Borenius Recruitment Privacy Notice
1 Introduction
1. This Borenius Recruitment Privacy Notice (the “Privacy Notice”) describes how Borenius Attorneys Ltd (“Borenius”, “we”) processes the personal data of individuals involved in our recruitment process, including job applicants, individuals referred or sourced for a position and, where relevant, candidates selected for employment (together, “Applicants”). We also process personal data of individuals acting as referees in our recruitment process, whether our employees or others (“Referees”). The categories of personal data we process vary depending on your role in the recruitment process, as described in more detail below.
2 Data controller and contact details
2. Borenius is the data controller (“Controller”). We are responsible for ensuring that your personal data is processed in accordance with this Privacy Notice and applicable data protection laws.
3. Contact details of the Controller: Borenius Attorneys Ltd, Eteläesplanadi 2, 00130 Helsinki, Finland. Tel: +358 20 713 33, email: gdpr@borenius.com
4. Should you have any questions regarding the recruitment process itself, you may deliver your request to our human resources, email: hr@borenius.com
3 Applicable legislation and necessity requirement
5. The processing of Applicant’s personal data is governed mainly by the following: EU General Data Protection Regulation (“GDPR”, 2016/679), Data Protection Act (1050/2018), and Act on the Protection of Privacy in Working Life (759/2004). The provisions of the Act (759/2004) concerning employees also apply to, where applicable, to job applicants. Borenius also processes personal data to demonstrate compliance with, and to defend legal claims under, the Non-Discrimination Act (1325/2014), the Act on Equality between Women and Men (609/1986) and the Employment Contracts Act (55/2001).
6. We process only personal data that is directly necessary for the employment relationship applied for.
7. Providing personal data is not a statutory or contractual requirement for the Applicant. However, if the Applicant does not provide the information necessary to assess the application, we may be unable to consider the application. If the Applicant is selected, certain personal data must be provided in order to enter into an employment agreement and to comply with Borenius’ statutory obligations as an employer.
8. We don’t process special categories of personal data (Article 9 GDPR) concerning Applicants. Applicants are asked not to include such data in their applications. If an application nevertheless contains special categories of personal data, we will not use such data in the recruitment process.
4 Data subjects, categories of personal data, purpose of processing, legal bases and retention periods
| Data subject | Category and content of category | Purpose of processing | Legal basis for the processing | Retention |
| Applicant | Identification and contact data; application and professional data; communications; technical data. For example, name, email and other contact details, CV, photos and videos, answers to application and screening questions, messages with recruiters, other information provided by the Applicant, IP address | Receiving and assessing applications, arranging interviews and communicating with Applicant, making the selection decision and preparing the employment contract. | Taking steps at the request of the data subject prior to entering into a contract (Article 6(1)(b) GDPR). | 24 months from the date of the hiring decision. When Applicant’s personal data is deleted, it remains in the backups for ten days. |
| Application data | Retaining the application of an Applicant. | The Applicant’s consent (Article 6(1)(a) GDPR). | With Applicant’s written consent, we may retain your personal data for up to 24 months to consider Applicant’s future positions at Borenius. Applicant may withdraw consent at any time by contacting hr@borenius.com, after which we will delete personal data unless we are required to retain it for another reason described in this Privacy Notice. | |
| Assessment results | Aptitude and personality assessments. | The Applicant’s consent (Article 6(1)(a) GDPR) and Section 13 of the Act on the Protection of Privacy in Working Life. | 24 months from the date of the hiring decision. | |
| Referred Applicant | Identification and contact data; referral data. For example, name, contact details, information provided by the referrer (e.g. CV, LinkedIn profile, comments), identity of the referrer | Receiving the referral and contacting the referred person regarding a position. | Legitimate interest (Article 6(1)(f) GDPR) in contacting suitable Applicants referred to us If the Referred Applicant decides to participate in the recruitment process, Applicant’s consent (Article 6(1)(a) GDPR). | See paragraph number 9 below this table. See retention times for the Applicant. |
