PRIVACY POLICY – RECRUITMENT
When applying for a position with any of the entities in the Stillfront Group (jointly “Stillfront”, “we” or “us”) you have been required to submit information relating to you. In order for Stillfront to be able to process your application, we need to process certain personal data relating to you. Failure to provide such data can entail in that your application cannot be processed. Stillfront is committed to safeguarding your privacy. This privacy policy will inform you about the processing we undertake with your personal data in connection with your application. The controller of your personal data will be Stillfront Group, Kungsgatan 38, 111 35 Stockholm.
Throughout this privacy policy the terms "controller", "processor" "processing" and "personal data" shall have the same meaning as in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (the "GDPR").
"Candidate" means you as an individual who has applied for a position with Stillfront.
"Reference person" means you as an individual who has been named as a reference by a Candidate in connection with the recruitment process.
FROM WHOM DO WE RECEIVE YOUR PERSONAL DATA
If you choose to apply for a position within Stillfront on our career page we will collect your personal data directly from you when you submit your application. We may also collect further information from and about you if we choose to conduct interviews and tests with you as part of the recruitment process.
We will collect information from the relevant Stillfront Group company if you have consented for processing in connection with future recruitment processes.
We will also collect personal data from other sources as appropriate for the position such as social networks, e.g. LinkedIn.
If you are a Reference person we will collect your personal data directly from you but also from the Candidate that has named you as reference in their job application.
WHEN AND WHY DO WE PROCESS YOUR PERSONAL DATA
Handle the recruitment process
We will process your personal data to handle the recruitment process, for example to collect and review documents relating to your application (such as your CV and cover letter), to evaluate the application, making reference checks and to communicate during the recruitment process.
Categories of Personal data
Legal basis
Contract. The processing is necessary in order to take steps at your request prior to entering into a potential employment contract with you.
Legitimate interest. To the extent you have not requested a specific action the processing is necessary in order fulfil our legitimate interest to handle the recruitment process.
The processing of personal number will only be made if necessary for a secure identification or similar circumstances.
We will only process special categories of data, for example health data and information on trade union membership, if you freely have submitted such data to us and if you have given your consent.
Retention period: Personal data processed for this purpose is retained during the recruitment process and for a period up to 12 months thereafter to fulfil our legitimate interest to establish, exercise and defend any legal claims.
Future recruitment and talent pool
If you give your consent, we will save your application documents to evaluate you for other positions within Stillfront which may become vacant within the relevant period set out below. It is optional to give your consent to this processing, it will not affect your chances in the initial recruitment process and you may at any time withdraw such consent.
Categories of Personal data
Name
Contact details
Photo
Location data
Personal number
Experience description
Education description
CV
Personal letter
Work certificate(s)
Feedback data from Reference person
Other information from connected LinkedIn page, social media page and cover letter
Legal basis
Consent. The processing is based on your given consent.
The processing of personal number will only be made if necessary for a secure identification or similar circumstances.
We will only process special categories of data, for example health data and information on trade union membership, if you freely have submitted such data to us and if you have given your consent.
Retention period: Personal data is retained during a period of 12 months from the time of the recruitment process for the position you have applied for has ended. Provided that you give your consent in each case, personal data will be retained for additional 12 months' periods.
Conduct reference checks
We will process your personal data while conducting reference checks in connection with the recruitment process, for example in order to receive feedback on you as a candidate and evaluate you for the applied position.
Reference person
Categories of Personal data
Legal basis
Legitimate interest. The processing is necessary in order to fulfil our legitimate interest in contacting you and to collect feedback from you regarding the Candidate as part of the recruitment process.
Retention period: Personal data processed for this purpose is retained during the recruitment process and for a period up to 12 months thereafter to fulfil our legitimate interest to establish, exercise and defend any legal claims.
Carry out background checks
As part of the recruitment process we may, depending on the position you have applied for, perform background checks on you in order to further evaluate and validate your application. Such background checks may include credit reports and public social media checks etc.
