Purpose
Purpose of this privacy notice is to provide job applicants information about processing of their personal data in Oriola (as defined herein). This Privacy Notice gives a general understanding of such personal data processing. However, the individual recruiting situations may vary significantly. Thus, all of the information provided in this privacy notice may not be applicable to each different data processing situation related to job applicants. If you want more detailed information in relation to how specifically your personal data is being processed, you should contact use the contact information provided in section 13 of this Privacy Notice.
Data Controller
In respect of each data subject’s personal data, the controller is regarded to be the Oriola group company organising the recruitment. This may be either Oriola Oyj, Oriola Finland Oy, Farenta Oy, Farenta 1 Oy, Farenta 2 Oy, Pharmaservice Oy, Kronans Droghandel Apotek AB, Oriola Sweden AB, Svensk dos AB or ICTHS Health Support AB.
For the avoidance of doubt, in this privacy notice “Oriola” shall refer to the company acting as the data controller in each individual case, or companies acting as joint controllers in each individual case.
Regardless of the applicable data controller in each situation, the data subjects can always use their rights by contacting their own principal or Oriola Oyj as instructed in section 13.
Lawfulness of Processing of Data
Processing of the personal data is based on the data controller’s legitimate interest to process personal data for the purposes of recruiting as well as the connection between Oriola and the applicant participating to the recruiting process. For some parts, processing of the personal data is also necessary for the purposes of preparing the employment contract. In some cases Oriola may be required to collect certain information in order to fulfil its statutory obligations.
Local legislation may require the data controller to acquire the applicant’s consent for processing of certain type of personal data or for conducting of certain processing activities. Also in these cases, processing of the personal data is based on the data controller’s legitimate interest, and only personal data relevant for fulfilling of such reasonable legitimate interest shall be collected.
Purpose of Processing of Data
The purpose of processing of personal data is to receive and handle applications from job applicants for recruitment and selection purposes. The applications can be open applications or intended for a certain specific job opening. The applicants filing such job applications can be internal (Oriola’s current employees) or applicants not currently employed by Oriola.
In certain cases the data may be used for fulfilling of Oriola’s statutory obligation. Such obligations may relate to e.g. proving that the recruitment decisions have been non-discriminatory.
Certain data processing activities may be outsourced to third parties, in which case such third-party processors operate on behalf of the data controller. E.g., the IT/operational management of online application system may be outsourced to an external IT supplier and the data may also be processed by external recruitment consultants who are handling applicant assessments and supporting Oriola in the recruitment process.
Content of Register
The register contains following information about persons applying for a job at Oriola:
- Personal information, including name, contact information, place of birth, year of birth, gender and other similar information necessary for identifying applicants;
- A cover letter and CV;
- The applicant’s education and work experience information;
- Possible suitability questionnaires and self-evaluation records;
- Potential other similar/relevant application-related information (such as applicant assessment reports by recruitment consultants) which the job applicants may want to disclose to Oriola in connection with their job application; and
- Subject to the applicable laws and applicants’ consent, background check information, such as information obtained through security clearances or similar information sources.
Regular sources of information
As a general rule, Oriola processes such application information which has been provided by a job applicant him/herself. The applicants enter their applications and information in the job applicant register on Oriola’s internet home page or in Farenta network page using an online service and software designed for the purpose. The applicants may also provide additional information by email or by phone to the persons handling his/her application.
Subject to the applicants’ consent, information may also be obtained from recruitment consultants interviewing applicants and handling applicant assessments as a part of the recruitment process. Also, subject to the applicable laws and applicants’ consent, information may be obtained through background checks, security clearances and other similar information sources deemed necessary due to the nature and security requirements related to the open position in question.
Data Retention
Oriola is actively processing the personal data of the applicants during the recruitment process. After the recruitment process has ended, Oriola passively retains the personal data for 24 months based on Oriola’s genuine needs and legislative requirements Oriola is subject to. For more information regarding the retention times, please contact Oriola as instructed in section 13.
If an applicant is chosen for the position, the basic information of the respective applicant as well as other information relevant for the employment relationship shall be transferred to Oriola’s employee information register. The retention times concerning Oriola’s employee information register are available in the respective register’s privacy notice made available to Oriola employees.
Regular Data Disclosure
Personal data may be disclosed to Oriola Group companies for purposes compatible with the processing purposes defined in section 4 of this privacy notice. Personal data is not regularly disclosed to any third party.
Data Transfers from EU/EEA
Personal data may be disclosed or transferred to Oriola’s suppliers.
Some of these entities may be located outside of EU/EEA countries. In such situations, the data controller ensures that sufficient level of data protection is maintained through appropriate safety measures, e.g. EU commission’s model clauses. More information of such international data transfers and the applied safeguards may be received by contacting the Data Controller as instructed in section 13.
Data Security
All data is primarily handled electronically in the recruitment system. If printouts are taken or any manual data is otherwise processed, the persons handling the recruitment process at Oriola are responsible for secure processing of such manual material and destroying the material when no longer needed in connection with the relevant recruitment process or if so requested by the applicant.
Access to any electronic or manual materials is limited only to those persons who need to process such information / personal data as a part of their duties within Oriola.
Automated decision making
In recruitment processes where the volume of the applicants, volume of the open positions or other similar reasons cause Oriola substantive administrative burden, Oriola may use automatic recruitment decisions in the first phases of the recruitment. The decision making is based on the information the applicant has given regarding his/her education, certifications and work experience as well as possible competence evaluation questionnaires (completed by the applicant him-/herself). This data is then automatically reflected to the pre-defined requirements set for the open position(s) in question and presented for the applicants in the job advertisement (e.g. language skills, education requirements, previous experience etc.).
As a result of the automatic reflecting, an automatic decision is produced regarding whether the applicant’s attributes and qualifications are suitable for the position. Based on this decision, the applicant is either invited to the next round of recruitment or the applicant receives an e-mail informing him/her that the recruitment process regarding the respective applicant has ended.
Data subject’s rights
12.1 Data subject’s right to object personal data processing
On grounds relating to his/her particular situation, data subject is entitled to object processing of personal data concerning him/her, provided that the processing is based on the data controller’s legitimate interest.
Data subject may send his/her request to object the processing in accordance with section 14 of this privacy notice. In this request, the data subject shall define the particular situation based on which data subject is objecting the data processing. Oriola may decline the request on statutory grounds.
12.2 Access to information
Data subject is entitled to obtain information of the personal data concerning him/her which Oriola is processing and obtain a copy of such personal data. Request for access may be presented to Oriola in accordance with section 13 of this privacy notice.
12.3 Right to rectification, erasure and restriction
Data subject is entitled to have any such personal data that is inaccurate, outdated, unnecessary or contrary to the purposes of data processing corrected or erased. Requests concerning rectification and erasure may be presented in accordance with the instructions in section 14 of this privacy notice.
Data subject is also entitled to have the data controller to restrict processing of the data subject’s personal data for example when data subject is waiting for the data controller’s answer to data subject’s access or erasure request.
12.4 Right to lodge a complaint
If the data controller does not follow the applicable data protection regulation, a data subject is entitled to lodge a complaint with competent data protection authority.
Contacting the Data Controller
In all questions and matters relating to personal data processing or rights of the data subject, data subjects can contact Oriola Oyj. Oriola Oyj shall further communicate the matter to the Oriola entity considered as the data controller in the respective case. Data subjects may use their rights by e-mail to
recruitments@oriola.com.
Data protection officer:
E-mail: GDPR-DPO@oriola.com
Tel: +46-701 981 322
https://www.oriola.com/se/oriola-privacy-notice/