| Sourced Applicant | Identification and contact data; professional profile data; source of data. For example name, contact details, professional profile information (education, work history, skills), source of the data, messages with recruiters | Identifying and contacting potential Applicants regarding open positions. | Legitimate interest (Article 6(1)(f) GDPR) in identifying and contacting suitable Applicants. If the Sourced Applicant decides to participate in the recruitment process Applicant’s consent (Article 6(1)(a) GDPR). | See paragraph number 10 below this table. See retention times for the Applicant. |
| Referees | Identification and contact data; reference data. For example name, contact details, relationship to the Applicant, messages with references, reference statements | Contacting referees with the Applicant’s consent. | Legitimate interest (Article 6(1)(f) GDPR) in verifying the applicant’s suitability. Under Section 4 of the Act on the Protection of Privacy in Working Life, referees may only be contacted with the Applicant’s consent. | 12 months from the recruitment decision. When Referrer’s personal data is deleted, it remains in the backups for ten days. |
| Selected Applicant | Identification and contact data; employment and onboarding data. For example applicant name, role, and starting date, job title and other information needed for the onboarding | Concluding the employment contract and onboarding, including entering the Applicant’s personal data into an electronic signature platform and Borenius’ HR system. | Taking steps at the request of the data subject prior to entering into a contract and performance of the employment contract. (Article 6(1)(b) GDPR). Borenius also processes personal data where necessary to comply with its legal obligations as an employer, such as verifying the right to work in Finland and fulfilling tax, pension and insurance obligations (Article 6(1)(c) GDPR). | Described in Privacy Notice for Borenius' Employees. (Not shared externally). |
| All Applicant types | Data relevant to the legal claim or compliance matter. Personal data depending on the role of the Applicant (Data Subject) | Establishing, exercising or defending legal claims and demonstrating compliance with non-discrimination legislation. | Borenius’ legitimate interest (Article 6(1)(f) GDPR). | See paragraph number 11 below this table. |
9. We retain the personal data of a Referred Applicant only for as long as necessary to contact them regarding the position in question. If we decide not to contact the Referred Applicant, we delete the personal data, including the information received from the referring person, without undue delay and in any event within one month of receiving the referral. If the Referred Applicant does not respond to our contact, we delete the personal data 4 weeks after our first contact. If the Referred Applicant informs us that they did not agree to be referred, that they do not wish to participate in the recruitment process or that they object to the processing, we delete the personal data without undue delay, except for their name, contact details and the date of the request, which we retain for 24 months to ensure that they are not contacted again. If the Referred Applicant decides to participate in the recruitment process, the retention times applicable to Applicants apply from that point onwards. When personal data is deleted, it remains in the backups for ten days.
10. We retain the personal data of a Sourced Applicant only for as long as necessary to contact them regarding the position in question. If we decide not to contact the Sourced Applicant, we delete the personal data without undue delay and in any event within one month of obtaining it. If the Sourced Applicant does not respond to our contact, we delete the personal data 4 weeks after our first contact. If the Sourced Applicant informs us that they do not wish to participate in the recruitment process or objects to the processing, we delete the personal data without undue delay, except for their name, contact details and the date of the request, which we retain for 24 months to ensure that they are not contacted again. If the Sourced Applicant decides to participate in the recruitment process, the retention times applicable to Applicants apply from that point onwards. When personal data is deleted, it remains in the backups for ten days.
11. Notwithstanding the above in terms of retention times, we may retain personal data for longer where this is necessary for the establishment, exercise or defence of legal claims, for example where a claim or complaint concerning the recruitment process, including under non-discrimination or equality legislation, is pending before a court or authority. In such cases, we retain the data until the matter has been finally resolved.
12. Additionally, limited amount of personal data is also stored in logs: (i) Technical logs; Our recruitment system provider Teamtailor AB keeps technical logs that may include IP addresses and system identifiers. Note that Teamtailor processes these as an independent data controller and retains them for up to 365 days. (ii) Application event logs; Teamtailor keeps logs of application-related events on our behalf as our data processor and retains them for 28 days. [(iii) Audit logs; We keep logs of our users’ actions in the system for 12 months.
