# Privacy policy for the Cactos employer branding and recruitment Date of publication: 07-06-2024 We at Cactos manage our employer branding and recruitment process through our [career site](https://careers.cactos.com/) (the “Career Site”), and by using a related applicant tracking system. In this privacy policy, we explain how we process your personal data if: 1. You visit our Career Site (you being a “Visitor”) 2. You connect with us via our Career Site, to create a profile with us and receive information about current or future vacancies with us (you being a “Connecting Candidate”) 3. You apply for a position with us, via our Career Site or a third party service (you being an ”Applying Candidate”) 4. We collect information about you from other parties, sites and services, since we believe your profile is of interest for our current or future vacancies (you being a “Sourced Candidate”) 5. We receive information about you from our employees or partners, since they believe your profile is of interest for our current or future vacancies (you being a “Referred Candidate”) 6. We receive information about you from a Candidate, who lists you as their reference (you being a “Reference”). This privacy policy also describes what rights you have when we process your personal data, and how you can exercise these rights. When we use the term “Candidate” in this privacy policy, we are referring to each of Connecting Candidates; Applying Candidates; Sourced Candidates; and Referred Candidates, unless it’s stated otherwise. ### 1. About processing of personal data Personal data is all information that can be directly or indirectly linked to a living, physical person. Examples of personal data are: name, e-mail address, telephone number and IP address. Processing of personal data is any automated use of personal data - such as collecting, creating, analyzing, sharing, and deleting personal data. There are laws and regulations on how companies may process personal data, so-called data protection laws. Different data protection laws apply to different types of use of personal data, and in different parts of the world. An example of a data protection law that is relevant for our use of your personal data, as described in this privacy policy, is the EU Data Protection Regulation (2016/679, “GDPR”). Most obligations under the GDPR apply to the so-called data controller. A data controller is the entity that decides for which purposes personal data will be processed, and how the processing will be executed. The data controller can use a so-called data processor. A data processor is an entity that is only allowed to process personal data as instructed by the data controller, and may not use the personal data for its own purposes. We are the data controller when we process your personal data as described in this Privacy policy. ### 2. What personal data do we process? #### All individuals - **Device information** - If you visit our Career Site, we will collect information about your device, such as IP address, browser type and version, session behaviour, traffic source, screen resolution, preferred language, geographic location, operating system and device settings/usage. - **Technical and statistical data** - If you visit our Career Site, we will collect technical and statistical data about your use of the site, such as information about which URLs you visit, and your activity on the site. - **Communications data** - We will collect and store your communication with us, including the information you provided in the communication. This may include the content of emails, video recordings, messages on social media, the information you add to your account with us, surveys, etc. - **Contact details** - Such as your name, email address, telephone number and physical address. #### Candidates - **Data from interviews, assessments and other information from the recruitment process** - Such as notes from interviews with you, assessments and tests made, salary requirements. - **Information in your application** - Such as your CV, cover letter, work samples, references, letters of recommendation and education. - **Information in your public profile** - Meaning the information we collect about you from public sources related to your professional experience, such as LinkedIn or the website of your current employer. - **Information provided by references** - Meaning the information we receive from our employees or partners who refer you to us, or by the persons you have listed as your references. ### 3. Where do we receive your personal data from? #### All individuals - **From the Career Site.** If you visit our Career Site, we collect technical and statistical information about how you use the Career Site, and information from your device. - **Directly from you.** Most of the information we process about you, we receive directly from you, for example when you apply for a position with us or connect with us. You can always choose not to provide us with certain information. However, some personal data is necessary in order for us to process your application or provide you the information you request to get from us. #### References - **From the person for whom you are a reference.** If a Candidate lists you as their reference, we will collect your contact details from the candidate to be able to contact you. #### Candidates - **From public sources.** We may collect personal data about you from public sources, such as LinkedIn or the website of your current employer. - **From our references.** We may receive information about you from our employees or partners (such as recruitment service providers), when they believe your profile is of interest for our current or future vacancies. - **From your references.** If you provide us with references, we may collect information about you from them. - **Data we create ourselves or in cooperation with you.** Information about your application and profile is usually created by us, or by us in cooperation with you, during the recruitment process. This may for example include notes from interviews with you, assessments and tests made. ### 4. For what purposes do we process your personal data? - Protect and enforce our rights, interests and the interests of others, for example in connection with legal claims. - Share your personal data with other recipients, for the purposes mentioned. - Collect information about your use of the career site, using cookies and other tracking technologies, as described in our [Cookie Policy](https://careers.cactos.com/cookie_policy). - Maintain, develop, test, and otherwise ensure the security of the career site. - Analyse how the career site and its content is being used and is performing, to get statistics and to improve operational performance. - Provide you with updates about vacancies with us. - Review profiles and applications sent to us. This also includes communicating with you about your application and profile. - Collect and evaluate your professional profile on our own initiative. This also includes communicating with you regarding your profile. - Contact you directly about specific, future vacancies with us. - Record the interview(s) with you. - Contact you to ask for your participation in surveys. - Contact you to ask you to provide information about a candidate, and evaluate the information you provide. ### 5. Whom do we share your personal data with? - Our service providers. We share your personal data with our suppliers who provide services and functionality in our employer branding- and recruitment process. - Our group companies. We share your personal data with our group companies, when they provide us services and functionality to our employer branding- and recruitment process. - Companies providing cookies on the Career Site. If you consent to it, cookies are set by other companies than us. - Authorities and other public actors - when we are ordered to do so. - Parties involved in legal proceedings. If needed to protect or defend our rights, we share your personal data with public authorities or with other parties involved in a potential or existing legal proceeding. - Mergers and acquisitions etc. In connection with a potential merger, sale of company assets, financing, or acquisition of all or part of our business to another company, we may share your personal data to other parties involved in the process. ### 6. On what legal bases do we process your personal data? To be able to process your personal data, we need to have a so-called legal basis. A legal basis is a reason for processing the personal data that is justified under the GDPR. When we process your personal data for the purposes described in this Privacy Policy, the legal basis we rely on is normally that the **processing is necessary for our legitimate interest** in being able to recruit talent with the relevant competence for us. ### 7. When do we transfer your personal data outside of the EU/EEA, and how do we protect it then? We always strive to process your personal data within the EU/EEA area. However, some of our service providers process your personal data outside of the EU/EEA. ### 8. For how long do we keep your personal data? - If we process your personal data for the purpose of being able to protect and enforce our rights, we will keep your personal data until the relevant legal issue has been fully and finally resolved. - We keep your personal data for one (1) year for security purposes. - If you are a Connecting Candidate (only), we keep your personal data for as long as you remain connected with us. ### 9. What rights do you have, and how can you exercise them? In this section, you will find information about the rights you have when we process your personal data. - Right to be informed - Right to access your personal data. - Right to access and to request a transfer of your personal data to another recipient (“data portability”). - Right to have your personal data deleted (“right to be forgotten”). - Right to object against our processing of your personal data. - Right to restrict processing. - Right to rectification. - Right to withdraw your consent. - Right to raise a complaint. ### 10. Where can you turn with comments or questions? If you want to get in touch with us to exercise your rights, or if you have any questions, comments or concerns about how we handle your personal data, you can reach us by sending an email to paivi.rantsi@cactos.fi. ### 11. Updates to this Privacy policy We update this privacy policy when necessary - for example, because we start processing your personal data in a new way, because we want to make the information even clearer to you, or if it’s necessary to do so in order to comply with applicable data protection laws.