

Providers of the IT systems of HR management

Communication services providers

Transfer of data to third countries

Personal data will not be transferred outside the EU and EEA.

Storage period of personal data

When the applicant uses recruitment website, the applicant chooses the retention period in the recruitment system (alternatives 3 months, 6 months, 1 year and 2 year). Personal data obtained otherwise than via recruitment system will be stored for as long as is necessary for the purposes for which they are processed or for complying with the controller’s legal obligations. For example the limitation period set out in legislation and employer’s obligations will be taken into account in the storage periods.

Data subject’s rights

The Data Subject may exercise their rights described below by contacting privacy@eversheds.fi or

Eversheds Attorneys Ltd.
Data protection matters
Fabianinkatu 29 B
FI-00100 Helsinki
Finland

Right of access

The data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning them are being processed. The data subject also has the right to access personal data concerning the data subject as well as information on the processing of personal data as set out in the Data Protection Regulation.

When the data subject exercises their right to access the data, the controller provides a copy of the personal data undergoing processing. If the data subject requests multiple copies, the controller may charge a reasonable fee for them based on administrative costs.

Right to rectification

The data subject has the right to request the controller to rectify inaccurate personal data concerning the data subject without undue delay. The data subject also has the right to have incomplete personal data completed by providing the controller with a supplementary statement.

Right to erasure

The data subject has the right to obtain from the controller the erasure of personal data concerning the data subject without undue delay if:

• the personal data are no longer needed for the purposes for which they were collected or otherwise processed;
• the data subject withdraws consent on which the processing is based and there are no other legal grounds for the processing of such data;
• the data subject objects to the processing of their personal data on ground relating to their particular situation and there are no legitimate grounds for processing;
• the controller has processed the personal data unlawfully; or
• the personal data have to be erased for compliance with a legal obligation the controller is subject to.

Right to restriction of processing

The data subject has the right to obtain from the controller restriction of processing so that the personal data may, with the exception of storage, be processed only with the data subject's consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another person if:

• the data subject contests the accuracy of the personal data, in which case processing will be restricted for a period enabling the controller to verify the accuracy of the personal data;
• the controller processes personal data unlawfully and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
• the controller no longer needs the personal data for the purposes of the processing but the data subject requires them for the establishment, exercise or defence of legal claims; or
• the data subject has objected to the processing of their personal data on grounds relating to their particular situation and waits for the verification whether the controller’s legitimate grounds override those of the data subject.

Right to data portability

The data subject has the right to receive the personal data provided to the controller in a structured, commonly used and machine-readable format and the right to transmit those data to another controller if:

• the processing is carried out by automated means; and
• the processing is either based on the data subject's consent or the processing of the data subject's personal data is required for the performance of the employment contract or for the implementation of pre-contractual measures taken in response to the data subject’s request.
• The right to data portability is limited to conduct which does not adversely affect the rights and freedoms of others.

Right to object to processing of personal data

The data subject has the right to object to the processing of their personal data on grounds relating to their particular situation if there are no legitimate grounds for the processing.

Right to withdraw consent

Where the processing is based on the data subject’s consent, the data subject has the right to withdraw their consent to the processing of personal data at any time.

Right to lodge a complaint with a supervisory authority

The data subject has the right to lodge a complaint with the Data Protection Ombudsman if the data subject considers that their rights under the Data Protection Regulation have been infringed in the processing of the personal data.

Where personal data is obtained (if not from the data subject)

The controller collects personal data primarily from the data subjects themselves.

Data may also be collected from the data subject’s referee and a recruitment consultant.

The controller may also collect personal data from other sources with the data subject’s consent, unless it is question of the person’s credit information to establish the applicant’s reliability, in which case no consent is required.

Security of personal data processing

Personal data is stored in systems which are protected with firewalls, passwords and other technical and organisational measures generally accepted in the field at the time.

Any materials maintained manually are located in premises to which unauthorised access is prevented.

Only such employees of the controller who need to process the personal data to perform their working duties have access to personal data processed by the controller.