This privacy policy describes how Hurtigruten (“Employer”, “we”, “us”) (All associated legal entities listed below) collects and process personal data about job applicants (“Candidates”, “you”) through the service Jobylon (“Jobylon”), including your rights regarding your personal data and how to enforce them.

Hurtigruten hereafter refers to as a common nominator for the entirety of associated legal entities, here listed: Hurtigruten Asia Pacific Ltd, Hurtigruten Australia Pty Limited, Hurtigruten Estonia OÜ, Hurtigruten Global Sales AS, Hurtigruten Global Services AS, Hurtigruten GmbH, Hurtigruten Inc, Hurtigruten Ltd, Hurtigruten Norway AS, Hurtigruten Pluss AS, Hurtigruten SAS, Hurtigruten Sjø AS.

If you apply for a job, get recommended for a position, get in touch with one of the Hurtigruten entities or Hurtigruten processes your data through Jobylon, Hurtigruten is the data controller (as defined in the General Data Protection Regulation 2016/679 (“GDPR”)). Jobylon AB will only process your personal data as a data processor, meaning that it is Hurtigruten and not Jobylon AB who determines how and why your data is processed.

Please do not hesitate to reach out to Hurtigruten if you have any questions or comments regarding your personal data or this privacy policy:

Via email: recruitmentHRN@hurtigruten.com

Via regular post: Langkaia 1, 0150 Oslo, Norway.

You may of course always contact the Jobylon privacy team at privacy@jobylon.com with any questions you may have. However, please note that as a data processor Jobylon may not respond to your request or fulfil any of your rights without the approval of Hurtigruten. The Jobylon privacy team are however happy to forward your request to Hurtigruten.

Personal DATA THAT THE EMPLOYER PROCESS

We process the following categories of personal data about you:

• Contact details. Your name, email address, telephone number and postal code.
• CV and other information included in the application. We will process your CV, cover letter, work samples, references, letters of recommendation and other information you provide us with in your application. If sensitive data is included by you, we will process such information only to the extent necessary and justified in accordance with the consent you have provided us.
• Data from interviews and other reference information. This means notes from interviews with you, assessments or tests made, expectations and salary requirements.
• Communications data. We will collect and store your communication with us and any information provided to us in such communication.
• Special categories of personal data (“sensitive data”). If sensitive data is included by you in your communication with us or in your resume, we will process such information only to the extent necessary and justified in accordance with the consent you have provided us.

How we gather your personal DATA

Information you give to us. Most of the information we process about you is received from you. You may directly or indirectly give us information about yourself in different ways, for example when you contact us or through your application. You can always choose not to provide us with certain information. However, some personal data is necessary in order for us to process your application.

Information we collect about you. We may also obtain your personal data from your current employer or the website of your employer and/or through third parties such as LinkedIn and/or a recruitment service provider, commonly known as “sourced recruiting”.

Furthermore, our employees can give us a recommendation about a potential candidate, meaning that they will add the personal data they choose regarding a potential candidate in Jobylon. If this is applicable in your case, this privacy policy also applies to you.

How your PERSONAL DATA will be used And the Legal grounds for it

We process your personal data for the following purposes and based on the following legal basis:

• To administer incoming applications. Your personal data will be processed in order for us to administer and manage incoming applications. This processing is based on a balancing of interests, where our legitimate interest is being able to have a structured application- and selection process.
• For the recruiting and selection process. We will process your personal data during the recruitment process, including sourced recruitment, for the purpose of finding and determining whether you are a good fit for us, based on our legitimate interest in being able to recruit personnel with the relevant competence for Hurtigruten.
• To communicate with you. Your contact details will be used to communicate with you. This processing is necessary for our legitimate interest in effective communication with you in connection with your application or the recruitment process.
• To protect our legitimate business interests and legal rights. We will save and store information if we believe it is necessary to protect and enforce our legal rights, interests and the interests of others, for example in connection with legal claims, discrimination claims, compliance, regulatory and audit functions. This processing is based on a balancing of interests, where one legitimate interest of ours is defending and enforcing legal claims.
• To be able to contact and consider you for future job openings. In our legitimate interest, and what we believe is yours as well, in being able to keep relevant however unsuccessful candidates of the position applied for, for other job openings, we save the above-mentioned personal data necessary for this purpose up to 24 months.
• Marketing of Hurtigruten. Based on our legitimate interest in being able to market us as a potential employer to relevant candidates your contact information will be used to send you newsletters regarding for example how it is to work for us or to send you event invitations.

If you do not wish to receive this kind of marketing, please contact us directly.

• To administer events that you are attending to. If you attend one of our events, we will process the personal data necessary to be able to administer that event. Generally, the categories of personal data involved are your contact details, the company you currently work for and if we serve food – food preferences. This processing we base on our legitimate interest in being able to process the information needed to plan, provide and administer the event. In case you provide us with information of your allergies, we process this information based on your consent.
• In connection with a merger or acquisition. In connection with, due to strategical or business-oriented reasons, a potential merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company, the personal data we retain about you may be processed, shared or transferred, to parties involved in the process. This processing is based on our legitimate interest of being able to develop our business.
• With your consent. Your personal data may be used for other purposes than stated above if you ask us to or you give us your consent. Any sensitive data you have provided to us will be processed based on your consent.

