Privacy Policy for Candidates

What’s this about?

Jobylon AB is the so-called data controller for your personal data, meaning we are responsible for how your personal data is processed (basically used) by us if you apply for a job with us, get recommended for a position, get in touch with us or we otherwise process your data for our own recruitment purposes.

The policy describes how the personal data of all Jobylonians is being used and your rights in relation to your personal data. It may be updated periodically why we recommend that you review this privacy policy from time to time to ensure you are aware of any amendments.

You can reach out to us at any time with questions regarding your personal data or this privacy policy. If you have any questions about how we process your personal data, please feel free to contact Legal, legal@joylon.com or send a letter to Sankt Eriksgatan 63 B, 112 34 Stockholm, Sweden.

Personal data we process about you

We process the following categories of personal data about you:

• Contact details. Your name, email address, telephone number and postal code.

• CV and other information about your worklife experience. We will process your CV, cover letter, work samples, references, letters of recommendation and other information you provide us with in your application or that has been provided to us during a sourcing or referral process. If sensitive data is included by you, we will process such information only to the extent necessary and justified in accordance with the consent you have provided us.

• Data from interviews, assessments and other reference information. This means notes from interviews with you, assessments or tests made, expectations and salary requirements.

• Communications data. We will collect and store your communication with us and any information provided to us in such communication.

• Special categories of personal data (“sensitive data”). If sensitive data is included by you in your communication with us or in your resume, we will process such information only to the extent necessary and justified in accordance with the consent you have provided us.

How we collect your personal data

Information you provide to us. Most of the information we process about you is received from you. You may directly or indirectly give us information about yourself in different ways, for example when you contact us or through your application. You can always choose not to provide us with certain information. However, some personal data is necessary in order for us to process your application.

Information collected in other ways. We may also obtain your personal data from your current employer or the website of your employer and/or through third parties such as LinkedIn and/or a recruitment service provider, commonly known as “sourced recruiting”. Furthermore, our employees can give us a recommendation about a potential candidate.

How we process your data and the legal grounds

We will primarily process your personal data for the purposes of assessing candidates in a recruitment process, fullfil an agreement with you, legal obligations and other legitimate interests.

We process your personal information for the following purposes and based on the following legal bases:

• To administer incoming applications. Your personal data will be processed in order for us to administer and manage incoming applications. This processing is based on a balancing of interests, where our legitimate interest is being able to have a structured application- and selection process.

• For the recruitment and selection process. We will process your personal data during the recruitment process, including sourced recruitment, for the purpose of finding and determining whether you are a good fit for us, based on our legitimate interest in being able to recruit personnel with the relevant competence for us.

• To communicate with you. Your contact details will be used to communicate with you. This processing is necessary for our legitimate interest in effective communication with you in connection with your application or the recruitment process.

• To protect our legitimate business interests and legal rights. We will save and store information if we believe it is necessary to protect and enforce our legal rights, interests and the interests of others, for example in connection with legal claims, discrimination claims, compliance, regulatory and audit functions. This processing is based on a balancing of interests, where one legitimate interest of ours is defending and enforcing legal claims.

• To be able to contact and consider you for future job openings. If you have given us our consent, we keep your personal data up to 3 years after the recruitment process has ended in order for us to consider and contact you for other job openings.

• Marketing of us as an employer. Based on our legitimate interest in being able to market us as a potential employer to relevant candidates your contact information might be used to send you newsletters regarding e.g. how it is to work for us or to send you event invitations if you have been in contact with us e.g. attended an event. If you do not wish to receive this kind of marketing, please use the instructions we have provided in the email you have received from us or contact us directly.

• To administer events that you are attending. If you attend one of our events, we will process the personal data necessary to be able to administer that event. Generally, the categories of personal data involved are your contact details, the company you currently work for and if we serve food – food preferences. This processing we base on our legitimate interest in being able to process the information needed to plan, provide and administer the event. In case you provide us with information of your allergies, we process this information based on your consent.

• In connection with a merger or acquisition. In connection with, due to strategical or business-oriented reasons, a potential merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company, the personal data we retain about you may be processed, shared or transferred, to parties involved in the process. This processing is based on our legitimate interest of being able to develop our business.

Jobylon will only process sensitive personal data if necessary for the purposes of fulfilling or exercising our, or your, obligations and rights in the field of recruitment, to defend us against or enforce legal claims, to protect your health in case of an emergency, or with your explicit consent.

How and to whom we share your personal data

Sometimes, we need to share your personal information with other trusted individuals and companies. Your personal information is shared with:

• Our consultants. Your personal data will, when appropriate, be shared with our trusted consultants. However, we will restrict access to those consultants who need it to perform their jobs, for example to provide recruiting services to us. Our consultants are of course subject to strict confidentiality.

