Privacy notice for job applicants

This privacy notice explains how Arelion (“employer”, “we”, “us”) collects and processes personal data about job applicants (“candidates”, “you”) through the HR system HiBob. It also outlines your rights regarding your personal data and how you can exercise them. 

When you apply for a job, are referred to for a position, or otherwise interact with the employer through HiBob, the employer is the data controller under the General Data Protection Regulation (GDPR). This means we are responsible for deciding how and why your personal data is used. 

HiBob acts as a data processor, which means it only handles your data on our behalf and does not make decisions about how your data is used. 

If you have any questions or concerns about your personal data or this privacy notice, please contact us at dpo@arelion.com.

You may also contact HiBob’s privacy team at hiring.privacy@hibob.com. However, since HiBob is a data processor, they may not be able to respond to your request directly without our approval.

We process the following types of personal data about you during the recruitment process:

• Contact details: We will process your name, email address, phone number, and postal code.
• Application materials: We will process your CV, cover letter, work samples, references, letters of recommendation, and any other information you include in your application. If you choose to include sensitive personal data, we may process it only when necessary and based on your explicit consent.
• Interview and reference data: We will process notes from interviews, results from assessments or tests, and information about your expectations and salary requirements.
• Communication records: We will collect and store your communications with us, including any information you provide in those messages.
• Sensitive personal data: If you share sensitive information, we may process it only when necessary and with your explicit consent.

We collect your personal data in the following ways:

• Information you provide to us: Most of the personal data we process comes directly from you. You may provide this information when you apply for a job, contact us, or otherwise interact with us. You can choose not to share certain information, but please note that some data is necessary for us to evaluate your application.
• Information we collect from other sources: We may also collect personal data about you from external sources, such as your current employer’s website, LinkedIn, or recruitment service providers. This is commonly referred to as “sourced recruitment.”
• Employee referrals: Our employees may recommend potential candidates by submitting their details on HiBob. If you are referred to in this way, this Privacy Notice also applies to you.

We process your personal data for the following purposes and based it on the following legal basis:

• To manage your application: We will use your personal data to handle and review your job application. This is based on our legitimate interest in maintaining a structured and efficient recruitment process.
• To carry out the recruitment and selection process: We will process your data to assess your qualifications and determine whether you are a good fit for the role. This includes both direct applications and sourced recruitment. The legal basis is our legitimate interest in hiring qualified candidates.
• To communicate with you: We will use your contact details to stay in touch with you throughout the recruitment process. This is necessary for our legitimate interest in ensuring clear and timely communication.
• To protect our legal rights and business interests: We may retain and use your data if necessary to protect our legal rights or respond to legal claims, such as in cases of discrimination or regulatory investigations. This is based on our legitimate interest in defending and enforcing legal claims.
• In connection with business changes: If Arelion undergoes a merger, acquisition, or other business restructuring, your personal data may be shared with parties involved in the process. This is based on our legitimate interest in managing and developing our business.

In some cases, we may need to share your personal data with trusted individuals or organizations. We only share your data when necessary and ensure that appropriate safeguards are in place.

• Consultants: We may share your personal data with trusted consultants who support our recruitment process. Access is limited to those who need the data to perform their tasks, and all consultants are bound by strict confidentiality obligations.
• Service providers: We may share your personal data with service providers who support our daily operations, such as HiBob or external recruitment agencies. These providers process your data on our behalf and in accordance with our instructions.
  Sub-processors of HiBob: For information about HiBob’s sub-processors, please refer to https://www.hibob.com/privacy/hibob-subsidiaries-and-sub-processors/#core_sub_processors.
• Authorities and public bodies: We may share your personal data when required by law, such as responding to lawful requests from law enforcement, regulatory agencies, or other government authorities. We may also disclose data when necessary to detect or prevent fraud.
• Legal proceedings: If legal action is taken or anticipated, we may share your personal data with parties involved in the process, such as legal advisors, to protect or enforce our rights.
• Business transfers: In the event of a merger, acquisition, sale of assets, or other business restructuring, your personal data may be shared with or transferred to the relevant parties involved. This is based on our legitimate interest in managing and developing our business.
• Other parties: We may share your personal data with other parties if you ask us to or give us your explicit consent.

We aim to process and store your personal data within the European Union (EU) or European Economic Area (EEA). However, in some cases, your data may be transferred to or stored in countries outside the EU/EEA.

Please note that privacy laws in countries outside of the EU/EEA may not be the same as, and in some cases may be less protective than privacy laws in your country. However, we always select our service providers carefully and take all the necessary steps to ensure that your personal data is processed with adequate safeguards in place in accordance with the GDPR.

These safeguards may include:

• Using the EU Commission’s Standard Contractual Clauses,
• Ensuring the service provider is located in a country recognized by the EU Commission as offering adequate data protection,
• Or, if the provider is based in the United States, confirming they are certified under a valid data transfer framework such as the EU-U.S. Data Privacy Framework.

If you would like more details about specific countries or the safeguards we use, please contact us.

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected. The exact duration depends on the type of data and the purpose we process it for. We regularly review our data retention practices to ensure compliance with applicable laws.

• During the recruitment process: If you apply for a job, we will keep your personal data throughout the recruitment process. If you are hired, your data will be retained for the duration of your employment, but for other employment-related purposes, which you will be informed about separately.
• Sourced or recommended candidates: If you were identified through a recommendation or sourced recruitment, we will retain your personal data during the recruitment process.
• Unsuccessful applications: If your application is unsuccessful, we will retain your personal data for a period of up to 6 months from the date of the rejection decision, unless a longer retention period is required or permitted by applicable local legislation. After this period, your personal data will be securely deleted or anonymized in accordance with our data protection policies and applicable law.
• Data based on consent: Any personal data processed based on your consent will be deleted when you withdraw your consent or when the purpose for which it was collected no longer applies.
• Legal obligations: In some cases, we may be required to retain your data for a longer period to comply with legal or regulatory requirements.

Under the GDPR, you have several rights regarding your personal data. These include:

• Right of access: You have the right to request a copy of the personal data we process about you, along with information about how it is collected, used, and shared. The first copy is provided free of charge. If you make repeated or excessive requests, we may charge a reasonable administrative fee.
• Right to object: You have the right to object to our processing of your personal data when it is based on legitimate interests. If you object, we will stop processing your data unless we can demonstrate compelling reasons that override your interests. You can contact us to learn more about how we assess this balance.
  You also have an unconditional right to object to your personal data being used for direct marketing purposes.
• Right to data portability: You may request to transfer the personal data you have provided to us to another data controller, under certain conditions.
• Right to rectification: You have the right to correct or update inaccurate or incomplete personal data.
• Right to erasure ("right to be forgotten"): You may request that we delete your personal data, for example if it is no longer needed for the purpose, it was collected or if there is no legal basis for its processing.
• Right to restriction of processing: You can request that the processing of your personal data should be limited until inaccurate or incomplete information about you has been corrected, or until an objection from you has been handled.
• Right to withdraw consent: If you have given us consent to process your personal data, you may withdraw it at any time. This will not affect any processing that has already taken place.
• Right to lodge a complaint: If you believe we have not handled your personal data properly, you have the right to file a complaint with a supervisory authority.

To exercise any of your rights under this Privacy Notice, please contact us at dpo@arelion.com.

Please note that if you request restriction or erasure of your data, it may affect our ability to process your application. Additionally, legal obligations may prevent us from disclosing, transferring, or deleting certain data immediately.

We may update this privacy notice from time to time. If any significant changes are made, we will inform you. We also encourage you to review this privacy notice periodically to stay informed about how we handle your personal data.