At Taipuva, we handle your personal data with care and protect your privacy. We comply with the General Data Protection Regulation (GDPR) and all other applicable data protection legislation.
This Recruitment Privacy Notice has been prepared in accordance with the EU General Data Protection Regulation (GDPR) and national data protection laws. It explains how we collect, process, and safeguard the personal data of job applicants.
This Recruitment Privacy Notice applies to all countries in which Taipuva operates. Currently, it applies to Finland and Sweden. The notice is reviewed and updated as necessary.
Name of the Register
Taipuva Consulting Oy and Taipuva Consulting AB Job Applicant Register.
Contact Information of the Data Controller
Taipuva Consulting Oy (Business ID: 2439634-5)
Hämeenkatu 14 C 25, 33100 Tampere, Finland
Email: contact@taipuva.com
Taipuva Consulting AB (Business ID: 559143-4385)
Strandvägen 7 A, 114 56 Stockholm, Sweden
Email: contact@taipuva.com
Contact person for matters concerning the register
Petri Näppi
Phone: +358 50 536 5484
Email: petri.nappi@taipuva.com
Data protection matters may be addressed to the contact person listed above or via the general contact email address.
Recruitment Data Controllers within the Taipuva Group
Each Taipuva Group company acts as an independent data controller for its own recruitment processes and for the personal data processed in connection with those processes.
Applicant data may be shared between Taipuva Group companies where necessary for the recruitment process and in accordance with applicable data protection legislation.
Recruitment decisions are made by the company recruiting for the position. Representatives of other Taipuva Group companies may participate in the recruitment process where necessary, but each company remains independently responsible for its own processing of personal data and compliance with applicable data protection legislation.
Data subjects may exercise their rights under the GDPR in relation to the Taipuva Group company acting as the controller of their personal data.
Purpose of Processing Personal Data
The purpose of processing personal data is to carry out Taipuva Consulting Oy’s and Taipuva Consulting AB’s recruitment processes and to assess the suitability of job applicants.
Automated Decision-Making and Profiling
In the recruitment process, tasks, assessments, or tests may be used to support decision-making, such as role-related pre-assignment tasks, personality assessments, or suitability and aptitude tests conducted by partner organisations. In addition, Taipuva may use digital recruitment tools and platforms that utilise artificial intelligence or algorithmic features, for example for candidate search, matching, or ranking, to support the recruitment process.
Such tools are used solely as decision-support mechanisms. Final recruitment decisions are always made by a human.
Taipuva does not carry out automated decision-making as defined in Article 22 of the GDPR. No decisions producing legal effects or similarly significant effects concerning applicants are based solely on automated processing. Nor does Taipuva conduct profiling within the meaning of Article 22 of the GDPR.
Legal Basis for Processing
The processing of personal data in recruitment is primarily based on Taipuva’s legitimate interest in carrying out recruitment and assessing the suitability of job applicants.
Where required, the processing of personal data is based on the data subject’s consent, for example when collecting references or retaining applicant data for future recruitment purposes.
In certain cases, processing may also be necessary to comply with legal obligations.
Contents of the Register
The register may contain personal data necessary for the purposes of the register, including information falling into the following categories:
- Basic information about the job applicant, such as name and contact details (address, email address, phone number).
- Information necessary for assessing suitability for the role, such as education, profession, special skills, driving licence, possibility to use a car for work tasks, and where permitted or required by law, credit information, security clearance, and criminal record certificates together with related identification data.
- Information related to personal assessments, suitability evaluations, and drug tests.
- Information related to previous or current employment, including employers, employment dates, nature of duties, and references provided by employers.
- Information concerning the applicant’s job search, such as position preferences, salary expectations, preferred workplace, and information related to starting or ending employment.
Sources of Personal Data
Personal data is primarily collected directly from you during the recruitment process, for example when you submit a job application and CV.
Information related to your previous or current employment may be collected with your consent through feedback obtained from your employer.
With your consent, personal data may also be collected from parties conducting assessments on behalf of the data controller or from external partner companies providing assessment services.
