This Everon Group Recruitment Privacy Notice (“Notice”) explains how Oy Everon Ab and its affiliates (together “Everon Group” or “we”) use your data in connection with recruitment process and what rights you have as a candidate in respect to the personal data we process.
For the purposes of this notice, the controller of your personal data is the Everon Group company conducting recruitment. Due to our integrated operations and shared systems, if you choose to allow your application to be considered for other vacancies within the Everon Group, each recruiting Everon Group company processing your personal data acts as controller jointly with the primary recruiting company. If you have any questions relating to the recruitment process, please contact the recruiting manager stated in the job posting.
We are committed to compliance with the EU General Data Protection Regulation ("GDPR") and other applicable legislation concerning the processing of personal data. We ensure that all personal data is used for only such purposes which are clearly communicated to the individuals and on an appropriate legal basis.
Updated: 09.12.25
| Personal data | Purpose of processing | Legal basis |
|---|---|---|
Basic information such as name, date of birth, language, title or degree, photograph, ID Contact details such as email address, telephone number, home address | Processing of job applications and communication related to the recruitment process | Our legitimate interest in processing personal data for the purpose of implementing the recruitment process and selecting a suitable employee, as well as responding to enquiries and requests related to the recruitment process |
| Information related to the position applied for, such as information on the nature of the employment relationship, salary range and your salary expectations, start date | Processing of job applications | Our legitimate interest in processing personal data for the purpose of carrying out the recruitment process and selecting a suitable employee, as well as responding to enquiries and requests related to the recruitment process |
Information important for suitability and other information provided by the person about themselves and their background, such as information related to studies and education, profession, work history, IT and language skills, other work skills and interests, readiness to work abroad, description of personal characteristics, driver’s lisence, certificates and assessments, references
Criminal record checks
Sweden Prior to hiring a candidate, we may request to review a criminal record extract. In such cases, the extract is requested for review only and is not stored in any of our systems.
UK Your employment is conditional upon receipt of a satisfactory enhanced DBS certificate. | Processing job applications and assessing the suitability of job applicants and making hiring decisions Making hiring decisions | Our legitimate interest in processing personal data for the purpose of conducting the recruitment process and selecting a suitable employee Consent Consent Legal obligation |
| Information concerning the progress of the recruitment process, such as information about follow-up interviews or the discontinuation of the recruitment process | Management of the recruitment process and communicating with you in relation to the recruitment | Our legitimate interest in processing personal data for the purpose of implementing the recruitment process |
| Any other information provided voluntarily or otherwise published for professional purposes such as profiles or other sources found on the Internet, (such as LinkedIn) and any other information that you may choose to include in your CV, cover letter or other application documents as well as any information that you provide during the interview processs or information we collect with your separate consent | Assessment of job applicants' suitability Seeking out potential candidates and contacting them for recruitment purposes (i.e., headhunting); | Our legitimate interest in processing personal data for the purpose of conducting the recruitment process and selecting a suitable employee Consent |
The information is primarily provided by you in connection with the job application process. However, we may also collect and receive your data from following third-party sources:
Your personal data is processed by Everon Group employees involved in recruitment and HR, as well as hiring managers and other relevant team members participating in the recruitment process. Authorised users of our recruitment systems may also process your data.
We may disclose your personal data to the following third parties and in the following situations:
Affiliates and service providers: We may disclose your personal data to Everon Group companies and authorized service providers that typically process the data on our behalf (such as our IT vendors and HR system service providers). However, in certain situations, some of our service providers (such as headhunters or aptitude assessment providers) may act as independent data controllers – these service providers will inform you about their processing activities separately.
Lawful requests: We may be required by the mandatory requirements of applicable law, or for the purposes of responding to legal proceedings or other lawful requests, to disclose your personal data to authorities or third parties.
Protection of our interests and combating fraud: We may also disclose or otherwise process your personal data, in accordance with applicable law, to defend our legitimate interests (for example, in civil or criminal legal proceedings) and when combating fraud.
