Privacy notice of the recruitment register

In this privacy statement, we describe how Oddlygood Global Oy (hereinafter “OGG” or “we”) processes personal data concerning people who have submitted a job application to OGG, in order to implement recruitment. In this privacy state-ment, we also refer to job applicants as “data subjects“.

OGG may update this privacy statement from time to time, when legislation changes, for example. OGG will inform data subjects of material changes to this privacy statement.

1. Data controller

Oddlygood Global Oy (Business ID: 0112421-6)
Meijeritie 6
FI-00370 Helsinki

2. Contact information

If the data subject wishes to exercise their rights under this privacy statement or if they have questions about the pro-cessing of the personal data, please contact us 1) by email at privacy.office@valio.fi, 2) by calling +358 10 381 2185, or 3) by post at Oddlygood Global Oy, Meijeritie 6, 00370 Helsinki.

3. For what purposes and on what basis do we process the personal data?

OGG processes data subjects’ personal data to implement recruitment. The purpose of the recruitment process is to select, from among job applicants, persons suitable for OGG’s needs.

The processing of personal data is based on the exercise of OGG’s legitimate interests. OGG’s legitimate interests are based on the relationship that is established between OGG and the data subject when they submit a job application to OGG. The processing of personal data is necessary for processing job applications and implementing recruitment. In connection with the recruitment process, OGG may ask for the data subject’s consent to contact referees, conduct a personal assessment, an aptitude assessment or security check in line with national regulations.

4. What personal data do we process?

Concerning each data subject, we may process the following personal data:

• Name, date of birth, personal identity code, address and email address
• Education, professional experience and other competence background
• Data subject’s description of their expertise and suitability for the job, as well as their salary request
• Information that the data subject has voluntarily provided about whether they are a Finnish citizen (OGG will pro-cess this information for work permit confirmation purposes, for example)
• References that the data subject has provided on their own initiative or information about referees (name, posi-tion and contact details)
• Additional information that data subject has provided on their own initiative (e.g. family relations, hobbies, posi-tions of trust, life situation)
• Any summaries concerning the data subject written by persons participating in the recruitment process and any summaries of statements by the referees listed by the data subject
• The results of any personal and aptitude assessments or safety checks.

5. Where do we collect the personal data?

OGG and service providers acting on its behalf, including but not limited to its affiliated companies, collect the personal data directly from the data subject and from service providers conducting personal assessments. In the course of the recruit-ment process personal data may be collected also from referees subject to the data subject’s consent. OGG collects the personal data as a part of the job application process, meaning that the data subject enters their personal data directly into the recruitment system used by OGG. In addition, we collect open applications that the data subject has sent by email.

6. Who processes the personal data and to whom do we disclose the data?

OGG transfers the data subjects’ personal data to the recruitment system service provider, service providers assisting in the recruitment process (e.g. head hunters) and service provider conducting personal assessments, who process the personal data on behalf of and on the account of OGG. Personal data may also be disclosed to companies belonging to same group of companies with OGG, to the extent such companies participate to the recruitment process. OGG provides service providers conducting personal assessments only with personal data of applicants who have progressed to the personal assessment phase of the recruitment process. In addition, concerning applicants who have progressed in the recruitment process, OGG provides the authorities with personal data if security or other background checks are needed.

7. Do we transfer the personal data outside the EU or the EEA?

We have outsourced part of the personal data processing to data processors located outside of EU/EEA. In such situations, we will ensure that your personal data is transferred lawfully in one of the following ways:

• By verifying whether the European Commission has issued a decision on the adequacy of data protection in the coun-try in question (e.g. Canada)
• By ensuring appropriate safeguards as required by law, such as by signing the standard contractual clauses approved by the European Commission, by assessing the adequacy of the data protection measures for the transfer and by taking additional measures that may be necessary; or
• By ensuring the lawfulness of the transfer in other ways, such as requesting your express consent for transferring the personal data.

The data subject has a right to acquire information on the used transfer mechanism from the contact person set forth in the section 2.

8. How long do we store the personal data?

We process the personal data for the duration of the recruitment process, after which we will store the data for two years.

If the applicant is selected for the job, we will transfer the basic data collected during the recruitment process, as well as other personal data relevant to the employment relationship, to OGG’s personnel register.

9. How do we ensure the protection and information security of the personal data?

We ensure the information security of the personal data through appropriate administrative and technological safeguards. OGG keeps the recorders containing personal data in locked premises. OGG restricts the processing of personal data to those persons whose duties include the processing of such data.

The systems and databases containing personal data processed by OGG are located on servers that OGG maintains in locked premises and are accessible only to designated persons who are authorized to access them for their job duties. OGG pro-tects the servers and data networks with appropriate firewalls and other technical protection measures available at the time. Server rooms are protected with access control systems.

OGG uses a risk-based data encryption and pseudonymisation procedure to protect personal data. OGG uses encryption mechanisms to protect personal data on its servers based on a risk assessment when the data is subject to increased securi-ty requirements.

10. Right to object to the processing of personal data

The data subject has the right to object to the processing of their personal data at any time on grounds relating to personal reasons. If the data subject objects to the processing of their personal data, it will result in OGG not being able to process the data subject’s job application and OGG will therefore not be able to take the data subject into consideration in the re-cruitment process.

The data subject shall submit the objection to the contact person mentioned in section 2. When making the request, the data subject shall identify the reason relating to the personal reasons on basis of which the data subject objects to the pro-cessing of the personal data (for example, that the data subject is no longer interested in the job in question). OGG may request the data subject to verify their identity or to clarify their request before executing the request. OGG may also re-fuse to execute the data subject’s request on grounds set out in the data protection legislation, in which case OGG will in-form them about such grounds.

11. Other rights of the data subject

In accordance with the applicable data protection legislation, the data subject has, at any time, the right to:

• Access to one’s personal data (right of inspection)
• Require any inaccurate or incorrect personal data to be rectified or completed
• Object to the processing of the personal data and to require the personal data to be erased
• Require the processing of the personal data to be limited (e.g. while the data subject is waiting for a response to a request concerning the rectification of the personal data).

Any requests to exercise the data subject’s rights must be submitted to the contact person specified in section 2. OGG may request the data subject to verify their identity or clarify their request before executing the request. OGG may also refuse to execute the data subject’s request on grounds set out in the data protection legislation, in which case OGG will inform them about such grounds.

12. The data subject’s right to file a complaint with the supervisory authorities

The data subject has the right to file a complaint with the appropriate supervisory authorities if they believe that we have not processed the personal data in accordance with the applicable data protection legislation. The data subject can file a complaint with the supervisory authorities in the EU member state where the data subject’s permanent place of residence or employment is located or where the alleged personal data breach has occurred. In Finland, the appropriate supervisory authority is the Data Protection Ombudsman (www.tietosuoja.fi).

updated 25.8.2022