Candidate
Categories of Personal data
Name
Personal number
Educational/professional background
Financial data (such as credit reports)
Other information of relevance in public social media profiles
Legal basis
Legitimate interest. The processing is necessary in order to fulfil our legitimate interest to further evaluate and validate your application.
The processing of personal number is necessary with regard to the purpose of the processing.
Personal data relating to credit reports and public social media profiles will only be processed when necessary due to the hiring for a position with a certain financial responsibility within Stillfront.
Retention period: Personal data processed for this purpose is retained during the recruitment process and for a period up to 12 months thereafter to fulfil our legitimate interest to establish, exercise and defend any legal claims.
Conduct personality and ability tests
Depending on the position you have applied for we may conduct personality and ability tests as part of the recruitment process. If such tests are relevant for your applied position we will, before conducting the tests, ask for your consent.
Candidate
Categories of Personal data
Name
Personal number
Test data
Legal basis
Consent. The processing is based on your given consent.
The processing of personal number is necessary with regard to the purpose of the processing.
Retention period: Personal data processed for this purpose is retained during the recruitment process and for a period up to 12 months thereafter to fulfil our legitimate interest to establish, exercise and defend any legal claims.
Evaluate recruitment process and follow-ups
We process Personal data to evaluate and follow-up the recruitment process, for example in order to create reports and statistics of the number of applications per position.
Candidate
Categories of Personal data
Legal basis
Legitimate interest. The processing is necessary to fulfil our legitimate interest in following up and evaluating the recruitment process.
Retention period: Reports and statistics on aggregated level which do not contain personal data will be saved until further notice.
Reference person
Categories of Personal data
Legal basis
Legitimate interest. The processing is necessary to fulfil our legitimate interest to follow up and evaluate the recruitment process.
Retention period: Reports and statistics on aggregated level that do not contain personal data will be saved until further notice.
Establish, exercise and defend legal claims
For the purpose of establish, exercise and defend legal claims (for example in connection with a dispute or legal process) we will process your personal data.
Candidate and Reference person
Categories of Personal data
All data collected that is necessary to establish, exercise or defend the legal claim.
Legal basis
Legitimate interest. The processing is necessary in order to fulfil our legitimate interest to establish, exercise or defend the legal claim, for example in connection with a dispute or legal process.
The processing of personal number will only be made if necessary for a secure identification or similar circumstances.
We will only process special categories of data, for example health data and information on trade union membership, to fulfil our legitimate interest to establish, exercise or defend legal claims.
Retention period: Your personal data is retained for the period required in order for us to establish, exercise or defend the legal claim.
Fulfil legal obligations
We will process your personal data to fulfil legal obligations which apply to Stillfront.
Candidate and Reference person
Categories of Personal data
All data collected that is necessary to fulfil each legal obligation.
Legal basis
Legal obligation. The processing is necessary in order to fulfil Stillfront's legal obligations, for example within the area of book-keeping and taxation.
Retention period: Personal data is retained for the period as necessary to fulfil the legal obligations which apply to Stillfront.
WHOM DO WE SHARE YOUR DATA WITH
Stillfront will, if necessary, transfer your personal data to external parties such as vendors and service providers which process personal data under the instructions of Stillfront such as:
Recipient: Recruitment agencies
Purpose of transfer: To administer and handle the recruitment process
Legal basis: The processing is necessary in order to take steps at your request prior to entering into a potential employment contract with you.
Our legitimate interest to internally administer and handle the recruitment process.
Recipient: IT-service providers
Purpose of transfer: To administer and handle the recruitment process
Legal basis: Our legitimate interest to internally administer and handle the recruitment process.
Recipient: Courts and outside counsels
Purpose of transfer: In order to exercise, establish or defend legal claims
Legal basis: Our legitimate interest in having disputes settled by competent courts
Recipient: External auditors
Purpose of transfer: To fulfil legal obligations (such as accounting and auditing obligations)
Legal basis: To fulfil legal obligations
Recipient: Authorities
Purpose of transfer: To fulfil legal obligations (for example due to requests from competent authorities)
Legal basis: To fulfil legal obligations
Recipient: Group companies of the Stillfront Group
Purpose of transfer: To administer and handle the recruitment process
Legal basis: Our legitimate interest to internally administer, evaluate and handle the recruitment process
Recipient: Group companies of the Stillfront Group
Purpose of transfer: To share candidate information for possible future recruitment within Stillfront.
