Privacy Notice for Job Applicants
This Privacy Notice describes how Rapala VMC Corporation (“Company”) and its subsidiaries collect and process your personal data when you apply for a job or send an open application to us. The terms, “Rapala VMC”, “we”, “us” and “our” as used herein refers to Rapala VMC Corporation, a Finnish publicly listed corporation with a Finnish business ID 1016238-8. All Rapala VMC Corporation subsidiaries apply this notice.
Please read the following carefully to understand our policies and practices regarding your personal data and how we will treat it. Rapala VMC treats all applicant data with great respect and each of Rapala VMC’s subsidiaries is responsible to process the data according to this privacy statement.
If you have any questions about this Privacy Notice, if you wish to exercise your rights as a data subject or have any questions regarding Rapala VMC’s privacy practices, please feel free to contact us at privacy@rapalavmc.com
Rapala VMC Corporation
Mäkelänkatu 87
00610 Helsinki
Finland
email: privacy@rapalavmc.com
1. When do we collect your personal data?
Application. When you apply for an open position or send an open application to us, our HR team assesses your application.
Recruiting assistance. At times we may use headhunters or other service providers in our recruiting process. If those services are used, we set the terms for processing of personal data and make sure that the third party commits to the data processing agreement and follows given instructions.
Interviewing and informing the candidates. During your interview we collect the data that is needed for our decision-making process. After the interview we keep you informed on the status of your application.
When you want to stay informed on open positions. Your job application may be saved for other open positions with your consent.
When you visit our website. We use cookies and similar tools to enhance your experience using our website, provide our services and understand how you use our services so we can make improvements. You can manage your cookie preferences [here/banneri] and read more about cookies [here/notice].
2. What personal data do we process?
We process following of personal data categories and data on job applicants:
Directly from you when you send an application and your resume or interact with us otherwise.
| Category | Data element examples |
| Contact information | Such as full name, street address, phone number, email address, city and country |
| Content and documents | Such attachments as application letter, CV, interview information including video interviews, and recommendation letters. We may also call you for health checks and or credit checks before entering into agreement with you. |
| Employment and education information | Such as previous employers, work history, titles, education, qualification and certifications |
| Other identifying information | Such as social security number and/or birthdate, picture or other proof of identity |
| Salary preferences | Salary expectations |
| Video footage | If your interview is held locally, your visit may be stored on CCTV that we have in our premises. |
Data obtained from third parties
We use third parties for providing professional recruiting services and health checks. Those third parties disclose your data to us.
| Health checks and credit checks | Report on qualification |
| Recruiting services | Name, phone number, email and work history. Depending on assignment they create a candidate profile for interviews. |
| References or previous employers | References and qualifications |
Within Group companies when permitted by law or with legitimate interest.
3. For what purposes do we process your personal data?
Main purpose for any use of your personal data is maintaining and managing candidate data and fill open positions in Rapala VMC Corporation. Naturally majority of our processing activities are related to managing applicant data. Rapala VMC doesn’t do any automatic decision-making or profiling that would have legal affects or impacts for the candidates. These are examples of situations on where and how we use your personal data:
Processing the applications. Our HR team processes each application individually and invites the potential candidates for an interview.
Interviewing. During your recruitment process you are interviewed either using videoconference tools or meeting our representatives locally.
Content and documents. The recruiting services and or our HR may build a candidate profile during your recruiting process.
CCTV. Our headquarters, factories and stores have CCTV solutions. Depending on the location of your interview data is stored only for short period of time. Data is accessible locally or via a software that is accessible by security service provider.
Informing you on our decision. We do our best to keep you informed during the whole recruitment process. As soon as have reached a decision, we will let you know.
Maintaining candidate information. We do our best to ensure that all your information is handled with care and that all data is securely maintained. With your consent we will be able to keep in touch with you, if we open another positions that may interest you.
4. Lawful basis for processing your personal data
With your consent
- We store your application for other open positions
Processing is necessary for the performance of a contract to which you are party or about to become a party
- Storing and maintaining the candidate data
Legitimate interests
- CCTV
Please note that you have always the right to object the processing of your personal data that is based on legitimate interests
5. Do we share your personal data with 3rd parties?
Rapala VMC only shares your personal data if it is allowed by law. The principal recipient of your personal data is Rapala VMC Corporation. We also work particularly closely with certain service providers, for example with technical service providers (e.g. companies running data centers where we host our IT-systems). These service providers may generally only process your data on our behalf under special conditions.
Group companies. Many systems and technologies are shared within Rapala VMC group. Therefore, Rapala VMC group companies may require access to your data to fulfill our contractual and legal obligations or to fulfill their respective functions within our group.
IT & Data center providers. We work with different IT service providers in order to be able to provide our services. These service providers include, for example, IT-system providers, Cloud providers and data center providers.
Authorities. Your personal data can be disclosed to different authorities, if such disclosures are based on applicable law or a lawful request.
