According to the General Data Protection Regulation (the GDPR), the personal data controller of a register is obligated to inform the register’s data subjects in a clear manner. This statement fulfills this informing obligation.
1. Personal data controller
Xpertrec Oy (later referred to as “we” or “Xpertrec”)
00100 Helsinki, Finland
Contact information in matters related to data register:
Data Protection Officer
00100 Helsinki, Finland
+358 50 464 5477
2. Data subjects
Persons included in the register can be candidates and/or potential candidates who we have a legitimate business interest in.
3. Purpose of use of personal data
We access candidates’ information to help us match them to suitable assignments. We treat all personal and sensitive information we hold as highly confidential and private, as this information is not shared with our clients. We only give access to personal and sensitive information that is necessary and where consent has been given.
We will only use your information where we have a legal basis to do so and will always respect your rights. Where we do use your information, this will be because you have consented to us doing so or because we have a legitimate interest to use it. When we use your information with consent, it is done so in a way that is unobtrusive and respects your rights. Other reasons may include using information because we have a legal obligation to do so or because we have to fulfill contractual obligations. Your information will never be used without your permission, and you will have a right to withdraw your information from our records should you wish.
4. Personal data recorded in the register
The customer register may contain the following information:
Contact details such as; name, address(es), telephone number(s), email address(es);
Curriculum vitae and photograph, employment details
Compliance documentation and references verifying your qualifications and experience and your right to work in Finland or the EU
Employment preferences, links to your professional profiles available in the public domain e.g. LinkedIn, Twitter, business Facebook or corporate website
Identification information such as; date of birth, gender, nationality, residency,or other national identity number such as passport number, driving license, occupation, employment status,employer and job title.
5. The data subject’s rights
The data subject has the following rights under GDPR:
Right to access data
The data subject may check the data we have recorded.
Right to rectification
The data subject may request the rectification of inaccurate or incomplete personal data.
Right to object
The data subject may object to the processing of personal data if the data subject feels that personal data has been processed unlawfully.
Right to forbid direct marketing
The data subject has the right to forbid the use of personal data for direct marketing.
Right to deletion
The data subject has the right to request the deletion of data if personal data processing is not necessary. We will handle the request for deletion and proceed to either delete the data or state a justified reason for not being able to delete the data.
It should be noted that the controller may have legal or other rights to not delete the requested data. The controller is obligated to preserve accounting materials for the duration (10 years) set out in the Accounting Act (Chapter 2, Section 10). For this reason, materials related to accounting cannot be deleted before that term has expired.
If the processing of personal data is only based on the data subject’s consent and not for instance on a customer relationship or membership, the data subject may withdraw consent.
The data subject may complain of the decision to the Data Protection Supervisor
The data subject has the right to demand us to restrict the processing of controversial data until the matter is solved.
Right to complain
The data subject has the right to complain to the Data Protection Ombudsman if the data subject feels that we are violating the effective data protection regulation when processing personal data.
Contact information of the data protection ombudsman: https://tietosuoja.fi/en/contact-information
6. Duration of processing
At this time, personal data is held by Xpertrec as long as we need it for our legitimate business purposes or until the person in question asks for it to be removed. Inactive candidates’ information will be removed three (3) months after last contact.
7. Regular information sources
For the purposes of providing you with work-finding services and/or information relating to roles relevant to you we will only use your personal data in accordance with the terms of the following sections.
You may give your personal details to the company directly via email or over the phone with one of our representatives who are authorized to take personal data, on an application or registration form or via our website at www.xpertrec.com or www.xpertrec.fi, or we may collect them from another source such as LinkedIn, corporate websites, job board websites, online CV libraries, your business card, personal recommendations, and any relevant social media sites.
8. Regular disclosure of data
The data is not generally disclosed for business purposes outside Xpertrec. If such instance arises, the company representative will individually ask for the data subject's consent to sending their information to our external partner.
9. Personal data processors
Xpertrec and its employees process personal data. We may also outsource the processing of personal data partly to a third party, in which case we will guarantee with contractual arrangements that personal data is processed in compliance with valid data protection legislation and also otherwise appropriately.
10. Transferring data outside the EU
Personal data is not transferred outside the EU or the EEA.
11.Automatic decision-making and profiling
We are not using the data for automatic decision-making or profiling.
We reserve the right to update this policy as we see fit in regard to the information we require. To ensure full transparency, the updates made can be viewed on this page as soon as they take place.