Zimpler’s Privacy Notice for Job Applicants and Candidates

We greatly appreciate your interest in working at Zimpler!

Zimpler AB, org.no 556887-9984, with registered address at Wallingatan 2, 111 60 Stockholm (”Zimpler”, “we”, “us” or “our”) cares about your privacy and we always strive to achieve a high level of protection for your personal data. In this privacy notice we will among other things explain how we in connection with a recruitment process collect and process your personal data.

For the processing of personal data that we undertake as a part of our recruitment process Zimpler acts as the data controller.

If you have any questions in regards to this privacy notice, please feel free to contact us at privacy@zimpler.com.

1 OUR PROCESSING OF YOUR PERSONAL DATA
1.1 The personal data we process and why

When you apply for a job at Zimpler, we will need to process the following personal data about you, which we collect from you directly:

• Name
• Social security number
• Email address
• Phone number
• Address
• Work history
• Resume
• Other information you provide to us in your application

If you are a non-EU resident, we will also process:x

• Copy of your ID card
• Residence permits

In addition, on a voluntary basis, we ask you to provide us with your demographic information. This information will be processed separate from your personal data and the application process, and whether you choose to answer will not affect your job application. Maintaining a diverse organization is our priority and the information from this survey helps us improve the first step of that process as it helps us understand who is seeing and responding to our ads, whereby we can improve our job ads, their placements, and reach.

1.2 How we use your personal data
We collect and process the personal data in order for us to review your application and to evaluate you as a potential candidate for a position with us, both in regard to the position you have applied for or for any other position at Zimpler that we think you might be interested in. We will also process your personal data when we make decisions in our recruitment processes, when we contact you as well as when we are fulfilling our legal obligations and defending Zimpler in case of any legal claims in regard to a recruitment process.

If you continue on to the second step in our recruitment process, we may also want to conduct background checks to ensure that the information you have provided us is correct and that you are suitable for the position. You will receive information about this processing at a later stage of the recruitment process.

1.3 Legal basis for the processing
The legal basis for the processing of your personal data is either based on the performance of a contract (i.e. we process your personal data as first step to possibly enter into an employment agreement with you) or based on the balancing of interests (i.e. we have a legitimate interest to process your personal data in connection with our recruitment process, which is done in a way that does not interfere with your privacy).

If we need to perform any processing of personal data that would require your consent, we will obtain such consent from you in connection with the specific processing activity.

1.4 How long we keep your personal data
If your application results in you becoming an employee at Zimpler, the information we collect about you during the recruitment process will become a part of your employment record and be kept with us in accordance with our internal privacy policy. If you are not offered a position at Zimpler, we will save your personal data for two years for the purpose of regulating any potential claims.

If you provide us with contact details to someone providing you with a reference, please inform that person beforehand that Zimpler may contact them as a part of our recruitment process and that the personal data of that individual will be deleted once the recruitment process is finished.

1.5 Disclosure of personal data to third parties and storage
Your personal data may be shared within Zimpler’s organization for recruitment purposes and to external parties outside of Zimpler who we collaborate with in regard to the recruitment process (e.g. parties providing services to Zimpler as processors, such as Jobylon). Such third parties are only allowed to process your data in accordance with our instructions and by way of agreements we ensure a high level of security for your personal data. We may also be obliged to share your data with public authorities at their request in accordance with applicable legislation or a decision by a competent authority.

In this regard, your personal data is transferred, processed and stored both within and outside the EU/EEA. When the personal data is transferred outside the EU/EEA, we ensure that appropriate security measures have been taken, such as including the EU Commission’s standard contractual clauses for data transfers in our agreements with third parties as well as implementing any necessary supplementary measures.

1.6 Automated decision-making
Some of our recruitment processes may occasionally use limited elements of solely automated decision-making in order to confirm that we only proceed with candidates who meet the minimum requirements for a job, as set out in a job description. E.g. If the job description clearly requires a candidate to have had managerial experience and you are asked about this in the application form, your application may be rejected automatically if your answer in the application form is “No”. Automated decision-making is only used as an exception when we expect a high volume of applications which we cannot handle manually. You may always request a manual review of the decision by contacting us.

2 YOUR RIGHTS
In accordance with applicable data protection legislation, you have the following rights in connection with our processing of your personal data.

