Processing of personal data - recruitment
Read about the collecting, processing, storage and transfer of personal data of individually identifiable current, past and future Candidates.
RISE Research Institutes of Sweden AB (RISE), as data controller, processes personal data regarding job applicants and candidates (hereinafter referred to as the “Candidate”), due to the circumstance that the Candidate has applied for employment at RISE, or has registered in the RISE candidate database.
Personal data processed by RISE
The personal data of the Candidate that RISE processes may include name, address, phone number, e-mail address, personal security number (swe: personnummer) photo, educational and professional expertise, CV, information from references where applicable, other information provided in application documents or in other ways in the recruitment process, results from recruitment tests if applicable (such as MAP and Matrigma) and interview notes where applicable.
Purpose and lawful basis
Based on RISE legitimate interest, RISE processes personal data for the following purposes:
- to review the application documents and assess and evaluate the Candidate as a candidate based on the information submitted in the application documents, individually and in relation to other candidates
- recruitment administration regarding e.g. booking of interviews and communication concerning these
- to safeguard and exercise legal rights according to the Discrimination Act (Swe: Diskrimineringslagen 2008:567)
This processing is needed for RISE to be able to recruit employees with the right competence, which is considered to be the legitimate interest of RISE.
Based on consent, RISE processes personal data for the following purposes:
- to save the personal data of the Candidate in RISE candidate database for possible future available vacancies
- to conduct and analyze personality tests in the recruiting process
If RISE intend to process the personal data for these purposes, specific consent will be collected.
The Candidate is recommended not to submit any sensitive personal data (e.g. gender, religious beliefs etc.) since these data are not interesting for the recruiting process. If the Candidate, however, has chosen to submit such information, RISE will process and, in its own discretion, delete it, on the basis of the voluntarily and specific consent which is deemed to be given when submitting such information.
Based on Legal obligation, RISE processes personal data for the following purposes
- to negotiate with relevant trade unions when appointing manager with personnel responsibility.
To whom the personal data is disclosed
RISE applies appropriate technical and organizational security measures to protect personal data against e.g. loss, misuse and unauthorized access.
Only persons within RISE who need to process the personal data in accordance with the above stated purposes will have access to the data. RISE may transfer personal data to:
- third parties within the RISE company group, for the purpose of global management of the personal data processing for the above stated purposes.
- third parties acting as personal data processors, e.g. supplier of the supply, support and maintenance of IT- and cloud services, suppliers of recruitment tools and recruitment services, etc.
- third parties acting as independent data controllers, if such transfer is required by applicable law, or if RISE has a legitimate interest for such transfer, e.g. trade unions, governments, third parties for the purpose of protect and exercise RISE legal rights, e.g. in connection with labor law dispute, etc.
Storage and disposal
RISE processes the personal data as long as it is necessary for the purposes for which the personal data was collected.
Personal data processed for the purpose of employing a candidate for an announced specific role will be processed for as long as the recruitment process is ingoing, and will thereafter be processed for another 24 months, for the purpose of safeguarding and exercising RISE legal rights according to the Discrimination Act (Swe: Diskrimineringslagen 2008:567). Thereafter, the personal data will be deleted.
If the Candidate has given consent to RISE saving the personal data in RISE candidate database for possible future available vacancies, the personal data will be saved for 24 months and will thereafter be deleted.
Transfer to third countries
RISE strives to process personal data within the EEA. In cases where RISE is transferring or processing personal data outside the EEA, RISE will ensure an adequate level of protection in accordance with applicable legislation.
Legal rights as a candidate
The Candidate has the right to receive information regarding its personal data processed by RISE, and to request for rectification, limitation or deletion of these, by contacting the Data Protection Officer at RISE, at firstname.lastname@example.org. The Candidate also has the right to file a complaint to the Swedish Data Protection Authority.
The personal data processor for the processing is RISE Research Institutes of Sweden AB (company registration number 556464-6874), with mailing address: Box 857 501 15 Borås Sweden.