• Suppliers. Your personal information will be shared with companies that provide different types of services to us. For example:
  
  - Suppliers used for providing our recruitment system Jobylon,
  - Communication systems providers, such as email,
  - social media, marketing and event companies, and
  - statistics and survey companies (e.g. for personality or competence tests).
  
  These suppliers will either act as data processors can then only use your data as instructed by us or to fulfill their legal obligations, or they will be data controllers. Do not hesitate to reach out to us if you wish to know which suppliers that are data controllers for your personal data, in order for you to access their privacy policies.

• Public authorities and other actors, including trade unions. Sometimes legal obligations may require us to share information about you, for example to respond to lawful requests from law enforcement agencies, regulatory agencies, and other public and government authorities. We may also disclose information if needed to detect and prevent fraud.

• Parties involved in a legal proceeding. In connection with a potential legal proceeding, including in the preparatory work for us to be able to defend us against or enforce any legal claims, your personal data may have to be shared with parties involved in the proceedings, such as lawyers.

• Parties involved in an acquisition, merger, or sale of business. We may, for strategic or commercial reasons, decide to sell or transfer all or parts of the company in the future. As part of a transaction, your personal information may need to be shared with parties involved in the transaction.

• Other parties. We may also disclose your personal data to other companies, organizations or persons with your approval.

Transfer of your personal data outside the EU/EEA

We always strive to process your personal data strictly within the EU/EEA, however in certain cases there may be a risk of a transfer outside of the EU/EEA. As the privacy laws may not be the same as in the EU/EEA we will do everything we can to protect your data. We select our service providers carefully and take all the necessary steps to ensure that your personal data is processed with adequate safeguards in place in accordance with the GDPR. We always have a transfer mechanism in place, such as the EU Commission Standard Contractual Clauses or ensure that the service provider is established in a country that the EU Commission has deemed has adequate privacy protection, together with the necessary risk assessments and additional security measures where necessary.

Please contact us if you want information about the applicable countries and safeguards in specific cases.

How long we keep your personal data

We keep your personal data only as long as necessary to fulfil the purposes for which it was collected. How long depends on the type of information and why we process it. We regularly review our need to keep data, taking into account applicable legislation.

If you apply for a job, we generally keep the collected data during the recruitment process and if you become an employee at Jobylon AB we will keep your personal data during your employment (for other purposes than those stated above, which you will be informed of).

If you have been recommended to us, we keep your personal data for up to 2 years from the day we received the recommendation or if we have found you through sourced recruiting, up to 2 years months from the day we collected your data to be able to invite you to a recruitment process.

If you do not succeed in the recruitment process, we keep your personal data for up to 3 years from the day the recruitment process ended, if you have given us your consent. You can always contact us to withdraw that consent.

We furthermore save the personal data necessary for us to be able to defend ourselves against e.g. discrimination claims in up to 2 years from the day you received notice of whether you were successful or not in the recruitment process.

Personal data processed on the basis of your consent will be deleted when your consent is withdrawn or upon expiry of the purpose for which your consent was given.
Your data may also be stored for a longer period if required by applicable statutory retention periods.

Your rights

The personal data is yours. Therefore, you have the right to information and to influence how your personal data is processed by us. Following is a short summary of your rights.

• A right to object to processing. You have right to object to processing based on legitimate interest. This means that we may no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests. You can always contact us for more information on the balance test that has been made.

• A right to access and portability. You may at any time request a copy of your personal data and information on how this data has been collected, used, shared, etc. You may also have the right to transfer your personal data to another data controller, such as another employer.

• A right to erasure. You have the right to request that we delete personal data about you, for example if the data is no longer necessary in relation to the purposes for which it was collected or otherwise processed, or if there is no legal basis for processing the data.

• A right to rectification. You have the right to request that we correct inaccurate or incomplete information about you.

• A right to restriction. You have the right to request that our processing of your personal data shall be limited until we have corrected inaccurate or incomplete data about you or until we have handled an objection from you.

• A right to withdraw your consent. You have the right, at any given time, to withdraw any consent you have given us. Please note that this will not affect any processing that has already taken place.

• A right to complain to your supervisory authority. You are entitled to contact the supervisory authority if you believe that we have handled your personal data incorrectly. You can lodge a complaint with the supervisory authority in the country where you live or work. Our lead Supervisory Authority is Integritetsskyddsmyndigheten (Sweden) why you can always contact them.

Please note that if you request restriction or erasure it might affect our ability to process your application or consider you for a job. Moreover, legal rights or obligations may prevent us from disclosing or transferring all or part of your information, or from immediately deleting your information.