Ensuring your privacy is maintained

This Candidate Privacy Notice explains how we collect, use, and protect your personal data during our recruitment process, and how you can exercise your privacy rights as a job applicant.

This notice applies specifically to personal information collected as part of our hiring activities – including when you apply for a job, interact with our recruitment team, or are referred to us as a candidate.

Please read this Candidate Privacy Notice carefully to understand how your data is handled. For general data processing practices unrelated to recruitment, please refer to our full Privacy Policy.

If you have any questions about your data during the hiring process, you can contact us via the details provided in the “Contact” section of our website.

1. Controller

Company: Firemind Group Oy
Address: Kalevankatu 4 A 20, 00100
Helsinki, Finland
Email: tuuli.niininen@itd589002f97671-sfygl.wpcomstaging.com
(“we” or “Firemind”)

2. Contact Person for Register Matters

Name: Tuuli Niininen, HR Manager
Address: [Same as above] 
Email: tuuli.niininen@itd589002f97671-sfygl.wpcomstaging.com 

3. Name of the Register

Job Applicant Register

4. Purpose and Legal Basis for Processing Personal Data

We process personal data to manage and facilitate our recruitment processes – including receiving and reviewing applications, conducting interviews and assessments, communicating with candidates, and finalizing hiring decisions.

The legal bases for processing your data are:

• Legitimate interest – to evaluate candidates, manage recruitment, and communicate with applicants.

• Consent, for example:

  • Contacting references;
  • Conducting personality or aptitude assessments;
  • Performing background or medical checks where applicable.
  • Contract – to prepare or negotiate an employment contract at the final stages of recruitment.
  • Legal obligation – if legislation requires retention or disclosure of certain data.

Background Checks

For specific roles (e.g., those requiring legal clearance or high trust), we may conduct background checks such as reference verification or security clearances. These are only performed when permitted by law and based on your consent or our legitimate interest. 

5. What Data Do We Process?

• Basic information (name, contact details)
• Application-related information (role applied for, salary expectation, availability)
• Education, work history, skills, certifications
• Publicly available professional profiles (e.g., LinkedIn, GitHub)
• Assessment results, interview notes, references (if applicable)
• Work eligibility documentation (such as proof of right to work, work permits, or visa status), if necessary for certain roles or to finalize employment
• Other voluntarily provided information (e.g., video introductions, cover letters, references, portfolios). 

Providing your personal data is necessary to process your application. 

6. Where We Get the Data

We primarily collect data directly from you. We may also receive data from: 

• Publicly available professional platforms
• Recruitment partners or consultants (with your permission)
• References and assessments (with your consent)  

7. Disclosures and Transfers of Data

We may share your personal data: 

• Internally at Firemind with recruitment stakeholders
• With selected third-party processors (e.g., ATS providers, assessment platforms, external recruiters)
• With Firemind group companies, if necessary for recruitment

We may transfer personal data outside the EEA, and the United Kingdom, in compliance with applicable data protection laws. In such cases, we ensure appropriate safeguards (e.g., EU Standard Contractual Clauses or equivalent legal mechanisms). 

8. Automated Processing and Profiling

We may use digital and AI-assisted tools (for example CV parsers, summarization features, or systems that help us organize applications) to support and streamline parts of our recruitment process. These tools may assist with tasks such as identifying keywords, grouping similar profiles, or generating preliminary evaluation compared to the job requirements)

However, these tools do not make final hiring decisions, nor do they automatically accept or reject candidates. All decisions that could affect your application outcome involve human review, judgment, and accountability.

If we introduce systems that make solely automated decisions that could have legal or similarly significant effects on you (for example, automatic shortlisting or rejection without human involvement), we will inform you in advance and ensure you have the right to request human intervention, express your point of view, or contest the decision.

9. Open Applications

If you submit an open (unsolicited) application, we will process it in the same manner as standard applications and store it for up to one (1) year, unless you request earlier removal.

10. Data Security and Retention

We protect your personal data with appropriate technical and organizational measures, including: 

• Access controls, secure infrastructure, and encryption
• Confidentiality obligations for personnel
• Secure physical and digital storage environments

Data Retention

By default, your data is stored for up to one (1) year after the recruitment process ends.

• If required by law, we may retain certain data longer (e.g., for regulatory compliance).
• With your explicit consent, we may store your data in our talent pool for up to ten (10) years, renewing your consent every two years. If you do not renew, your data will be deleted without undue delay.

If you are hired, relevant applicant data will be transferred to your employee file and processed under our employee data protection policy.

11. Your Rights

As a data subject, you have the right to: 

• Access the data we hold about you
• Rectify inaccurate or incomplete data
• Erase data (right to be forgotten), subject to legal exceptions
• Restrict processing in certain circumstances
• Object to processing based on our legitimate interest
• Withdraw your consent at any time (affects future processing)
• Data portability, where applicable  

To exercise your rights, contact the person listed in section 2. We may ask you to verify your identity to protect your data. 

You also have the right to file a complaint with the Finnish Data Protection Authority or your local supervisory authority. 

12. Updates to This Privacy Notice

We may update this notice due to changes in law, our operations, or recruitment tools. If the changes are material, we will inform you directly or via our recruitment platform. We encourage you to review this notice periodically.