Mergers and acquisitions: In the event of any sale, consolidation or reorganization of our businesses (for example mergers and acquisitions), we may disclose your personal data to prospective or actual purchasers or their advisers, where appropriate.
Your personal data may be transferred between Everon Group companies in Finland, Sweden and UK. The European Commission has adopted an adequacy decision for the UK, meaning that transfers from the EU /EEA to the UK benefit from an adequate level of protection. Transfers from Everon UK to EU/EEA are governed by UK GDPR and benefit from the UK's recognition of the EU/EEA as providing adequate data protection.
Where IT systems or other service providers enable access to employee data from outside the EU/EEA, appropriate safeguards are in place, such as EU Commission standard contractual clauses and necessary additional safeguards in accordance with GDPR.
Information security and ensuring appropriate protection of personal data of candidates is vital for us. We and our service providers strive to implement organizational and technical security measures to set appropriate level of protection of information and to prevent and detect disclosure of personal data to unauthorized parties.
Access controls and authorization: Only our employees who are authorized to process personal data as part of their job responsibilities are entitled to access systems containing personal data. All persons processing such data must receive individual accreditation. Different levels of access have been created based on the types of data a person needs to access or process according to their job description.
Technical security measures: We maintain a variety of physical, electronic, and procedural safeguards to guard your personal data. The data is located in an environment protected by appropriate security software and technical arrangements. Each user has their own user name and password for the system. The data are collected in databases protected by firewalls, passwords and other technical means. Our systems are firewall protected.
Physical security measures: The system and its backups are located in locked premises and only certain pre-designated persons have access to the data. We strive to store all recruitment data in electronic format only. Any temporary physical copies of your personal data are stored in restricted files of the involved personnel and in secure premises, accessible only to persons whose job entitles them to access the data.
Third-party agreements: We have entered into agreements with system vendors and other service providers who process personal data, whereby our partners are committed to complying with the data protection and security requirements of the GDPR. All personnel from our service providers who are granted access to your personal data are required to keep such data confidential.
We will only keep your personal data for as long as necessary for the purpose for which the personal data is processed, taking into account the retention periods required by law.
Generally, we will store and process your personal data for recruitment purposes during the duration of the recruitment process and for 24 months after the process has ended. We may need to store and process your personal data for a longer period in case it is necessary to establish, exercise or defend any legal rights or related administrative investigation.
If you would like us to store your information in order to be able to consider your application for any other vacancies, you can separately consent to such processing of your personal data. You may at any time withdraw your consent by contacting us at the contact details given below. In case you withdraw your consent concerning the processing of your personal data for other vacancies, we will no longer store or process your personal data for such purposes. However, we may still store and process your personal data for the duration of any period necessary to establish, exercise or defend any legal rights.
If the candidate becomes our employee, we will store the information provided as a candidate and related to the job application as part of the personnel profile in accordance with our privacy policy concerning employee data.
| Right | In what circumstances |
|---|---|
| To inspect the data stored about you | Always |
| Request the correction of inaccurate or outdated information | Always |
| Request the deletion of data | Where you have withdrawn your consent or one of the other conditions of Article 17 of the GDPR is met |
| Withdraw consent | Where processing is based on consent |
| Object to processing | Where the processing is based on legitimate interests and involves a particular personal situation or where the data are processed for direct marketing purposes |
| Request the restriction of processing (e.g. until the requests for the data are clarified and resolved) | Where the accuracy of the data is contested or one of the other conditions of Article 18 of the GDPR is met |
| Lodge a complaint about personal data processing with the relevant supervisory authority. Please do see a list for European supervisory authorities’ websites here. | Always |
To exercise your rights, please send a written request to gdpr@everon.fi. Please note that in order to exercise your rights, you may be requested to provide additional information for identification purposes. Such additional information shall not be used for any other purpose.
If you are dissatisfied with our response or believe your data is not being processed lawfully, you have the right to lodge a complaint with the national data protection authority.
We may update this Recruitment Privacy Notice from time to time and communicate the changes on this site. When we post changes to this Recruitment Privacy Notice we will modify the “Effective Date” at the top of this document to indicate when such changes have come into effect.
