Recruitment Privacy Statement

This Privacy Statement provides information to data subjects as required by the EU’s General Data Protection Regulation (GDPR).

Illusian Group Oy (2635423-7)
Illusian Capital Oy (3303834-7)
Napkin Operations Oy (3323874-4)
Aleksanterinkatu 11, FI-00100 Helsinki

Email address: compliance (at) illusian.org

Recruitment Privacy Statement

Illusian processes personal data in a manner that ensures the appropriate security of the personal data, including their protection against unauthorised processing and accidental loss, destruction or damage.

Illusian uses appropriate technical and organisational safeguards, which include the use of firewalls, encryption techniques and safe equipment rooms, appropriate access control, careful management of data system user IDs, and providing instructions to the personnel participating in the processing of personal data.

All employees processing personal data have a non-disclosure obligation for matters related to the processing of personal data of the data subjects based on the Employment Contracts Act (55/2001) and non-disclosure agreements that supplement it.

A. Job Application

Data collected in connection to applying for a position:

Personal data:
Background information (name, date of birth, contact details)
Information on education, previous experience, and competence
Possible application, CV, and photo
Possible references/referees
Possible interview notes, incl. salary request, start date, etc.

Legal basis:
Statutory requirement

Processing Period:

The applicant’s data is retained until the recruitment process is finished and up to 24 months after it. The data may be processed for up to 6 months after the selected applicant’s start date if another person is needed to fill the position during the statutory probation period.

B. Collecting referees

Collecting data when an applicant has referees:

Personal data:
Background information (name, contact details)
Notes on the discussion

Legal basis:
Legitimate interest

Processing period:

The referees’ data is retained until the recruitment process is finished and up to 24 months after it. The data may be processed for up to 6 months after the selected applicant’s start date if another person is needed to fill the position during the statutory probation period.

C. Surveys

Questionnaires used to develop and improve the recruitment process:

Personal data:
Name
Email address
Responses
Legal basis
Consent

Processing period:

12 months

Illusian reserves the right to use subcontractors for recruiting. In this event, personal data can be transferred to the subcontractors in the extent that is required for the subcontractor to provide the service (e.g., storing data on a server hosted by a third party on behalf of Illusian, using a recruitment system).

When transferring data stored in the registry, Illusian will observe all statutory requirements. Illusian may process personal data in systems that transfer data outside the EU/EEA. If the European Commission has not verified that the third country offers an adequate level of data protection, Illusian will guarantee a sufficient level of data protection through agreements or other measures.

Right to Access

The applicant has the right to request and receive confirmation on whether their personal data is being processed. If it is, they have the right to access their data and obtain a copy.

Right to Rectification 

The applicant has the right to request the correction of any inaccurate or incomplete personal data concerning them.

Right to Erasure 

The applicant has the right to request the deletion of their personal data, if the data is no longer necessary for the purposes for which it was collected, or if the data is collected based on consent and the applicant withdraws consent.

Right to Restriction of Processing 

The applicant has the right to restrict the processing of their personal data concerning them if the data subject contests the accuracy of their personal data; the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of its use instead; or the controller no longer needs the personal data for the purposes of the processing, but it is required by the data subject for the establishment, exercise or defence of legal claims.

Right to Data Portability 

The applicant has the right to receive their personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller where technically feasible.

Right to Object 

When the data is processed based on legitimate interest, the applicant has the right to object to the processing of their personal data.

Right to Withdraw Consent 

When the processing of data is based on consent, the applicant has the right to withdraw that consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

Right to Lodge a Complaint 

If the applicant believes that the processing of their personal data violates data protection laws, they have the right to lodge a complaint with the relevant supervisory authority to Lintulahdenkuja 4, 00530 Helsinki, PL 800, 00531 Helsinki, tietosuoja@om.fi.

Illusian is continuously developing its activities and may therefore be required to amend and update its privacy policies when necessary. The amendments may also be based on changes in the legislation concerning data protection.