Recruitment Privacy Statement

This Privacy Statement provides information to data subjects in accordance with the EU General Data Protection Regulation (GDPR).

Each of the following companies acts as an independent data controller concerning the personal data processed during their respective recruitment activities:

Ilkka Paananen Foundation (Business ID: 2680141-2)
Illusian Group Oy (Business ID: 2635423-7)
Illusian Capital Oy (Business ID: 3303834-7)
Napkin Operations Oy (Business ID: 3323874-4)
(Collectively referred to as “Illusian”)

Address: Aleksanterinkatu 11, FI-00100 Helsinki
Email: privacy@illusian.org

Independent Data Controllers mean that each company is solely responsible for determining the purposes and means of processing personal data for its own recruitment processes. When you apply for a position with any of these companies, that specific company will be the data controller of your personal data related to that recruitment.

While these companies are collectively referred to as ”Illusian”, they conduct their recruitment activities independently. Personal data collected during the recruitment process is not shared between these companies unless explicitly stated and agreed upon by you.

You may exercise your data protection rights (such as access, rectification, erasure, etc.) directly with the specific company handling your application.

Each independent controller has their own registry:

Ilkka Paananen Foundation – Recruitment Data Registry
Illusian Capital Oy – Recruitment Data Registry
Illusian Group Oy – Recruitment Data Registry
Napkin Operations Oy – Recruitment Data Registry

Illusian is committed to processing your personal data in compliance with the GDPR principles outlined in Article 5:
Lawfulness, Fairness, and Transparency: We process your data lawfully and transparently.

Purpose Limitation: Data is collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes.

Data Minimization: We collect only the data necessary for the recruitment process.

Accuracy: We keep your personal data accurate and up to date.

Storage Limitation: Data is retained only as long as necessary for the purposes stated.

Integrity and Confidentiality: We ensure appropriate security of your personal data.

Security Measures: We implement technical and organizational measures to protect your personal data against unauthorized access, loss, destruction, or damage, including:

– Secure IT infrastructure with firewalls and encryption.
– Restricted access to data through appropriate access controls.
– Regular training for personnel on data protection and safe data processing.
– Confidentiality obligations for all employees handling personal data.

All personal data is collected directly from the applicant, unless explicitly provided by referees or from publicly available professional platforms, such as LinkedIn.

A. Job Application

Data collected in connection to applying for a position:

Personal data:
Name, date of birth, contact details
Education, previous experience, and competence
Application, CV, and photograph (if provided)
References and referees (if provided)
Interview notes (including salary request, start date, etc.)

Purpose of Processing:

To assess your suitability for the role applied for.
To communicate with you throughout the recruitment process.
To make informed hiring decisions.

Legal Basis:

The processing of this data is based on Illusian’s legitimate interest and, where necessary, contractual obligations to manage recruitment activities.

Retention Period:

Applicant data is retained until the recruitment process is completed and up to 24 months afterward. If a candidate is selected, data may be processed for up to 6 months after the start date to address potential recruitment needs during the statutory probation period.

With your consent, we may retain your personal data for future job opportunities that match your profile. You have the right to withdraw this consent at any time.

B. Collecting referees

Personal Data Collected:

Name and contact details
Notes from the discussion regarding the applicant’s qualifications

Purpose of Processing:

To verify information provided by you.
To assess your suitability for the role.

Legal Basis:

Legitimate interest to assess the candidate’s suitability for the role.

Retention Period:

Referee data is retained until the recruitment process is completed and up to 24 months afterward, similar to applicant data.

C. Surveys

Illusian may collect feedback through surveys to improve the recruitment process.

Personal Data Collected:

Name (if provided)
Email address (if provided)
Survey responses

Purpose of Processing:

To gather feedback and improve our recruitment process.

Legal Basis:

Consent (survey participation is voluntary).

Retention Period:

Survey data is retained for 12 months.

Participation in surveys is voluntary, and refusal to provide consent will not affect your application or chances of employment.

Illusian may use third-party service providers (e.g., external recruitment platforms or hosting providers) to facilitate recruitment activities. Personal data is transferred only to the extent necessary to provide these services.

Data may be transferred outside the EU/EEA if required. In cases where data is transferred to countries without an adequacy decision by the European Commission, Illusian ensures appropriate safeguards by using EU Standard Contractual Clauses (SCCs) or by working with service providers certified under the EU-US Data Privacy Framework, where applicable.

Illusian does not make recruitment decisions based solely on automated processing, including profiling. All decisions regarding recruitment are made by human review.

Right to Access

You have the right to request and receive confirmation of whether your personal data is being processed, and if so, obtain a copy of the data.

Right to Rectification 

You can request the correction of inaccurate or incomplete personal data.

Right to Erasure 

You may request the deletion of your personal data if it is no longer necessary for the recruitment process or if the processing is based on consent and you withdraw that consent.

Right to Restriction of Processing 

You can request that the processing of your personal data is restricted under certain conditions, such as when contesting the accuracy of the data or if the processing is unlawful.

Right to Data Portability 

Where your data is processed based on a contract, you may request to receive it in a structured, commonly used, and machine-readable format, or to have it transmitted to another controller where technically feasible.

Right to Object 

You can object to the processing of your personal data where it is based on legitimate interest, unless there are clearly demonstrated legitimate grounds for the processing.

Right to Withdraw Consent 

Where data is processed based on your consent, you can withdraw your consent at any time without affecting the lawfulness of processing prior to withdrawal.

Right to file a Complaint 

If you believe your personal data has been processed in violation of data protection laws, you may file a complaint with the supervisory authority:

Office of the Data Protection Ombudsman
Lintulahdenkuja 4, 00530 Helsinki
PL 800, 00531 Helsinki
Email: tietosuoja@om.fi

right to judicial remedy 

If you are dissatisfied with the outcome of a complaint to the supervisory authority, you have the right to seek a judicial remedy in accordance with applicable data protection laws.

How to Exercise Your Rights:

Contact us at privacy@illusian.org with your request.

Please specify the right you wish to exercise and provide sufficient information for us to process your request.

Illusian will respond to requests for access, rectification, erasure, or restriction of processing within one month of receiving the request. This period may be extended by two additional months if necessary, considering the complexity and number of requests. You will be informed of any such extension and the reasons for it.

Your personal data will be processed solely for the recruitment purposes described in this statement and will not be used for any other purposes unless required by law or with your explicit consent.

Illusian is continuously developing its activities and may therefore be required to amend and update this privacy statement when necessary. Amendments may also be required to reflect changes in data protection legislation. Any substantial changes to the way we process your personal data will be communicated in advance where required.

If you have any questions or concerns about this privacy policy or your personal data, please contact us at privacy@illusian.org.