Recruiting service providers and other professional services. At times we use the help of carefully chosen professional service providers. For instance, in reviewing applications and performing health checks.
Other. In addition we may also disclose your personal data to third parties for us to comply with any court order or another legal obligation. This includes exchanging information with other companies and organizations for the purposes of fraud protection and credit risk reduction. In the event of merger, acquisition, or any form of sale of some or all of our assets, in which case personal information held by us could be among the assets transferred to the buyer.
6. Do we transfer your personal data outside european economic area?
As we cannot do everything ourselves and we rely on a number of third parties that help us to conduct our business operations. We operate internationally and there are situations when your personal data is occasionally transferred to a country outside European Union or European Economic Area (“Third Countries”). For example, some IT-systems that we use to store personal data are located in Third Countries. In addition, some sub-contractors of our business partners can have an access to personal data in limited situations.
When your personal data is transferred to a Third Country, the level of protection guaranteed in the GDPR might decrease. Therefore, before any transfer, we aim to take necessary measures to ensure the high level of protection of your personal data as required by the GDPR. Such measures include the use of so called ‘standard contractual clauses’ (“SCC’s”) approved and provided by the EU Commission as part of our agreements we enter into agreement with the recipients of personal data in Third Countries. You can read more about the SCC’s here: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en
| Examples when your personal data is transferred to a Third Country | ||
| Country | Situation when this transfer happens? | Measures to ensure high level of data protection |
| USA | Microsoft Teams, O365. | SCC’s |
7. How long do we keep your data?
Generally, your personal data may not be kept in a form which permits identification longer than is necessary for the purposes for which the personal data is processed for. Therefore we delete or alter the data so that it’s not identifiable when there is no use for the data anymore.
As the purposes of processing (please check the part HOW DO WE USE THE PERSONAL DATA? above) vary so does the retention times of your personal data.
We process your personal data as long as we have a valid legal reason to do so. This might be for example for us to enforce our legal rights in which case the data will be kept until the legal matter has been fully ceased.
| Category | Data retention time |
| Candidate information | 6 months |
| Contact information | 6 months |
| Content and documents | 6 months |
| Employment and educational information | 6 months |
| Other identifying information | 6 months |
| Salary preference | 6 months |
| Video footage | 4 weeks |
8. How do we keep your data safe?
Rapala VMC applies strict and up-to-date data security means to protect your personal data. It is important for us to protect confidentiality and integrity of your personal data when we are processing it. We have implemented measures designed to secure your personal information from accidental loss and from unauthorized access, use, alteration and disclosure.
Your personal data is protected by physical, organizational and technical means. Data is stored on servers securely located, behind firewalls and when we are using our partners to process your personal data, we require them to follow the same rules that we follow. Only authorized persons are allowed to access the data and we keep strict technical measures to protect the data and control the access. All of this is done to reduce any risk of loss, misuse or unauthorized access, disclosure or modification of your personal data in our possession.
9. Your rights as a data subject
The data protection legislation gives you rights to manage how your personal data is collected and used. However, please note that these rights are not absolute and there are certain limitations. Please also note that we are obliged to keep your personal data confidential, so be prepared to prove your identity when exercising these rights.
To exercise the rights listed below, please contact us at privacy@rapalavmc.com
Right to transparent information. You have the right to receive transparent information about the processing of your personal data. You can always ask more details about the processing by contacting us at the email address above.
Right to access your personal data. You have a right to know whether or not we are processing your personal data. In addition, you have the right to know what personal data we have on you, the purposes of processing it, the recipients to whom your personal data have been or will be disclosed, the retention periods, information about the sources of your personal data as well as information about transfers of your personal data to third countries. If you wish, we will also provide you with a copy of all your personal data undergoing processing.
Right to rectification. If you feel that your personal data is inaccurate, incomplete or out-of-date, you have the right to have such data rectified or completed.
Right to erasure. In certain situations, you have a right to get your personal data erased. Please note however, that this right applies in limited situations, for example, we can’t delete personal data that we must retain to comply with a legal obligation, such as accounting and bookkeeping laws.
Right to restriction of processing. In certain situations, you have a right to obtain a restriction of processing. For example, if you contest the accuracy of your personal data and we can’t verify it, or you need personal data that we are about to delete for the establishment, exercise of defence of legal claims, we will restrict the processing of such personal data.
Right to data portability. You have a right to get your personal data in a structured, commonly used and machine-readable format and have it transmitted to another controller (where technically feasible). Please note however, that this right applies only to personal data processed by automated means which you have provided to us and which we are processing relying on your consent or contract.
Right to object. You have the right to object the processing of your personal data which is based on our legitimate interests. In addition, you have the absolute right to object the processing of your personal data for direct marketing purposes.
Right to lodge a complaint. If you suspect your personal data has been processed unlawfully or you are not happy about our privacy practices, you always have the right to lodge a complaint to your local data protection supervisory authority. Find the contact details of the supervisory authorities below:
Finland: https://tietosuoja.fi/ilmoitus-tietosuojavaltuutetulle
