Recruitment Privacy Notice for Nelly Group

Data privacy is important to Nelly Group (“Nelly”). We actively work to protect the personal data of all individuals who come into contact with us. The purpose of this Privacy Notice is to explain how Nelly handles personal data about you as a candidate for a job with our company and it also includes information on how we handle personal data of reference persons. This notice will also explain the rights both candidates and reference persons have under data protection law.

Personal data is any information about a natural person, who can be identified, directly or indirectly, from data that we hold about them or from data that is combined with other information.

The prospective employer within the Nelly Group is the data controller of your personal data (both candidates and reference persons) and as such responsible for the processing. Contact information to the Corporate Privacy Manager and the Data Protection Officer (“DPO”) is found at the end of this notice.

Jobylon is our partner and acts as a data processor in the recruitment process, providing and maintaining the recruitment platform on behalf of Nelly (the data controller). In this role, Jobylon processes personal data strictly in accordance with Nelly’s documented instructions and applicable data protection legislation.

Information about how personal data is processed in the recruitment process at Nelly can be found in this privacy notice and, where relevant, in Jobylon’s privacy information and cookie notice available on Jobylon’s website.

The information in this notice applies to candidates for jobs when recruitment data is collected by Nelly irrespective of how the application is initially submitted to us: via manual handling such as post or email, via our website or comes to us via Jobylon.

PERSONAL DATA WE COLLECT OR HOLD ABOUT YOU
The personal data that we collect during the recruitment process is limited to what is necessary for us to assess your qualifications and suitability for the position that you have applied for. This may include the following categories of information:

• Name; contact details such as your address, telephone number and email address; identification details such as national identification number.
• Application-related data such as information about your current position and role; information about education, language skills and previous job experiences (i.e. information contained in your CV); information about your interests and personal engagements (insofar such are included in your CV); information, profiles and/or posts contained on your work related social media (e.g. LinkedIn profile) and any other information you may wish to provide or decide to disclose to us as part of your application; and personal letter.
• Recruitment generated data, i.e. data generated during the recruitment process. We may require you to go through tests, we generally conduct interviews and we also collect references. In some instances, we may perform background checks, but then only when required due to the nature of our business or legal requirements.
• We may collect information about gender, ethnicity and/or disabilities in order to fulfill legal requirements about equal opportunities.
• Personal data about criminal convictions or medical information will only be collected and further processed where required by law or based on well-founded business interests and only when permitted by applicable law.

More information about the specifics for your particular recruitment process and details on the personal data covered can be obtained by contacting our Privacy Manager or DPO (see contact details below).

With regards to reference persons, Nelly will collect your personal data such as name and contact details and the information and opinions that are provided in relation to the candidate.

HOW YOUR PERSONAL DATA IS DATA COLLECTED
The personal data will primarily be collected directly from you, e.g. when you provide information to us as part of your job application or during the recruitment process, or from third parties, e.g. from recruitment agencies or test institutes. We will indicate whether the information we have requested is mandatory or optional for you to provide and we will also explain the consequences should you decide not to provide information to us. In some cases, this may mean that we are not able to proceed with your application.

Video questions may be used during the recruitment process. Participation is voluntary, and candidates who choose not to participate will not face any negative consequences.

With regards to reference persons, Nelly will collect your name and contact details from the candidate and the remaining information is collected directly from you.

PURPOSES FOR WHICH WE PROCESS YOUR PERSONAL DATA
We need to process a certain amount of personal data about you for a variety of purposes to manage the recruitment process. The purposes include:

• Managing your application; including comparing and assessing your education, experience and other professional qualifications with the job specification.
• Verifying your skills and / or assessing your personal traits through tests.
• Keeping in touch; we process your contact data with the purpose of being able to keep in touch with you during the recruitment process and about any future job opportunities (if applicable and consented to by you).
• Improving our application process; for example, to ensure that the careers section of our website is user-friendly and contains appropriate and helpful information.
• Security management; for example, to ensure the security of our premises, assets, information, employees and other personnel.
• Legal and regulatory compliance; for example, to ensure compliance with health & safety requirements and other legal or fiscal obligations, or in connection with litigation or an internal investigation or audit and to ensure compliance with our policies regarding bribery and corruption, as well as equal opportunities monitoring.
• Ensuring compliance with our Code of Conduct, for example to ensure that we are living up to our values.

We may verify the recruitment data you provide during the recruitment process and/or collect personal data about you from third party sources to assist with our pre-employment checks. If this occurs:

• You will be told in advance which aspects of your personal data will be verified, including an explanation of how the pre-employment checks will be carried out.
• Information about criminal convictions or medical information (if applicable) will only be collected through official authorized sources and in accordance with applicable law.

With regards to reference persons, Nelly will process your personal data with the purpose of collecting references of the candidate from you.

LEGAL GROUNDS FOR PROCESSING YOUR PERSONAL DATA
We will only process your personal data where we have a legal ground for doing so. Your personal data is processed based on different legal grounds:

• The majority of the processing is based on the legitimate interest of Nelly, i.e. the legitimate interest of the organization in finding qualified and suitable candidates to ensure the business is run appropriately. This includes e.g. processing of your contact data, information about previous job experiences and skills etc. This also includes e.g. collecting your photo and other information that is not explicitly necessary, but is collected since it brings extra value, such as information about your interests and hobbies, or it may be information that you decide to voluntarily share with us during the course of the recruitment process. This also includes processing to improve our application process and to manage security aspects.
• Certain processing may be based on compliance with a legal obligation, i.e. for the establishment, exercise or defence of legal claims in the context of the recruitment process and to be able to answer questions from you regarding the recruitment process.
• If you choose to being added to our career database regarding upcoming positions within Nelly that may be of interest to you, this processing is based on your consent. If you provide your consent for this purpose, you have the right to withdraw this consent at any time without any negative consequences.

