EU General Data Protection Regulation (679/2016), Articles 12, 13 and 14.
In this privacy policy, we provide you, the data subject, with information about the processing of your personal data and your rights in accordance with the EU General Data Protection Regulation (GDPR).
Changes in the privacy policy
We develop our services constantly, which may require changes in the privacy policy. These changes can also be needed if there are changes in the law. If the changes are noticeable, we will inform you about them on our website or by contacting you in other reasonable manner.
We recommend reading this policy from time to time to get familiar with the possible changes.
The latest change in the content 31.12.2020: company name FCG Talent Oy changed to FCG Finnish Consulting Group Oy. 17.1.2024: FCG Finnish Consulting Group Oy > FCG Digital Oy.15.4.2024 FCG Digital Oy -> Grade Solutions Oy and the contact information of the data protection officer updated.
1 CONTROLLER
Grade Solutions Oy
Osmontie 34, 00610 Helsinki
PO BOX 950, 00601 Helsinki
2 PERSONS RESPONSIBLE FOR MATTERS RELATED TO THE REGISTER AND/OR CONTACT PERSONS
Contact details of the national superuser and administrator of the recruitment system and the data protection officer:
Telephone: 044 4314 999
Email: tuki@kuntarekry.fi
Substitute: Risto Kökkö
Email: risto.kokko@fcg.fi
3 NAME OF REGISTER
Register of visitors to the websites of Kuntarekry.fi and Kuntarekrytointi.fi services and profile data register of the kuntarekry.fi web service.
4 PURPOSE OF PROCESSING PERSONAL DATA (PURPOSE OF USE OF THE REGISTER)
Visitors to the websites of Kuntarekry.fi and Kuntarekrytointi.fi services:
Purpose of the register
Personal data is processed to ensure the functioning of Kuntarekry.fi and Kuntarekrytointi.fi services and develop the services. The development of processes, business operations and systems, including testing, is based on the processing of personal data.
Legal basis of processing
The processing of personal data is based on the controller’s legitimate interest to the extent that the processing of personal data is necessary to operate the service.
The legal basis for the processing personal data is your consent when we process personal data to develop the service. You can manage your consent using a web browser. For more precise details of consent management, see our cookie practices section
Job seekers registered with the Kuntarekry.fi service:
Purpose of the register
Personal data is processed for purposes related to the Kuntarekry.fi web service provided by the data controller for data subjects. In the service, data subjects can create a user profile, after which they can prepare job applications to be sent to selected employers that use the service.
In addition, job-seekers can receive recommendations of job advertisements matching their profile. For these purposes, the data controller maintains the profile data saved by data subjects in the service.
Legal basis of processing
The principle of processing personal data is the performance of a contract to which the data subject is party. The terms of use of the service accepted by the data subject when starting to use the Kuntarekry.fi web service constitute the contract in question.
5 DATA CONTENT OF THE REGISTER
Visitors to the websites of Kuntarekry.fi and Kuntarekrytointi.fi services:
The following data is recorded in the register of the visitors to the websites of the services:
- Time stamp of the time you used the service
- Your IP address
- Which websites of the Kuntarekry.fi and/or Kuntarekrytointi.fi services you have visited
- Amended username (the username is generated on the website visitor’s device)
- The page you arrived from at the Kuntarekry.fi or/and Kuntarekrytointi.fi website(s) if you arrived via an internet link
- Details of the device, operating system and browser used
- The language used in the service
- Session ID
If you have logged in as a user in the Kuntarekry.fi and/or Kuntarekrytointi.fi service, the following details of usage are also collected: Role and organisation of the Kuntarekry/Kuntarekrytointi software in the service.
Job seekers registered with the Kuntarekry.fi service:
The register consists of data added by data subjects in their personal job-seeker profile and their username and password for the kuntarekry.fi web service.
Data subjects can edit the data saved in their profile.
The following data is collected of the data subjects:
(a) Basic data and identification data, such as name, date of birth, gender, telephone number, email address, language selection;
(b) Data about education, such as completed degrees, additional and further education;
(c) Data about work history, such as previous employers, job title, description of positions, duration of employment;
(d) Username and password;
(e) Technical data about the use of the system, audit trails and log data.
With regard to job-seeking, it should be noted that each employer selects the questions asked in each application form. Considering personal data collected in application forms, the employer that posted the job advertisement in question in the kuntarekry.fi web service acts as the data controller, insofar as and if the data subject decides to send an application to that employer. Data collected about job-seekers and saved in the recruitment system depends on what data is asked in a targeted application form and what data each data subject provides and saves in the recruitment system. In situations where Grade Solutions Oy offers the service to a employer acting as a data controller, Grade Solutions Oy acts as the processor of personal data for that employer on behalf of that employer.