Applicant information may be collected from public sources, such as LinkedIn, only if you have directed the employer to the source or provided your consent.
Provision of Personal Data
The provision of personal data is generally voluntary. However, certain personal data is necessary in order to process a job application and carry out the recruitment process.
Personal data required for recruitment includes basic identification and contact details, educational background, work experience, skills, and other information necessary to assess suitability for the position.
If an applicant chooses not to provide such required information, Taipuva may be unable to process the application or continue the recruitment process.
The provision of additional information, such as references, assessment results, or consent to retain personal data for future recruitment purposes, is voluntary. Failure to provide such information does not prevent participation in the recruitment process but may limit the extent to which the application can be evaluated.
Retention Period of Data
Applications and all related personal data are retained for the duration of the recruitment process and deleted no later than six months after the process has ended, unless the applicant has provided separate consent for a longer retention period, for example for future recruitment purposes.
Personal data may be retained for a longer period where necessary for the establishment, exercise, or defence of legal claims.
Disclosure and Transfer of Personal Data
Disclosure of personal data refers to situations where personal data is shared with third parties in connection with the recruitment process.
Personal data may be processed by service providers acting on behalf of Taipuva Consulting Oy and Taipuva Consulting AB (data processors) or disclosed to public authorities where such disclosure is required by applicable law.
Personal data may also be shared between Taipuva Consulting Oy and Taipuva Consulting AB as part of joint recruitment processes. Personal data is disclosed only where necessary for recruitment purposes and in accordance with applicable data protection legislation.
Personal data may be disclosed to:
- Providers of cloud-based HR and recruitment systems.
- Providers of suitability and assessment services, including partners conducting role-related pre-assignment tasks, personality assessments, aptitude tests, and ability tests.
- IT and hosting service providers.
- Partners providing background checks or other recruitment-support services.
- Public authorities where disclosure is required by applicable law.
Taipuva Consulting does not disclose personal data to third parties other than those listed above unless explicit consent has been obtained from the data subject or disclosure is required by law.
For technical implementation purposes, personal data may be stored on servers operated by external service providers located within the EU/EEA. Such data is processed through secure technical connections and in compliance with applicable data protection legislation.
As a general rule, personal data is not transferred outside the EU/EEA. If transfers outside the EU/EEA occur, they will be carried out in accordance with GDPR requirements and subject to appropriate safeguards.
All service providers used by Taipuva Consulting are required to ensure that personal data is processed securely, lawfully, and in accordance with an adequate level of data protection.
Protection of Personal Data
We protect personal data against loss, unauthorised access, and other potential misuse through appropriate technical and organisational measures.
Data is stored in databases protected by firewalls, passwords, and other technical safeguards.
Access to personal data is restricted internally through access controls and system permissions. Only employees who require access to personal data to perform their job duties are granted access.
Databases are located in secured and monitored facilities, and only designated individuals with specifically assigned access rights can access the data.
Data Subject Rights
Data subjects have several rights regarding the processing of their personal data.
They have the right to:
- Access the personal data stored about them and review that information.
- Verify whether any personal data concerning them is held in the register.
- Obtain information regarding the sources of personal data, the purposes of processing, and the regular recipients of such data.
- Request correction, deletion, or supplementation of inaccurate, unnecessary, incomplete, or outdated personal data.
- Request restriction of processing where applicable under GDPR.
- Request the transfer of personal data from one system to another when processing is based on consent or a contract and the data was collected directly from the data subject.
- Object to the processing of personal data based on legitimate interests, public interest, or the exercise of official authority.
Where processing is based on consent, such as the collection of references or the retention of data for future recruitment purposes, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
Data subjects also have the right to lodge a complaint regarding the processing of their personal data.
In Finland, the competent supervisory authority is the Office of the Data Protection Ombudsman.
In Sweden, the competent supervisory authority is the Swedish Authority for Privacy Protection (IMY).
How to Exercise Your Rights
Requests may be made in the following ways:
- By sending a written request to the email address provided in the Contact Information section above.
- By submitting an access request in person at the address provided in the Contact Information section at a separately agreed time.