2.1 Right to information and access
You have the right to know if we process personal data about you. If we do, you also have the right to receive information about the personal data we process and why we do it. You also have the right to receive a copy of all personal data we have about you.

If you are interested in specific information, please indicate so in your request. For example, you can specify if you are interested in a certain type of information (e.g. what contact and identification information we have about you) or if you want information from a certain time period.

2.2 Right to have erroneous data corrected
If the data we have on you is incorrect, you have the right to have it corrected. You also have the right to supplement incomplete information with additional information that may be needed for the information to be correct.

Once we have corrected your data, or it has been supplemented, we will inform those we have shared your data with about the update, provided that it is not impossible or too cumbersome. If you ask us, we will also tell you who we have shared your data with.

If you request to have data corrected, you also have the right to request that we limit our processing during the time we investigate the matter.

2.3 Right to have data deleted
In some cases, you have the right to have your data deleted. You have the right to have your data deleted if:

• the date is no longer needed for the purposes for which we collected it,
• you withdraw your consent, if applicable
• you oppose our use that is based on our legitimate interest and we cannot show compelling grounds that outweigh your interests,
• the personal data has been used illegally, or
• deletion is required to fulfill a legal obligation.

If we delete data following your request, we will also inform those we have shared your data with, provided that it is not impossible or too cumbersome.

2.4 Right to data portability
Under certain circumstances, you may request to have your data transferred to another actor in a commonly used machine-readable format. This is also known as data portability. You can request data portability if we have collected the data from you, and our processing is based on your consent or if it is processed to enter into or fulfill an agreement with you.

2.5 Right to object
You have the right to object to processing that is based on our legitimate interest. If you object to the use, we will, based on your particular situation, evaluate if our interests in using the data override your interests, rights and freedoms. If we are unable to provide compelling legitimate grounds that outweigh yours, we will stop using the data you object to – provided we do not have to use the data to establish, exercise or defend legal claims. If you object to the use, you also have the right to request that we restrict our use during the time we investigate the matter.

2.6 Right to withdraw consent
You have the right to withdraw your consent for a specific processing at any time. You can withdraw your consent by contacting us at privacy@zimpler.com. Your withdrawal will not affect processing that has already been carried out.

2.7 Right to request restriction
Restriction means that the data is marked so that it may only be used for certain limited purposes. The right to restriction applies:

• When you believe the data are incorrect and you have requested correction. If so, you can also request that we limit our use while we investigate if the data are incorrect or not.
• If the use is illegal but you do not want the data to be deleted.
• When we no longer need the data for the purposes for which we collected it, but you need it to be able to establish, assert or defend legal claims.
• If you object to the use. If so, you can request that we limit our use while we investigate if our interest in processing your data outweighs your interests.

Even if you have requested that we restrict our use of your personal data, we have the right to use it for storage, if we have obtained your consent to use it, to assert or defend legal claims or to protect someone’s rights. We may also use the information for reasons relating to an important public interest.

We will let you know when the restriction expires.

If we limit our use of your data, we will also inform those we have shared your data with, provided that it is not impossible or too cumbersome. If you ask us, we will also tell you who we have shared your data with.

2.8 How to exercise your rights
If you want to exercise any of your rights, please contact us at privacy@zimpler.com and we will help you with your request.

2.9 Complaints
If you have any complaints regarding how we process your personal data even after you have notified us of this, you are always entitled to submit your complaint to the relevant supervisory authority in your country. In Sweden, the supervisory authority is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten).

3 CONTACT INFORMATION

Data controller
Name: Zimpler AB
Org. no: 556887-9984
Postal address: Wallingatan 2, 111 60 Stockholm
E-mail address: privacy@zimpler.com

Zimpler has appointed a Data Protection Officer (DPO) who is responsible for monitoring our compliance with applicable data protection legislation. If you have any questions to us, or feel you need any part of this policy explained, please contact us by sending an e-mail to our support team at privacy@zimpler.com, or to our DPO Karin Schurmann at dpo@zimpler.com.

4 VERSIONS IN OTHER LANGUAGES THAN ENGLISH
The original version of this privacy policy is written in English. To the extent that a translated version of this privacy policy conflicts with the English version, the English version shall prevail.

5 CHANGES
We reserve the right to make changes to this privacy notice from time to time. We will inform you of any changes by posting the updated notice on our website.

This privacy policy was last updated in February 2023.