Legal basis: Consent for the purposes of future recruitment processes
Recipient: Trade unions
Purpose of transfer: To fulfil legal obligations within the field of employment, e.g. consultation obligations
Legal basis: To fulfil legal obligations within the field of employment
Appropriate safeguards for transfers outside the EU/EEA-area
Where a disclosure as mentioned above entails transfers of personal data outside the EU/EEA, Stillfront will ensure that the EU Commission's standard contractual clauses have been entered into between the transferring Stillfront entity and the receiving external party. Alternatively, other safeguards will be put in place prior to such transfers such as an adequacy decision.
You are entitled to receive a copy of any documentation demonstrating that appropriate safeguards have been taken in order to protect your personal data during a transfer outside the EU/EEA.
If you would like to know more about the processing of your personal data and whether your personal data is transferred outside the EU/EEA, please contact us on the contact details as set out below.
WHAT ARE YOUR RIGHTS
Under the GDPR you may be entitled to:
Access You may request confirmation whether your personal data is processed and if that is the case have access to your personal data and additional information such as the purposes of the processing. You are also entitled to receive a copy of the personal data undergoing processing. If the request is made by electronic means the information will be provided in a commonly used electronic format if you do not request otherwise.
Rectification Stillfront will take steps to keep your personal data accurate, complete and up-to-date. If you identify that any personal data related to you is inadequate, incomplete or incorrect, you are entitled to have the personal data corrected.
Object to certain processing You may object to the processing of your personal data processed on the basis of a legitimate interest, on grounds relating to your particular situation and to processing for direct marketing purposes.
Erasure You may have your personal data erased under certain circumstances such as when your personal data it is no longer needed for the purposes for which it was collected.
Restriction of processing Under certain circumstances, you may ask us to restrict the processing of your personal data to only comprise storage, if you do not want your personal data erased.
Withdrawal of consent You have the right to at any time withdraw your consent to processing of personal data to the extent the processing is based on your consent, for example if your personal data is kept for the purpose of evaluating you for other open positions.
-
Data portability As regards personal data that you have provided to Stillfront, you may ask to receive a machine-readable copy of the data, in so far the data is processed on the basis of your consent or on the basis that the processing is necessary in order to perform an agreement with you. You also have the right to ask for such data to be transferred to another controller (where possible).
Complaints to the supervisory authority
You acknowledge that you always have the right to lodge complaints pertaining to the processing of your personal data to the competent data protection authority.
Data collected from recommendations
If you refer a friend for a vacant job position in Stillfront, it is your responsibility to make sure that the person you refer has given the consent to be referred and his/her data submitted.
SECURITY
We will ensure that the access to your data is accurately secured by applying appropriate safeguards, depending on the circumstances taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk. In support of this commitment, we have implemented appropriate technical, physical and organizational measures to protect your personal data against unauthorized or accidental destruction, alteration or disclosure and misuse, damage, theft or accidental loss or unauthorized access.
CONTACT INFORMATION
If you have any questions or concerns regarding the processing of your personal data or if you wish to exercise any of your rights as set out below, please contact Stillfront on the contact details set forth below.
Stillfront Group AB (publ)
Kungsgatan 38,
111 35 Stockholm
dpo@stillfront.com
The data protection officer of the Controller for the purposes of the GDPR is:
Name: Peter Birgersson
Contact details: dpo@stillfront.com
OTHER NOTICES
We reserve the right to update this privacy policy, if necessary, for example to comply with legislative changes, regulatory changes, new practices and procedures, or requirements imposed by any authority. The revisions will apply from the date of their publication or via the position page on the website. The date on which this text was last changed can be found in the header of the document.