5 Personal data we process and its sources
13. We only collect personal data that is necessary for the position in question. We obtain personal data directly from the Applicant through the job application and any attachments, personal and aptitude assessments, and interviews. If you provide us with a link to your professional profile, such as your LinkedIn profile, we may review the information in that profile to the extent it is relevant to the position. During the recruitment process, we do not otherwise collect information about Applicants from other sources, such as search engines or social media, without the Applicant’s consent.
14. We may receive personal data about potential Applicants from sources other than the individuals themselves. If an Applicant is referred to us by a Borenius employee or another person (“Referred Applicant”), we receive the Applicant’s name, contact details and other information relevant to the position from the referring person, and we may ask the referring person to confirm that the Applicant has agreed to be referred. We may also identify potential Applicants through publicly accessible sources, such as professional networking services, or through recruitment partners (“Sourced Applicant”). We will inform Referred and Sourced Applicants of the processing in accordance with Article 14 GDPR, including the categories of personal data concerned and the source of the data, and whether it came from publicly accessible sources. We will do so at the latest at the time of our first communication with them and in any event within one month of obtaining the data. If a Referred or Sourced Applicant decides to participate in the recruitment process, we thereafter collect personal data primarily from the Applicant directly, as described in this Privacy Notice.
15. With the Applicant’s consent, we may collect information about the Applicant from Referees, such as their assessment of the Applicant’s skills, experience and suitability for the position. We only contact Referees named by the Applicant, and their personal data, such as name, contact details and position, is generally obtained from the Applicant.
16. If you visit our premises, for example for an interview, your personal data may also be collected through our camera surveillance and access control systems. More information on this processing is available in our separate Privacy Notice for Visitors at Borenius’ Offices. To protect your privacy, we do not use Applicants’ full names in meeting room bookings in our calendar system.
6 Processors and transfers of personal data
17. Borenius uses the Teamtailor recruitment system, provided by Teamtailor AB (Sweden), to manage the recruitment process. Teamtailor acts as a processor on behalf of Borenius, and its processing of personal data is governed by a data processing agreement in accordance with Article 28 GDPR.
18. Borenius’ assessment partner processes the personal data on behalf of Borenius as its processor solely for the purpose of conducting the assessment.
19. Applicants’ and Referrer’s personal data is stored and processed in data centres located within the EU/EEA. Personal data may be transferred outside the EU/EEA only in limited situations, for example where a sub-processor engaged by Teamtailor to provide a specific feature of the service is located outside the EU/EEA. In such cases, the transfer is based on an adequacy decision of the European Commission (Article 45 GDPR) or on the European Commission’s Standard Contractual Clauses (Article 46 GDPR), supplemented by additional safeguards where necessary.
7 Disclosure of your personal data
20. Within Borenius, access to Applicants’ personal data is restricted to employees who need it to carry out the recruitment process, such as Human Resources personnel, the relevant hiring manager and persons participating in interviews
21. As a main rule, we do not disclose Applicants’ personal data to external parties, except as described below:
- Assessment partner: With the Applicant’s consent, we may disclose the Applicant’s personal data to an external partner engaged to carry out personal and aptitude assessments. The partner is bound by a confidentiality agreement and may only use the data for the purpose of conducting the assessment.
- Authorities and legal proceedings: We may disclose Applicants’ personal data to competent authorities, such as the Non-Discrimination Ombudsman or the Ombudsman for Equality, where we are required to do so by law or the authority has a statutory right to obtain the data (Article 6(1)(c) GDPR), or where necessary for the establishment, exercise or defence of legal claims (Article 6(1)(f) GDPR). Only the personal data necessary for the purpose in question will be disclosed.
22. If the Applicant is selected for the position, their personal data will be transferred to our HR system and processed as described in our privacy notice for employees.
8 Security of the processing
23. In accordance with Article 32 GDPR, we have implemented appropriate technical and organisational measures to ensure a level of security appropriate to the risk. Borenius is certified under ISO/IEC 27001:2022, which means that we systematically identify, assess and manage information security risks, including those related to our service providers. All Borenius employees are required to complete regular information security training.
