Xpertrec Privacy Policy

According to the General Data Protection Regulation (the GDPR), the personal data controller of a register is obligated to inform the register’s data subjects in a clear manner. This statement fulfills this informing obligation.

1. Personal data controller 

Xpertrec Oy (later referred to as “we” or “Xpertrec”)


Contact information:

Eerikinkatu 8 

00100 Helsinki, Finland

Contact information in matters related to data register:

Data Protection Officer

Jouni Rydman 

Eerikinkatu 8
00100 Helsinki, Finland
+358 50 464 5477

2. Data subjects 

Persons included in the register can be candidates and/or potential candidates who we have a legitimate business interest in.

3. Purpose of use of personal data

We access candidates’ information to help us match them to suitable assignments. We treat all personal and sensitive information we hold as highly confidential and private, as this information is not shared with our clients. We only give access to personal and sensitive information that is necessary and where consent has been given.

We will only use your information where we have a legal basis to do so and will always respect your rights. Where we do use your information, this will be because you have consented to us doing so or because we have a legitimate interest to use it. When we use your information with consent, it is done so in a way that is unobtrusive and respects your rights. Other reasons may include using information because we have a legal obligation to do so or because we have to fulfill contractual obligations. Your information will never be used without your permission, and you will have a right to withdraw your information from our records should you wish.

4. Personal data recorded in the register

The customer register may contain the following information: 

  • Contact details such as; name, address(es), telephone number(s), email address(es);

  • Curriculum vitae and photograph, employment details

  • Compliance documentation and references verifying your qualifications and experience and your right to work in Finland or the EU

  • Employment preferences, links to your professional profiles available in the public domain e.g. LinkedIn, Twitter, business Facebook or corporate website

  • Identification information such as; date of birth, gender, nationality, residency,or other national identity number such as passport number, driving license, occupation, employment status,employer and job title.

5. The data subject’s rights 

The data subject has the following rights under GDPR: 

Right to access data

The data subject may check the data we have recorded.

Right to rectification

The data subject may request the rectification of inaccurate or incomplete personal data.

Right to object

The data subject may object to the processing of personal data if the data subject feels that personal data has been processed unlawfully.

Right to forbid direct marketing

The data subject has the right to forbid the use of personal data for direct marketing.

Right to deletion

The data subject has the right to request the deletion of data if personal data processing is not necessary. We will handle the request for deletion and proceed to either delete the data or state a justified reason for not being able to delete the data.

It should be noted that the controller may have legal or other rights to not delete the requested data. The controller is obligated to preserve accounting materials for the duration (10 years) set out in the Accounting Act (Chapter 2, Section 10). For this reason, materials related to accounting cannot be deleted before that term has expired.

Withdrawing consent

If the processing of personal data is only based on the data subject’s consent and not for instance on a customer relationship or membership, the data subject may withdraw consent.

The data subject may complain of the decision to the Data Protection Supervisor

The data subject has the right to demand us to restrict the processing of controversial data until the matter is solved.

Right to complain 

The data subject has the right to complain to the Data Protection Ombudsman if the data subject feels that we are violating the effective data protection regulation when processing personal data.

Contact information of the data protection ombudsman: https://tietosuoja.fi/en/contact-information

6. Duration of processing

At this time, personal data is held by Xpertrec as long as we need it for our legitimate business purposes or until the person in question asks for it to be removed. Inactive candidates’ information will be removed three (3) months after last contact.

7. Regular information sources 

For the purposes of providing you with work-finding services and/or information relating to roles relevant to you we will only use your personal data in accordance with the terms of the following sections.

You may give your personal details to the company directly via email or over the phone with one of our representatives who are authorized to take personal data, on an application or registration form or via our website at www.xpertrec.com or www.xpertrec.fi, or we may collect them from another source such as LinkedIn, corporate websites, job board websites, online CV libraries, your business card, personal recommendations, and any relevant social media sites.

8. Regular disclosure of data

The data is not generally disclosed for business purposes outside Xpertrec. If such instance arises, the company representative will individually ask for the data subject's consent to sending their information to our external partner.

9. Personal data processors 

Xpertrec and its employees process personal data. We may also outsource the processing of personal data partly to a third party, in which case we will guarantee with contractual arrangements that personal data is processed in compliance with valid data protection legislation and also otherwise appropriately.

10. Transferring data outside the EU

Personal data is not transferred outside the EU or the EEA.

11.Automatic decision-making and profiling

We are not using the data for automatic decision-making or profiling.

12.Updating the Privacy Policy

We reserve the right to update this policy as we see fit in regard to the information we require. To ensure full transparency, the updates made can be viewed on this page as soon as they take place.