Privacy Notice – Job Applications

1. Data Controller 

Kojamo Plc (business ID 0116336-2)  

on behalf of itself and the companies belonging to the same group with it from time to time (hereinafter Kojamo) 

Mannerheimintie 168a  

00300 Helsinki, Finland  

Tel. +358 20 508 310 

2. Contact Information of the Data Protection Officer 

Data protection officer of the Kojamo Group 

Mannerheimintie 168a  

00300 Helsinki, Finland  

tietosuoja@kojamo.fi 

In case of questions related to the processing of personal data and situations related to the exercise of the data subject’s rights, the data subject must contact the above [person / address] in writing. 

3. Name of the Register 

Recruitment and job application register 

4. Purpose of and Legal Bases for Processing Personal Data 

Personal data are processed for receiving and processing job applications, selecting job applicants and fulfilling the needs related to the recruitment process. 

The processing of personal data is based on Kojamo’s legitimate interest to process personal data as required by the recruitment process in a relevant connection between Kojamo and the job applicant. In certain cases, the processing of personal data is also necessary for carrying out measures preceding the entering into an employment agreement between Kojamo and the job applicant and performing the employment agreement. 

5. Data Content of the Register  

  • name 
  • date of birth 
  • address 
  • telephone 
  • e-mail address 
  • basic education and degrees with the dates of completion 
  • other completed education 
  • skills in using applications and software 
  • special skills 
  • language skills 
  • current duties (employer, title and job description) 
  • principal prior duties (employer, title and job description) 
  • referees 
  • other data disclosed by the job applicant to Kojamo 

6. Regular Sources of Data  

Personal data are collected from the data subject himself/herself via the job application form submitted online or the paper job application form (including attachments). Personal data can also be collected from the data subject’s referees. 

7. Disclosure and Transfer of Data 

As a rule, personal data are not disclosed outside the Kojamo Group. Personal data can be disclosed, within the limits permitted and required by the legislation in force from time to time, e.g. on behalf of Kojamo to business partners carrying out debt collection as well as to parties that have the right to obtain data in accordance with the legislation, or if the establishment, exercise or defence of a legal claim requires that personal data are disclosed. Personal data can also be transferred to Kojamo’s service providers that process personal data on behalf of Kojamo under the obligation of confidentiality and a binding data processing agreement. 

As a rule, data are not transferred outside the European Union’s Member States or the European Economic Area, unless it is necessary for the purposes of the processing of the personal data or the technical implementation of the data processing. In such cases, the requirements of data protection legislation concerning implementing suitable or due safeguards must be complied with, e.g. by using the European Commission’s standard contractual clauses, and otherwise in such a way that the processing of personal data is carried out in accordance with this privacy notice. 

8. Storage Period of Personal Data 

Personal data are processed during the recruitment process, and they will be stored for a period of 2 years after the recruitment process has been completed. With the consent of the data subject, personal data can also be stored for a period of time mentioned when giving the consent, e.g. for future recruitment processes. If Kojamo and the applicant enter into an employment agreement, the personal data will be transferred to Kojamo’s personnel register. 

Personal data can be stored for a longer period, if this is necessary to fulfil Kojamo’s obligations under acts, decrees or any other authority sources. 

9. Protection of the Register  

The databases and data networks used for the processing of personal data are protected by technical and organisational measures. 

The manually maintained data sets are stored in locked premises to which only appointed persons who have signed a confidentiality agreement have access.  

The electronically processed data included in the register are stored in a centralised manner in a locked and monitored data centre which is protected with a firewall and other technical means. Only designated persons who have signed a confidentiality agreement have access to the data. These persons are required to use their individual user ID and password when logging into the system. 

10. Rights of the Data Subject 

Right to access data concerning you 

The data subject has the right to obtain confirmation from Kojamo of whether personal data concerning him/her are processed and to know what personal data concerning him/her are stored in the register. The data subject has also the right to obtain a copy of the personal data being processed. The access request must be sent to Kojamo in accordance with Section 2, and it must be in writing and signed. The access request can also be made in person at Kojamo’s office. The access request can be declined based on the grounds provided by law. The exercise of the right of access and the provision of a copy are usually provided free of charge; however, Kojamo may charge a reasonable fee based on administrative costs of taking the action requested, if the data subject requests copies repeatedly or the requests are manifestly unfounded or excessive. 

Right to request rectification, erasure or restriction of processing of personal data 

Kojamo will rectify, erase or complete any personal data in the register that is inaccurate, unnecessary, incomplete or obsolete for the purpose of the processing, either on its own initiative or at the request of the data subject (the data subject can contact Kojamo in accordance with Section 2). The data subject has also the right to demand Kojamo to restrict the processing of his/her personal data, for example, in a situation where the data subject is waiting for Kojamo’s response to the request concerning the rectification or erasure of the data. 

Right to object to the processing of personal data in certain cases 

The data subject has the right to object, on grounds relating to a particular personal situation, to processing of personal data by Kojamo which is based on Kojamo’s legitimate interest. In that case the data subject should contact Kojamo in accordance with Section 2 and specify the grounds on which he/she objects to processing. Kojamo can deny the request on the grounds provided by law. 

Right to withdraw consent 

If personal data are processed based on the data subject’s consent, the data subject has the right to withdraw his/her consent by notifying Kojamo in accordance with Section 2. 

Right to data portability 

To the extent that the data subject has provided data to the register to be processed in order to perform a contract between Kojamo and the data subject or based on a consent given by the data subject, the data subject has the right to receive this data in a structured, commonly used and machine-readable format and has the right to transmit those data to another controller (if this is technically feasible). 

Right to lodge a complaint with a supervisory authority 

The data subject is entitled to lodge a complaint with the competent supervisory authority if Kojamo has not complied with the data protection regulations applicable to its operations. 

Page updated 5 June 2019