How we share YOUR PERSONAL DATA

Sometimes, we need to share your personal information with other trusted individuals and companies. Your personal information is shared with:

• Our consultants. Your personal data will, when appropriate, be shared with our trusted consultants. However, we will restrict access to those consultants who need it to perform their jobs, for example to provide recruiting services to us. Our consultants are of course subject to strict confidentiality.
• Our service providers. We transfer to or share your personal data with our service providers who help us in our daily operations which require the processing of personal data, such as Jobylon or a recruitment service provider.

For the sub-processors of Jobylon, please click here.

Hurtigruten has service agreements with the following partners:

• Predictive Index – https://www.predictiveindex.com/
• Multilingua – https://multilingua.ee/
• Goethe Institute – https://www.goethe.de/ins/ee/et/index.html
• Spring France - https://www.springfrance.com/
• SHL - https://www.shl.com/

• Authorities and other public actors. Sometimes legal obligations may require us to share information about you, for example to respond to lawful requests from law enforcement agencies, regulatory agencies, and other public and government authorities. We may also disclose information if needed to detect and prevent fraud.
• Parties involved in legal proceedings. In connection with a potential legal proceeding, including in the preparatory work for us to be able to defend us against or enforce any legal claims, your personal data may have to be shared with parties involved in the proceedings, such as lawyers.
• Parties involved in a merger or acquisition. We may share or transfer your personal data in connection with any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
• Other parties, if you request us to or permit us to.

Where we PROCESS your personal data

We always strive to process and store your data within the EU/EEA. However, your data may in certain situations be transferred to, and stored at a destination outside of the EU/EEA territory.

Please note that privacy laws in countries outside of the EU/EEA may not be the same as, and in some cases may be less protective than privacy laws in your country. However, we always select our service providers carefully and take all the necessary steps to ensure that your personal data is processed with adequate safeguards in place in accordance with the General Data Protection Regulation 2016/679 (GDPR). These safeguards are either that we sign the EU Commission Standard Contractual Clauses or ensure that the service provider is established in a country which the EU Commission has deemed as having adequate privacy protection or, if the company is established in the United States, certified under the EU-U.S. Privacy Shield.

For the sub-processors of Jobylon, please click here.

Please contact us for more information about any applicable countries and safeguards in specific cases.

How long we keep your PERSONAL DATA

Hurtigruten keeps your personal data only as long as necessary to fulfil the purposes for which it was initially collected, but maximum up to one year. To ensure deletion of personal information within the time limitation, Hurtigruten and Jobylon have entered into agreement of a 24 months data clean up schedule. We regularly review our need to keep data, taking into account applicable legislation.

If you apply for a job, we generally keep the collected data during the recruitment process and as part of our internal talent pool. If you become an employee at one of Hurtigruten´s entities, we will transfer and store your personal data during your employment as regular employee data.

If we have found you through a recommendation, we keep your personal data for up to 24 months from the day your data is submitted or if we have found you through sourced recruiting, up to 24 months from the day your data was uploaded.

If you do not succeed in the recruitment process, we may keep your personal data for up to 24 months from the day you applied, in order for us to consider and contact you if a relevant position opens up.

We furthermore save the personal data necessary for us to be able to defend ourselves against claims from you in up to 24 months from the day your data was submitted.

Personal data processed on the basis of your consent will be deleted when your consent is withdrawn, or upon expiry of the purpose for which your consent was given.

Your data may also be stored for a longer period if required by applicable statutory retention periods.

Your rights

• Right to access your data. You have the right to request a transcript of personal data processed by us and additional information on how the data have been collected, processed, shared, etc. The first transcript may be requested free of charge, however if you make repeated and unreasonable requests for copies, we might charge you with an administrative fee.
• Right to object. You have right to object to processing based on legitimate interest. This means that we may no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests. You can always contact us for more information on the balance test that has been made.

You furthermore have an unconditional right to object to your personal data being processed for direct marketing purposes.

• Right to transfer your data. You have the right to transfer the personal data you have provided to us to another controller under certain conditions.
• Right to rectification. You have the right to correct inaccurate or incomplete information about yourself.
• Right to erasure (“right to be forgotten”). You have the right to request that we delete personal data about you, for example if the data is no longer necessary in relation to the purposes for which it was collected or otherwise processed, or if there is no legal basis for processing the data.
• Right to restriction. You are entitled to request that the processing of your personal data should be limited until inaccurate or incomplete information about you has been corrected, or until an objection from you have been handled.
• Right to withdraw your consent. You may at any time withdraw any consent you have given us. However, please note that it will not affect any processing that has already taken place.
• Right to complain. You have the right to lodge a complaint to the lead supervisory authority or the supervisory authority in the country you live or work in, if you believe that we have not complied with our obligations regarding your personal data.

Please note that if you request restriction or erasure it might affect our ability to process your application or consider you for a job. Moreover, legal rights or obligations may prevent us from disclosing or transfer all or part of your information, or from immediately deleting your information.

Changes in this Privacy Policy

This privacy policy may be updated periodically. You will be informed of any significant changes (e.g. by email or at our website), but we also recommend that you review this privacy policy from time to time to ensure you are aware of any amendments.