Accessibility tools

 AI-translated page—pardon any small errors!

Job applicant register privacy notice

PRIVACY NOTICE FOR THE JOB APPLICANT REGISTER OF THE HELSINKI THEATRE FOUNDATION / HELSINKI CITY THEATRE

Date prepared: 23.10.2019

 

1. DATA CONTROLLER
Helsinki Theatre Foundation / Helsinki City Theatre
Business ID: 0116521-0
Address: Ensi linja 2, 00530 Helsinki
Telephone: (09) 39401 (switchboard)
Contact person: Minna Santavuori, [javascript protected email address]

2. NAME OF THE REGISTER
Helsinki City Theatre’s job applicant register (hereinafter the Register).

3. PURPOSE AND LEGAL BASIS FOR PROCESSING PERSONAL DATA
The processing of personal data is based on the Data Controller’s legitimate interest arising from the relevant relationship between the Data Controller and the Data Subject when the Data Subject applies for a position with the Data Controller.

The processing of personal data is also partly based on compliance with a legal obligation insofar as the Data Controller processes personal data to fulfil its statutory obligations as an employer.

Personal data may also be processed on the basis of consent to the extent required by law, for example when personal data is collected from sources other than the Data Subject.

Personal data is processed for the purposes of receiving and reviewing job applications, carrying out and managing potential recruitment procedures, and communicating in relation to job applications and recruitment.

4. DATA CONTAINED IN THE REGISTER
The job applicant register contains personal data concerning individuals who have applied for a position with the Data Controller.

The following personal data may be processed in the Register:

  • name and contact details (including telephone number, email address, home address, postal code and city)
  • position applied for
  • educational background (including the name of the educational institution, qualification and duration of studies)
  • work experience (including employer details, job title and duration of employment)
  • other information provided by the applicant in their application and CV, such as information about their expertise, personal qualities, interests or skills.

As a rule, the Data Controller collects personal data directly from Data Subjects through the applications they submit. Within the limits permitted by law, the Data Controller may also obtain information about Data Subjects from other sources. Personal data may likewise be collected from referees named by the Data Subject.

If information is collected from sources other than the Data Subject, the Data Controller will, as a rule, always request the Data Subject’s consent. By submitting a job application, the Data Subject authorises the collection of information from any profile they have published for professional purposes, insofar as collecting such information is necessary and relevant to their ability to perform the position in question.

5. DISCLOSURE AND TRANSFER OF DATA
Data contained in the Register will not be disclosed to third parties or transferred outside the EU or EEA unless the Data Subject’s consent to such disclosure and transfer has been specifically requested and obtained. However, personal data may be disclosed to the extent required by the legislation in force at the time.

6. PRINCIPLES FOR PROTECTING THE REGISTER
When processing personal data, the Data Controller complies with the statutory duties of care and protection as well as good information management practices. Databases containing personal data may only be accessed by employees of the Data Controller whose duties require them to process personal data. Personal data is stored in systems protected by firewalls, passwords and any other technical and organisational measures generally accepted in the information security sector at the time. Manually maintained materials are kept on premises to which unauthorised access is prevented.

7. RIGHTS OF THE DATA SUBJECT
The Data Subject has the right to access the personal data concerning them that is stored in the Register and to request the correction of inaccurate, unnecessary, incomplete or outdated data, as well as the erasure of data. Insofar as the processing of personal data is based on consent given by the Data Subject, the Data Subject has the right to withdraw their consent.

If the Data Subject wishes to exercise their rights or has any questions about this privacy notice or the processing of their personal data, they are requested to contact the Data Controller by email at [javascript protected email address].

Under the General Data Protection Regulation, the Data Subject has the right to lodge a complaint with the competent supervisory authority if the Data Controller has failed to comply with the applicable data protection legislation in its operations ([javascript protected email address]).

8. RETENTION PERIOD FOR PERSONAL DATA
Data collected in the Register will be retained only for as long and to the extent necessary for the purposes for which the personal data is used. As a rule, the data may be used for recruitment purposes for a period of six (6) months. The law may require data to be retained for one (1) year from the recruitment decision (for example, in the event of alleged discrimination). The data will be destroyed within two (2) years at the latest. However, every effort will be made to erase outdated and unnecessary personal data without undue delay.

If the Data Subject becomes an employee of the Data Controller, the information they provided as a job applicant and any information related to their application will be retained as part of their employee profile in accordance with the privacy notice concerning the personal data of the Data Controller’s employees.