Processing of personal data - recruitment

The personal data of the Candidate that the Data Controller processes may include name, address, phone number, e-mail address, social security number (swe: personnummer) photo, educational and professional expertise, CV, information from references where applicable, other information provided in application documents or in other ways in the recruitment process, results from recruitment tests if applicable (such as MAP and Matrigma) and interview notes where applicable.

Based on legitimate interest, the Data Controller processes personal data for the following purposes:

• to review the application documents and assess and evaluate the Candidate as a candidate based on the information submitted in the application documents, individually and in relation to other candidates
• recruitment administration regarding e.g. booking of interviews and communication concerning these
• to conduct and analyze personality tests in the recruiting process

This processing is needed for the Data Controller to be able to recruit employees with the right competence, which is considered to be the legitimate interest of the Data Controller.

Based on consent, the Data Controller processes personal data for the following purposes:

• to save the personal data of the Candidate in the Data Controller’s candidate database for possible future available vacancies

If the Data Controller intend to process the personal data for these purposes, specific consent will be collected.

The Candidate is recommended not to submit any sensitive personal data (e.g. gender, religious beliefs etc.) since these data are not relevant for the recruiting process. If the Candidate, however, has chosen to submit such information, the Data Controller will process and, in its own discretion, delete it, on the basis of the voluntarily and specific consent which is deemed to be given when submitting such information.

Based on Legal obligation, the Data Controller processes personal data for the following purposes:

• to negotiate with relevant trade unions when appointing manager with personnel responsibility, 
• to safeguard and exercise legal rights according to the Discrimination Act (Swe: Diskrimineringslagen 2008:567), and
• other legal obligations

The Data Controller applies appropriate technical and organizational security measures to protect personal data against e.g. loss, misuse and unauthorized access.

Only persons within the Data Controller’s organization, or within other companies of the RISE Group, who need to process the personal data in accordance with the above stated purposes will have access to the data.

The Data Controller may transfer personal data to third parties within the RISE Group, for the purpose of management of the personal data processing for the above stated purposes.

The Data Controller may transfer personal data to third parties acting as personal data processors, e.g. supplier of the supply, support and maintenance of IT- and cloud services, suppliers of recruitment tools and recruitment services, etc.

The Data Controller may transfer personal data to third parties acting as independent data controllers, if such transfer is required by applicable law, or if the Data Controller has a legitimate interest for such transfer, e.g. trade unions, governments, third parties for the purpose of protect and exercise the Data Controller’s legal rights, e.g. in connection with labor law dispute, etc.

The Data Controller processes the personal data as long as it is necessary for the purposes for which the personal data was collected.

Personal data processed for the purpose of employing a candidate for an announced specific role will be processed for as long as the recruitment process is ingoing, and to the extent necessary for the purpose of safeguarding and exercising the Data Controller’s legal rights. Thereafter, the personal data will be deleted.

If the Candidate has given consent to saving the personal data in RISE candidate database for possible future available vacancies, the personal data will be saved for 24 months and will thereafter be deleted.

The Data Controller strives to process personal data within the EEA. In cases where the Data Controller is transferring or processing personal data outside the EEA, the Data Controller will ensure an adequate level of protection in accordance with applicable legislation.

The Candidate has the right to receive information regarding its personal data processed by the Data Controller, and to request for rectification, limitation or deletion of these, by contacting the Data Protection Officer at the Data Controller, at dpo@ri.se. The Candidate also has the right to file a complaint to the Swedish Data Protection Authority.