6 REGULAR DISCLOSURE OF DATA AND RECIPIENTS OF DATA
The data controller does not disclose any personal data included in the register to third parties.
Grade Solutions Oy uses subcontractors in its operations. The subcontractors process personal data in compliance with the instructions issued by Grade Solutions Oy and do not use the data in their own operations.
Visitors to the websites of Kuntarekry.fi and Kuntarekrytointi.fi services:
Data subjects can send applications to selected employers by using the service. After an application has been sent, the employer organisation in question is in the role of a data controller with regard to personal data entered in applications sent and saved in the service.
Job seekers registered with the Kuntarekry.fi service:
Data subjects can send applications to selected employers by using the service. After an application has been sent, the employer organisation in question is in the role of a data controller with regard to personal data entered in applications sent and saved in the service.
7 TRANSFER OF DATA OUTSIDE THE EU OR THE EEA
Grade Solutions Oy may also transfer personal data to organisations operating in countries outside the EU or the European Economic Area, i.e. in “third countries”.
Such transfers can be made if one of the following conditions is met:
- The European Commission has decided that the country concerned ensures an adequate level of protection.
- Other required safety measures have been implemented – for example, by following the model agreement clauses adopted by the European Commission or by ensuring that the company processing the data has valid and binding rules in place.
8 PROFILING AND AUTOMATED DECISION MAKING
Visitors to the websites of Kuntarekry.fi and Kuntarekrytointi.fi services:
Personal data may be processed for profiling purposes to develop the operations. No automated decision making or such profiling that involves decision making with a significant impact or that has a legal impact on data subjects is carried out.
Job seekers registered with the Kuntarekry.fi service:
Personal data can be processed for profiling purposes in order to recommend vacancies to job-seekers based on cookies. No automated decision-making or such profiling that involves decision-making with a significant impact (such as recruitment decisions) or that have a legal impact on data subjects is carried out. You can manage cookies using a web browser. For more precise details of cookie management, see our cookie practices section.
9 PRINCIPLES OF REGISTER PROTECTION
No manual material is generated from the register.
The controller ensures that electronically processed data material is only processed in compliance with the data protection practices valid at the time. The data protection practices include the encryption of transferred data material, access right limitations and appropriate updates of software suites.
The controller’s employees are committed to observing a confidentiality obligation and keeping all information obtained when processing personal data confidential.
10 RETAINING AND ERASING DATA LOCATED IN THE PERSONAL DATA REGISTER
Data collected in the register is only retained as long as and to the extent as is necessary considering the purposes for which the data was collected.
Grade Solutions Oy as the data controller is responsible for retaining and erasing profile data about data subjects.
(a) If a username has not been used for two (2) years, the username and the profile data linked to it will be erased.
(b) Any unsent job applications will be erased automatically after six (6) months.
(c) In open job applications, each user defines how long their application remains valid. The minimum retention period for job applications is one (1) day and the maximum retention period is two (2) years.
With regard to the retention and erasure of applications sent to employers, each employer organisation is responsible for defining retention periods in their role as a data controller. If data subjects have any questions about retention periods, they should contact the employer organisation to which they sent their application.
Grade Solutions Oy in its role as a processor assists employers in their role as a data controller so that applications sent for vacancies are automatically anonymised within two (2) years after an employer has ended their recruitment process by closing it. If a recruitment process is not closed, the system will end it automatically within one (1) year after the application period. In these situations, applications are retained in the system for three (3) years after the application period.
11 THE RIGHTS OF DATA SUBJECTS
Data subjects have the following rights:
- Right to obtain information from the data controller, indicating that their personal data is either processed or not processed. If personal data is processed, data subjects have the right to access their personal data.
- Right to withdraw their consent at any time. This withdrawal has no impact on the lawfulness of any processing carried out before the withdrawal on the basis of consent.
- Right to request the data controller to rectify any inaccurate and incorrect personal data about the data subject without any unnecessary delay and the right to have any incomplete personal data supplemented.
- Right to request the data controller erase their personal data without any unnecessary delay, provided that the requirements set out in the applicable data protection legislation are met.
- Right to restrict the processing of their personal data, provided that the requirements set out in the applicable data protection legislation are met.
- Right to receive their personal data, which they have provided to a controller, in a structured, commonly used and machine-readable format, and the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, provided that the requirements set out in the applicable data protection legislation are met.
- Right to file a complaint with the supervisory authority if the data subject notices that their personal data is processed in breach of the GDPR.
Requests for exercising the rights of data subjects must be sent to the data controller's contact person mentioned above.
If you want to exercise any of your rights listed above, the request will be assessed on a case-by-case basis. Please note that we may keep and use your data in spite of your request if this is necessary e.g. for complying with legal obligations, settling disputes or ensuring our legitimate interests (e.g. legal remedies).