24. We require our service providers to maintain an appropriate level of information security. Our recruitment system provider Teamtailor AB holds ISO/IEC 27001 and ISO/IEC 27701 certifications and undergoes an annual SOC 2 Type 2 audit. More information is available in Teamtailor’s trust center at https://trust.teamtailor.com/.
9 Automated decision-making, profiling and use of AI
25. We do not make decisions based solely on automated processing or decision-making, including profiling, that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR).
26. We may use AI-based tools to assist with tasks such as reviewing and summarising applications, scheduling interviews and organising Applicant information. Any output of such tools is reviewed by our personnel, and all decisions concerning your application are made by our personnel.
10 Rights of the data subject
27. Under the GDPR, you have the following rights in relation to the processing of your personal data:
| Right | Description |
| Right of access | You have the right to obtain confirmation of whether we process personal data concerning you and, if so, to receive a copy of that data and information on, for example, the purposes of the processing. If you make your request electronically, the data will be provided in a commonly used electronic format unless you request otherwise. |
| Right to rectification | You have the right to have inaccurate personal data concerning you rectified without undue delay, and to have incomplete personal data completed. |
| Right to erasure | You have the right to request the erasure of your personal data, and we are obliged to comply with your request where, for example, the personal data is no longer necessary for the purposes for which it was collected. |
| Right to restrict processing | You have the right to request that we restrict the processing of your personal data in certain situations, for example while we verify the accuracy of data you have contested or assess your objection. |
| Right to object | Where we process your personal data on the basis of our legitimate interest (Article 6(1)(f) GDPR), you have the right to object to the processing at any time on grounds relating to your particular situation (Article 21 GDPR). We will then no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims. |
| Right to data portability | Where the processing is based on your consent or on a contract and is carried out by automated means, you have the right to receive the personal data you have provided to Borenius in a structured, commonly used and machine-readable format, and to have it transmitted to another controller where technically feasible |
| Right to withdraw consent | Where the processing is based on your consent, you have the right to withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal. Please note that withdrawing your consent may result in the discontinuation of the recruitment process. |
| Right to lodge a complaint | You have the right to lodge a complaint with the supervisory authority, Data Protection Ombudsman, if you consider that data protection legislation has not been respected. For more information see chapter 12. |
28. You can exercise your rights by contacting us at gdpr@borenius.com. Requests can be made in free form and are free of charge. We will respond without undue delay and in any event within one month of receiving the request. This period may be extended by two further months where necessary, taking into account the complexity and number of requests, in which case we will inform you of the extension.
29. Where we have reasonable doubts concerning the identity of the person making a request, we may request additional information necessary to confirm your identity.
30. Please note that these rights are not absolute. Their extent depends on the legal basis for the processing, and they may be restricted under the GDPR, the Finnish Data Protection Act or other applicable legislation, for example where we must retain data to comply with a legal obligation or to defend legal claims, or where fulfilling the request would jeopardise the statutory confidentiality of our clients’ matters. If we cannot fulfil your request, we will inform you of the reasons, unless restricted by law.
11 The data protection ombudsman
31. If you consider that the processing of your personal data infringes applicable data protection legislation, you have the right to lodge a complaint with a supervisory authority. In Finland, the competent supervisory authority is the Office of the Data Protection Ombudsman: visiting address Lintulahdenkuja 4, 00530 Helsinki; postal address P.O. Box 800, 00531 Helsinki; email tietosuoja@om.fi; tel. +358 29 566 6700; www.tietosuoja.fi.
32. You may also lodge a complaint with the supervisory authority of the EU Member State of your habitual residence or place of work.
12. Changes to this privacy notice
33. Borenius may update this Privacy Notice from time to time, for example to reflect changes in applicable legislation or in its processing activities. The current version of this Privacy Notice is always available on Borenius’ website https://www.borenius.com/privacy-notice-for-job-applicants/