1. Processing of personal data
The protection of your personal data is important, and we will process your personal data only to the extent permissible under the applicable Norwegian data protection legislation.
2. The responsibility
Whether Vilect is the data controller and responsible for your personal data or just a data processor, meaning that we only process personal data on behalf of another entity, depends on our relationship with you. Below is a general description of when we act as data controller and data processor respectively.
2.1 Vilect as data controller
Vilect represented by its managing director, is responsible for your personal data in those instances as described in section 3 below. The contact information for Vilect is:
Company number: 917 649 278
Address: Munkedamsveien 67, 0270 Oslo, Norway
Any questions and queries regarding our processing of your personal data can be directed at firstname.lastname@example.org.
2.2 Vilect as data processor
We will in connection with conducting our business also act as data processors for our customers. This applies inter alia in the following instances:
a) When you submit a job application for a specific position in a certain company
b) When you submit an open application for a certain company
Pursuant to the data protection regulation, our customer, i.e. the company in which you have applied for a position, will be the controller. This means that it is this company that is the one responsible for the processing of your personal data in relation to the application processes described in letter (a) and (b) above. For the sake of clarity, please note that Vilect still may be the controller of the personal data processed for the purposes described in section 3 below.
Where we act as data processors we enter into a data processing agreement with the company that is responsible for the processing of your personal data. The data processing agreement outlines the framework for how we can process your personal data.
3. Why we process personal data and the categories of personal data
We collect and use your personal data for different purposes depending on who you are and how we come into contact with you. Below is an overview of which personal data we collect and process, and what the personal data is used for.
a) Managing your user access
In order to provide you with access to our system and manage your user access, including facilitating for communication with potential employers, we must process certain personal data regarding you. The personal data that will be processed are typically your contact details, such as name and email address.
Our basis of processing is our agreement with you regarding giving you access to our recruitment system so that you can submit job applications.
We will delete your user account if you are not associated with a recruitment process within six months after your previous log-in or since the last completed process you have been involved in, unless you have consented to your user account being kept active for an additional six months. We will also delete your user account if you request it. You may also delete your account yourself. If the account is deleted, all pertaining personal data will be deleted, including your job applications.
b) Provide user support and continuous support
We will help you should you need support in connection with the use of our recruitment system. We will also provide continuous support in the job seeking process, such as for example sending you a reminder to complete your application, or notify you if the application is incomplete or there are errors and therefore cannot be submitted.
The personal data that will be processed is your contact info, such as name and email address. We will be able to communicate with you directly in the system, or through email.
Our basis for processing is our legitimate interest in being able to help you throughout the job seeking process.
c) Handling open job applications
If you use our recruitment solution to send an open job application without the potential employer being predetermined or known, we will keep your application for you until it is connected to one or several potential employers through you becoming part of their recruitment process. An example is if you have an open application associated with a department store. In this instance all shops that are tenants in the department store will be your potential employer, and the company you are applying for a position with.
The personal data we collect and process are inter alia information that transpires from your CV, application letter, your diploma and any other references, pictures and videos.
Our basis for processing is your consent. You can at any time withdraw your consent by deleting your application or your user account. You can also send an email to email@example.com.
d) Administrating our recruitment solution
In order to administrate our recruitment solution, including ensuring sufficient security, we will process certain personal data regarding you.
We log information regarding traffic and user patterns, including your IP-address, for 30 days. After 30 days the log is deleted automatically.
The basis for our processing is our legitimate interest in ensuring administration and optimal running of our systems.
e) Optimising and further developing our recruitment solution
We log information regarding traffic and user patterns, including your IP address, for up to 30 days. After 30 days the log is deleted automatically.
We might also use submitted job applications in anonymised form in order to optimise and further develop our recruitment solution. The fact that the job applications are anonymised means that we cannot identify you.
The basis for processing is our legitimate interest in being able to optimise and further develop our system.
f) Other processing of personal data
4. Transfer of personal data to third parties
4.1 Use of data processors
Occasionally we use data processors to collect, store or in other ways process personal data on our behalf. These will typically be suppliers within operations, maintanance and other technical solutions. Our data processors will only gain access to the personal data necessary in order for the data processor to be able to deliver their services to us.
In order to secure your rights we have entered into a data processor agreement with all of our data processors, which means that your personal data cannot be used for other purposes than those agreed with you.
4.2 Other third parties
We will not disclose your personal data to other third parties unless there is a legal basis for such disclosure. Examples of a legal basis are if we have explicit consent from you, if the disclosure is necessary for legitimate interests pursued by us or because we are required by law to share the data. In the event a third party is located outside the EU/EEA, the disclosure will only take place in accordance with the applicable data protection regulation, including GDPR.
5. Deletion of the personal data
We will delete personal data in accordance with the applicable data protection legislation. This means that we will not store personal data any longer than what is necessary to fulfil the purpose of the processing.
This means that if we e.g. base our processing on your consent, we will delete the data if you withdraw your consent. If the processing is based on our legitimate interest, we will delete the data when the legitimate interest no longer exists.
In the case of open job applications we will delete your application in the event that you have not been associated with a recruitment process for six months, unless you have consented to it being stored for an additional six months. Consent can be withdrawn by deleting the job application or by deleted your user account. You can also send an email to firstname.lastname@example.org. If you delete your user account, all applications linked to your profile will be deleted automatically.
6. Your rights
In connection with our processing of your personal data, you have, with some reservations, several rights. Please find a summary of your rights below.
You have the right to:
- Access the personal data we process about you, and receive information about the processing.
- Demand rectification of personal data that are incorrect or incomplete.
- Demand erasure of personal data if the applicable conditions are fulfilled.
- Demand that the processing is restricted if the applicable conditions for such restriction are fulfilled.
- Object to the processing of personal data on the basis of your special situation, if the processing is based on our legitimate interest.
- Demand data portability, which means that your personal data is transferred to another data controller, if the applicable conditions for such transfer are fulfilled.
- Complain to the supervisory authority (Nw: “Datatilsynet”) if you are of the opinion that we are in breach of the personal data legislation. You may find information on how to reach the supervisory authority and more information regarding your rights on their website: www.datatilsynet.no.
A more detailed description of your rights is available her (currently only available in Norwegian): https://www.datatilsynet.no/rettigheter-og-plikter/den-registrertes-rettigheter/
We do not use automated decisions, including profiling.
In order to exercise your rights, you need to send an email to email@example.com. We will respond to your query as soon as possible, and within 30 days at the latest.
We will ask you to confirm your identity or to provide additional information before we let you exercise your rights with us. This is done in order to ensure that we only give access to your personal data to you – and not someone posing as you.
You can at any time withdraw your consent for the processing of personal data with us, see section 5.
Where we act as data processor you must contact the business in charge of processing if you wish to exercise your rights.