Recruitment and Candidate Sourcing Privacy Policy

1. Introduction

This Recruitment Privacy Policy ("Privacy Policy") outlines how Upright Oy, (“Upright”, "we," "us," or "our") processes personal data of job applicants and potential candidates who engage with our open positions. As the data controller, Upright Oy is committed to safeguarding your privacy and complying with data protection laws. This Privacy Policy explains why and how we process your personal data during the recruitment process. Moreover, this Privacy Policy provides information on how and why we process personal data regarding potential job candidates who we are contacting in connection with introducing our open positions (referred to as “Candidate” or “you”).

2. Data Controller Information

Upright Oy

Business ID: 2795743-5

Annankatu 27, 00100 Helsinki

Email: recruiting@uprightproject.com

3. Sources of Personal Data

We may collect personal data from the following sources:

  • Personal data provided directly by applicants during the recruitment process, including application forms, interviews, and aptitude assessments.
  • Technical data automatically collected when visiting our website, such as IP addresses. More information regarding the processing of personal data on our website here.
  • Personal data from publicly available services like LinkedIn and GitHub, particularly for candidates we approach.
  • Personal data from background checking organizations with your consent.
  • References from former employers or educational institutions.

4. Purposes of Data Processing

Your Personal Data is collected, used, stored and otherwise processed for the purposes of handling Your job application and for other Upright's recruitment activities. Your Personal Data is not used for profiling or other automated decision-making nor direct marketing purposes.

Upright will process Your Personal Data during recruitment process for the following purposes:

  • Communicating with You during the recruitment process, such as:
    • obtaining additional information from You;
    • informing You of possible available vacancies; and
    • providing You with information relating to Your application.
  • Setting up and conducting interviews and assessments;
  • Managing Upright's recruitment activities. In the course of such recruitment activities, Upright may use Your Personal Data:
    • To evaluate, select and recruit applicants;
    • To conduct background and credit checks and assessments as required or permitted by applicable legislation; and
    • To contact third-party references You have nominated in order to evaluate Your previous performances.
  • Other purposes necessary in context of Upright's recruitment activities.

Sourcing passive candidates: We use publicly available contact details for the purpose of contacting You and inquiring Your interest to apply for a job at Upright.

5. Legal Basis for Data Processing

Our data processing is based on the following legal bases:

  • Necessity for the performance of a contract prior to entering into an employment contract
  • Legitimate interests pursued by Upright in order to secure competitiveness and business continuity. The processing includes the following activities:
    • Searching and contacting potential candidates and inquiring their interest to apply for a job at Upright. For this purpose we will only process Personal Data that You have made publicly available.
    • Informing and offering our open positions to suitable candidates
    • Communicating effectively with candidates during the recruitment process
  • Consent, where required by data protection laws, for background and reference checks.

6. Categories of Personal Data Processed

During the recruitment process Upright collects Personal Data directly from You as well as from other available sources to the extent relevant and permitted by applicable local law. Your Personal Data that is processed under this Privacy Policy includes the following:

  • Information that You submit to Upright when you submit an application or otherwise apply for a position including your contact data and all the information that you have included in your CV or cover letter.
  • Information that Upright gets from other sources, such as
    • Information provided by the references You have nominated
    • Information related to credit or background checks, depending on the position You are applying for. Such information will be processed only when and to the extent permitted by applicable legislation.
    • Contact details from public sources (such as LinkedIn profile) for sourcing passive candidates
  • Cookies and other Technical Information: When You access Upright website, our web servers automatically create records of Your visit. We have explained in the Privacy Policy for Upright website how we process Your Personal Data when You are using our website.

7. Sharing of Personal Data

In order to fulfill the purposes described in this Privacy Policy, we may have to share your personal data with the parties set out below. These parties may include:

  • Third-party service providers, including but not limited to, data storage, data management and recruitment service providers;
    • All third-party service providers are required to take appropriate security measures to protect your data and they may only process personal data for the purposes mentioned in this Privacy Policy and in accordance with our instructions.
  • Courts, counterparties etc., as required to establish, exercise or defend legal claims;
  • To the extent required and necessary, competent authorities if we are obligated under law to disclose data; and
  • Prospective sellers or buyers if we are involved in a merger, acquisition, or sale of all or a portion of our assets.

8. International Data Transfers

For job applicants in EU/EEA countries:

Your Personal Data will be transferred to countries outside the European Union/EEA (including United States). Upright may use service providers that are located outside the European Union/EEA and provide services relating to recruitment activities to Upright. This means that Your Personal Data may be transferred to other countries than the one where You are applying to as an applicant.

When transferring Your Personal Data outside the European Union/EEA, we will ensure that the transfer is legal and safe by concluding an agreement based on EU Commission's standard contractual clauses or taking other measures permissible under applicable legislation.

Please email us at recruiting@uprightproject.com if you want further information on the specific mechanism used by us when transferring your personal data out of the EEA or to obtain a copy of any contractual clauses in place. Please note, however, that some details may be redacted for confidentiality reasons.

9. Data Retention

We retain personal data for the following periods:

We will only retain personal data for as long as it is necessary to fulfill the purposes defined in this Privacy Policy. In general, we comply with the following criteria with respect to retaining and erasing personal data:

  • With respect to you as a Candidate, personal data are retained during the search and evaluation period. Personal data will be erased after we have contacted you to inform and offer open position at Upright;
  • With respect to you as an Applicant, personal data are retained for the duration of the recruitment process. After the selection decision has been made, non-selected Applicants personal data are retained for a maximum period of 2 years in order to be able to communicate new open positions as well as for safeguarding our legitimate interests in establishing, executing or defending possible legal claims.

Please note that if you are hired as a result of your application, some of the personal data collected as part of the recruitment process may be transferred to your personnel file.

10. Data Subject Rights

You have the following rights:

Subject to certain exemptions and limitations, you have certain rights in relation to the processing of your personal data. You have the right to:

  • Access your personal data;
  • Update incorrect or incomplete personal data;
  • Object to the processing of personal data;
  • Erase your personal data;
  • Restrict the use of your personal data;
  • Data portability, meaning the right to receive your data in a structured, commonly used machine-readable format and transmit the data to another data controller; and
  • Withdraw your consent.

If you wish to exercise these rights, contact us at recruiting@uprightproject.com.

In case you exercise your rights, we may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

11. Contact us

If you have any questions regarding the processing of your personal data, please do not hesitate to contact us. See below for contact details:

Upright Oy

Annankatu 27

00100 Helsinki

Finland

recruiting@uprightproject.com

You have the right to make a complaint at any time to the supervisory authority in your country of residence. In Finland, the relevant supervisory authority is the Office of the Data Protection Ombudsman. We would, however, appreciate the chance to deal with your concerns before you approach any supervisory authority. Therefore, please contact us in the first instance.