Privacy Policy
Updated: 5th March 2025
PRIVACY NOTICE FOR QVIK OY’S JOB APPLICANTS’ REGISTER

1. Controller

Qvik Oy
Urho Kekkosen katu 5 C, 00100 Helsinki
+358 20 7354 355
info@qvik.fi
(”we” or ”Qvik”).

2. Contact person for register matters

Katriina Manneri
Urho Kekkosen katu 5 C, 00100 Helsinki
katriina.manneri@qvik.fi

3. Name of the register

Job applicants register

4. What is the purpose and the legal basis of processing personal data?

The purpose of processing personal data is to receive and to process job applications and to manage
our recruitment processes. We process data related to the recruitment process of the people who
have applied for our positions to enable contacting the applicant and for the decision making when
filling in the positions.

The legal basis for processing personal data is:

• our legitimate interest, which is based on the need to process personal data for recruitment
  purposes and which is formed of the connection between us
• your consent, which can be requested for example in the following situations:
  • collecting personal data from references
  • processing personal data in aptitude assessments
  • processing personal data when executing medical tests

5. What data do we process?

• basic information such as first name and surname;
• contact details such as private email address, private phone number, home address;
• information regarding the position in question such as information of the nature and type of
  the employment and information of the contact persons designated for the application
  process, salary request, information of the beginning of the job;
• important information regarding suitability that you have provided us in connection with the
  recruitment process and other information of yourself, your background etc. such as a
  photograph, information regarding study and education, occupation, information regarding
  work history (such as employers, starting date and duration of employment and nature of the
  duties), language skills, other special skills and competence, description of personal features,
  different kinds of certificates and evaluations and references to the portfolios, profiles and
  other sources on the Internet and references and personality and aptitude assessments
  performed based on your consent and information regarding them;
• information regarding the proceeding of the recruitment process such as information of
  following interviews or the interruption of the recruitment process;
• other possible information that you have provided us voluntarily in connection with the
  recruitment process or specifically published for professional purposes such as a LinkedIn
  profile or information we have separately collected based on your consent.

Providing your data is a requirement for us to be able to move forward in the application process.

6. From where do we receive information?

The source of information saved in the register is primarily you as a job applicant. Other sources of
information are used within the limits of the applicable regulations. We may use recruitment
consultants if needed.

By submitting a job application you consent for us to collect information from your profile published for
professional purposes to the extent that collecting data is necessary and related to job performance
taking into consideration the open position.

7. To whom do we disclose and transfer data, and do we transfer data outside the EU
or EEA?

By rule, we do not disclose data from the register to external parties, unless we have requested and
gotten your consent for the disclosure of e.g. aptitude assessments. We disclose personal data in a
manner permitted and obligated by the current legislation to parties, who based on legislation, and/or
contract have the right to receive data from the register, such as public employment and business
services offices. We may also disclose data for other purposes in accordance with Finnish laws.

We process data ourselves and use subcontractors for processing personal data on behalf of and for
us. In addition, we use subcontractors in the processing of personal data in the following services:

• Human resources
• Recruitment services
• IT management

We have ensured the protection of your data by making necessary contracts with the subcontractors.
We cannot name all our subcontractors, in part due to projects in development, so we have decided
on naming only the types of subcontractors. We transfer personal data outside of the EU/EEA. When
personal data is processed outside the EU/EEA, we make sure that the subcontractor has committed
to use the EU Commission’s standard contractual clauses and/or is covered by the Privacy Shield
system.

8. How do we protect the data and how long do we store them?

Only those of our employees, who on behalf of their work have the right to process personal data, are
entitled to use the systems containing personal data. The register is protected by the necessary
technical and organizational measures. Data is collected in databases that are protected by a user
name, password, firewalls and other technical measures. The register is stored on the servers of the
technical administrator and the electronic connection is protected. The persons processing data are
bound by professional secrecy of the information they receive. The databases and their backups are
in locked premises secured by access control and camera surveillance and can be accessed only by
certain predesignated persons.

We store personal data for only as long as it is necessary due to the purpose of use. In principle your
data will be stored for two (2) years after leaving your job application. If you become our employee,
we store the data you have provided as a job applicant and the information related to the recruitment
process as a part of your HR profile according to our privacy notice regarding our employee register.
We evaluate the need to store data regularly considering the applicable legislation. In addition, we
take care of such reasonable measures which ensure that no incompatible, outdated or inaccurate
personal data, taking into account the purpose of the processing, is stored in the register. We correct
or erase such data without undue delay.

9. What are your rights as a data subject?

You have the right to inspect the personal data stored in the register concerning yourself and the right
to demand rectification or erasure of incompatible, outdated or inaccurate personal data. Insofar as
the processing is based on consent, you also have the right to withdraw or change your consent.
Withdrawing your consent does not affect the lawfulness of processing before the withdrawal of the
consent. You have the right to object or to demand restriction of the processing of your data and to
lodge a complaint with the supervisory authority.

On grounds relating to your particular situation you also have the right to object other processing
activities when the legal basis of processing is the legitimate interest. In connection with your request,
you shall identify the specific situation, based on which you object to the processing. We can refuse
the request of objection only on legal grounds.

10. Who can you contact?

The contacts and requests concerning this privacy notice must be submitted in
writing or in person to the person mentioned in section two (2).