5 Recruitment

5.1 Lyko will collect personal information about you when you engage in our recruitment services. We use a third-party provider, Jobylon AB, for our recruitment activities. By engaging in our recruitment services, we may collect personal data from the following sources:

• Directly from you
• From recruitment agencies,
• Through publicly available sources online, e.g., LinkedIn, or
• By reference or word of mouth (such as from a previous employer).

Although we will transfer your personal data from our recruitment portal to our internal HR system if we hire you, this Notice does not form a part of an employment offer or contract between you and Lyko. If we do make an employment offer to you, you will receive separate, further information about our processing of your personal data.

Any personal data we receive from you in a recruitment process will, in any situation not mentioned down below, be deleted as soon as the data loses its necessity for the recruitment process.

5.2 You may delete or request a copy of your personal information in the recruitment portal provided by Jobylon. You can find the link in the confirmation email we send you. If you want to change the information you have provided, please contact the person who is stated as responsible in the job ad.

5.3 We collect and process the following categories of personal data about you when you apply for a job opening with us:

• Your name, e-mail address and phone number
• Answers to screening questions, and other information included in the application such as work samples, reference statements, letters of recommendation, video questions, open career site information (e.g. LinkedIn), salary expectation. If you so wish, you can complement your application with a CV, but please view the section regarding sensitive data before doing so.
• EU-Citizenship (yes/no), valid work permit (yes/no), work permit attestation
• Test results of standard tests (non-sensitive information)
• Data and notes from interviews, assessments and reference information.
• Communications data. We will collect and store your communication with us and any information provided to us in such communication.

5.4 Special categories of personal data (“sensitive data”): As the main rule, sensitive data about you is not processed. You should only submit necessary and relevant personal data when applying for a job at Lyko. We advise you to refrain from sending us sensitive data in your job application as it is often of no relevance to the purpose of the recruitment process. If a certain sensitive data is necessary for the specific job, you will be informed and there will be a chance for you to give us that necessary sensitive data. Sensitive data is for example, biometrical information, union participation, criminal records, genetic information, gender identification, political conviction, race, religion, health records, major social issues. If you suffer or have suffered from a medical condition that could have a significant effect on you while employed or if we need to make necessary adjustments, we will provide you with an opportunity to inform us at a later stage in the recruitment process and only process that data if necessary.

If sensitive data is included by you in your communication with us or in your resume, we will process such information only to the extent necessary and justified in accordance with the specific consent you have provided us.

5.5 We process your personal data for the following purposes and based on the following legal basis:

• To administer incoming applications. Your personal data will be processed in order for us to administer and manage incoming applications. This processing is based on a balancing of interests, where our legitimate interest is being able to have a structured application- and selection process.
• For the recruitment and selection process.
  We will process your personal data during the recruitment process, including sourced recruitment, for the purpose of finding and determining whether you are a good fit for us, based on our legitimate interest in being able to recruit personnel with the relevant competence for us.
• To communicate with you. Your contact details will be used to communicate with you. This processing is necessary for our legitimate interest in effective communication with you in connection with your application and/or the recruitment process.
• To protect our legitimate business interests and legal rights. We will save and store your personal data if we believe it is necessary to protect and enforce our legal rights, interests and the interests of others, for example in connection with legal claims, discrimination claims, compliance, regulatory and audit functions. This processing is based on a balancing of interests, where legitimate interest of ours is defending and enforcing legal claims.
• To comply with our legal obligations. We collect and save certain types of personal data which are required according to applicable laws. For example, we ask you if you are an EU-citizen and if not, we ask you to share a work permit attestation as we are legally obliged to ensure that all our employees have a valid work permit.
• For future job openings. If you do not succeed in the recruitment process, we keep your personal data with your consent for future job openings for up to 6-12 months from the day the recruitment process ended. When you send an application to us, you will be given the choice to give us your consent to store your application data for future job openings that you may apply for in the future. The data will only be stored for up to 12 months for this purpose. The legal basis for this process is consent, and you have the right to withdraw your consent at any time.
• Your personal data may be used for other purposes than stated above if you ask us to or you give us your consent. Any sensitive data you have provided to us will be processed based on your consent.

5.6 We may collect personal information from the following sources:

• Directly from you;
• From recruitment agencies;
• Through publicly available sources online, e.g. LinkedIn; or
• By reference or word of mouth (such as from a previous employer).

5.7 Sometimes, we need to share your personal information with other trusted individuals and companies. Your personal information may be shared with:

• Our consultants. Your personal data will, when appropriate, be shared with our trusted consultants. However, we will restrict access to those consultants who need it to perform their jobs, for example to provide recruiting services to us. Our consultants are of course subject to strict confidentiality.
• Our service providers. We transfer to or share your personal data with our service providers who help us in our daily operations which require the processing of personal data, such as Jobylon AB, a recruitment service provider or suppliers of different types of digital solutions.
• Authorities and other public actors.
  Sometimes legal obligations may require us to share information about you, for example to respond to lawful requests from law enforcement agencies, regulatory agencies, and other public and government authorities. We may also disclose information if needed to detect and prevent fraud.
• Parties involved in legal proceedings. In connection with a potential legal proceeding, including in the preparatory work for us to be able to defend us against or enforce any legal claims, your personal data may have to be shared with parties involved in the proceedings, such as lawyers.
• Other parties, if you request us to or permit us to.

5.8 Retention. We keep your personal data only as long as necessary to fulfil the purposes for which it was collected. How long depends on the type of information and why we process it. We regularly review our need to keep data, taking into account applicable legislation.

• If you apply for a job, we generally keep the collected data during the recruitment process.
• If you do not succeed in the recruitment process, we keep your personal data with your consent for future job openings for up to 6-12 months from the day the recruitment process ended.
• We furthermore save the personal data necessary for us to be able to defend ourselves against claims from you. For example, we store the data being relevant to defend ourselves against allegations of discrimination up to 24 months from the day the recruitment process ended.
• Personal data processed based on your consent will be deleted when your consent is withdrawn or upon expiry of the purpose for which your consent was given.
• Your data may also be stored for a longer period if required by applicable statutory retention periods.

5.9 Your personal information may in some cases be transferred to and stored at destinations outside the EU/EEA where the privacy laws may not be the same as, and in some cases may be less protective than, privacy laws in the EU/EEA. We will however take all the necessary steps to ensure that adequate safeguards (such as EU standard contractual clauses including supplementary safety measures or an adequacy decision by the EU Commission) are in place to protect your personal information and to make sure it is treated securely and in accordance with the GDPR. You can contact us for more information about any applicable countries and safeguards in specific cases.

Summary: We respect your privacy when you apply for a job with us.