Recruitment Privacy Statement for Illusian

1. General

This Privacy Statement provides information to data subjects as required by the EU’s General Data Protection Regulation (GDPR).

2. Controller and Controller’s contact details

Illusian, Korkeavuorenkatu 35, FI-00130 Helsinki

3. Name of registry

Recruitment Privacy Statement

4. Content of registry, purposes of processing and legal basis of processing

A. Job Application

Data collected in connection to applying for a position

Personal data

  • Background information (name, date of birth, contact details)
  • Information on education, previous experience, and competence
  • Possible application, CV, and photo
  • Possible references/referees
  • Possible interview notes, incl. salary request, start date, etc.

Legal basis

Statutory requirement

Processing period

Until the recruitment process is finished and up to 24 months after it

B. Collecting referees

Collecting data when an applicant has referees

Personal data

  • Background information (name, contact details)
  • Notes on the discussion

Legal basis

Legitimate interest

Processing period

Until the recruitment process is finished and up to 24 months after it

C. Surveys

Questionnaires used to develop and improve the recruitment process

Personal data

  • Name
  • Email address
  • Responses

Legal basis

Consent

Processing period

12 months

5. Transfer of personal data

Illusian reserves the right to use subcontractors for recruiting. In this event, personal data can be transferred to the subcontractors in the extent that is required for the subcontractor to provide the service (e.g., storing data on a server hosted by a third party on behalf of Illusian, using a recruitment system).

When transferring data stored in the registry, the Controller will observe all statutory requirements. The Controller may process personal data in systems that transfer data outside the EU/EEA. If the European Commission has not verified that the third country offers an adequate level of data protection, we will guarantee a sufficient level of data protection through agreements or other measures.

Data from the service is transferred to the following subcontractors (updated on 11 May 2021):