More information on the legal grounds for specific processing operations and details on the personal data covered can be obtained by contacting our Privacy Manager or DPO (see contact details below).

DISCLOSURE OF YOUR PERSONAL DATA
We keep your personal data safe and confidential, in compliance with our legal obligations. However, there may be circumstances where we need to disclose your personal data to third parties to accomplish the purposes listed above or for other legitimate business purposes. If so, disclosure will be performed in compliance with applicable law. Where third parties (including data processors) are engaged to process personal data, Nelly will ensure that such third party has appropriate security measures in place to protect your personal data in line with Nelly’s own policies.

Your personal data may be shared:

• within the Nelly Group. We restrict access to your personal data to individuals who have a "need to know" such information. For example, certain individuals within Human Resources will have access to your personal data in order to process your application and manage the recruitment process.
• outside of the Nelly Group, with authorized and contracted third-party service providers to conduct and manage the recruitment process. For example, we may share your personal data with service providers in order to conduct pre-employment checks and verification of your application and the information you have provided to us, or to conduct tests.

DATA STORAGE AND INTERNATIONAL TRANSFER OF YOUR PERSONAL DATA
Your personal data will be stored within the EU/EEA. We may however disclose or transfer your personal data to a third party in countries outside the EU/EEA, for further processing in accordance with the purposes set out above. Your personal data may also be transferred throughout the Nelly Group.

Nelly will ensure that all data transfers are secure and performed in accordance with applicable law, and that your personal data is protected by technical and organizational safeguards as required by law.

More information on, and a copy of, the applicable safeguards and transfer mechanisms for individual transfers can be obtained by contacting our Privacy Manager or DPO (see contact details below).

RETENTION OF YOUR PERSONAL DATA
In general, Nelly retains your personal data for as long as it is necessary to fulfill the purposes for which it was collected, as required by legal obligations in the country in question and according to internal policies.

If you are successful in your application with us and an employment contract is signed, the personal data you provided during the recruitment process will remain on your employee profile. More information will be provided through our Employee Privacy Notice.

If you are unsuccessful in your application with us (or if you reject the position), we will typically delete the majority of your personal data after 2 years. However, we may retain your name and address or email address, a record of the role you applied for, the date of your application and on occasion your personal letter, for a period of 2 years. Also, and only if consented to by you, we may retain your personal data so that we may contact you again if another suitable position arises - in this situation we will retain such personal data for up to 2 years or until you withdraw your consent. After the end of the retention period, your personal data will be permanently deleted.

More information on specific retention periods for different types of personal data can be obtained by contacting our Privacy Manager or DPO (see contact details below).

YOUR RIGHTS AND HOW TO EXERCISE THEM
Data protection law sets out specific rights for you. These rights ensure transparency, access, and autonomy over personal data held by organizations, in this case Nelly. Your rights include:

• Right to be informed: You have the right to know if, why and how your personal data is being processed, and by what party. In relation to recruitment, this Recruitment Privacy Notice is one way of providing you with this information.
• Right of access: You have the right to know what personal data about you is collected, how it is used, and the purpose of its processing. You may request access to your personal data, and you also have the right to a copy of the information.
• Right to rectification: If your personal data is inaccurate or incomplete, you have the right to request corrections or additions to ensure data accuracy.
• Right to erasure (right to be forgotten): Under certain circumstances, you can request deletion of your personal data, especially if it is no longer necessary for the purpose it was collected or if you have withdrawn your consent (if the processing was based on consent).
• Right to restrict processing: You can request a temporary halt on data processing if you contest the accuracy of the personal data, object to the processing, or need data preserved for a legal claim.
• Right to data portability: If your personal data is processed based on performance of a contract, such as a future employment contract between us, or it is being processed by automated means based on your consent, you have the right to obtain your personal data in a structured, commonly used, and machine-readable format, so that you may use it for other matters with other data controllers.
• Right to object: Under certain circumstances and on grounds related to your particular situation, such as if you question the accuracy of your personal data, you have the right to object to data processing.
• Rights in relation to automated decision-making and profiling: You have the right not to be subject to decisions made solely based on automated processes, including profiling, which significantly affects you. You can request human intervention or contest such decisions.

Each of these rights ensure that you maintain control and oversight over your personal data, promoting transparency and accountability.

To exercise your rights, please contact our Privacy Manager via email at dpo@nelly.com.

USE OF COOKIES
In order to collect information and personal data about you for the purpose of recruitment, we may use cookies and other similar technologies on the recruitment platform that we utilize, i.e. our recruitment partner Jobylon. Please visit Jobylon’s Cookie Notice for more information emp.jobylon.com/companies/1158/cookie-policy/.

QUESTIONS, CONTACT INFORMATION AND COMPLAINTS
Should you have any questions regarding our processing of your personal data, or questions relating to this privacy notice, please contact our Privacy Manager and DPO at dpo@nelly.com.

If you have questions or concerns that you do not want to present directly to Nelly, or if you wish to file a complaint, you may contact the Supervisory Authority for each country directly:

For Sweden: the Swedish Data Protection Authority (Integritetsskyddsmyndigheten)
www.imy.com
Email: imy@imy.se
Phone: 08-657 61 00
Post: Integritetsskyddsmyndigheten, Box 8114, 104 20 Stockholm, Sweden

For Denmark: the Danish Data Protection Authority (Datatilsynet)
www.datatilsynet.dk
Email: dt@datatilsynet.dk
Phone: 33-19 32 00
Post: Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark