Sympa Job Applicant Privacy Notice

Sympa Job Applicant Privacy Notice

 

1. About this Notice

Sympa Oy (“Sympa”, “we”) is committed to protecting personal data and handling it securely and confidentially. This privacy notice explains how we process personal data relating to job applicants and other recruitment participants (e.g., interviewees).

If you have questions about our processing of personal data or want to exercise your rights, please contact our Data Protection Officer (DPO) at dpo@sympa.com.

2. Controller and Contact Information

Data Controller: Sympa Oy
Address: Puolikkotie 8, 02230 Espoo
Business ID: 1938597-5
Data Protection Officer: dpo@sympa.com

3. What Categories of Personal Data Do We Process?

We process only personal data that is necessary for recruitment and related purposes described in this notice. Depending on the role and the recruitment stage, we may process:

Identification and contact details

• Name, email address, phone number, address, nationality
• Where required and lawful: personal identity number or other official identifier

Application and career-related information

• CV/resumé, education, work history, skills, certificates, language skills
• Cover letter, motivation, salary expectations, availability, preferences

Recruitment process data

• Interview notes, assessments and evaluations made by Sympa’s recruitment participants
• Records of communications and scheduling information

Reference information

• Referee contact details (typically provided by you) and reference feedback

Technical data (when you use our recruitment channels)

• IP address and device/browser information as part of security logging and service operation (where applicable)

Special categories of data / sensitive data (only when necessary and permitted by law)

• Drug test results and related information (health data)
• Security clearance outcomes or other background checks (where legally allowed/required)
  We ask you not to include special categories of data in your application unless specifically requested for a lawful purpose.

Photo

• A photo only if you voluntarily include it in your application or we explicitly request it for a justified purpose (where applicable).

4. Which Sources Do We Use to Collect Personal Data?

We primarily collect personal data directly from you during the recruitment process. We may also collect personal data from:

• Referees you have provided (or otherwise instructed us to contact)
• Recruitment partners (e.g., recruitment agencies)
• Publicly available professional sources (e.g., publicly available profiles), where relevant and permitted
• Authorities or service providers conducting checks, only where lawful and necessary

5. Purposes and Legal Bases for Processing

We process personal data for the following purposes and based on the following legal bases under data protection law:

Recruitment management and candidate selection

• Managing applications, interviews, candidate evaluation, communications, and recruitment decisions
• Legal basis: Legitimate interests (recruitment and staffing needs)

Preparing and entering into an employment relationship

• Steps necessary before concluding an employment contract (e.g., offer preparation)
• Legal basis: Contract (pre-contractual steps)

Compliance with legal obligations

• Meeting obligations under employment, non-discrimination, accounting, and other applicable laws
• Legal basis: Legal obligation

Background checks, security clearances, and drug testing (when applicable)

• Conducting checks only where relevant to the role and permitted/required by law
• Legal basis: Legal obligation and/or legitimate interests (depending on the check), and for health data: an applicable condition under data protection law (and where required, explicit consent)

Establishing, exercising or defending legal claims

• Handling disputes, complaints, or claims related to recruitment decisions
• Legal basis: Legitimate interests and/or legal obligation (as applicable)

Talent pool / future recruitment (only if applicable)

• Storing your application for future openings
• Legal basis: Your consent (or another lawful basis where clearly applicable)
  You can withdraw your consent at any time.

If you have questions about the purposes or legal bases, contact dpo@sympa.com.

6. Recipients, Transfers and Disclosures

Access to applicant data within Sympa is limited to employees and representatives who need it for recruitment purposes (e.g., HR, hiring managers, relevant interviewers). Personnel are subject to confidentiality obligations.

We may share personal data with the following categories of recipients:

Service providers (processors)

We use service providers to support recruitment and HR operations (e.g., recruitment systems, communication tools, consultants, recruitment agencies). These service providers process personal data on our behalf under written agreements and only according to our instructions.

Sympa group companies

We may share personal data within the Sympa group where necessary for recruitment administration or where the role involves a group entity, and only on a need-to-know basis.

Authorities and other third parties

We may disclose personal data to authorities if we have a legal obligation to do so, or where otherwise permitted by law (e.g., legal claims).

You may request a current list of relevant service providers by contacting dpo@sympa.com.

7. Transfers Outside the EU/EEA

Personal data is primarily processed within the EU/EEA. If personal data is transferred outside the EU/EEA, we ensure a lawful transfer mechanism is in place, such as:

• An adequacy decision by the European Commission for the destination country; or
• Standard Contractual Clauses (SCCs) and, where necessary, supplementary safeguards.

8. Retention of Personal Data

We keep applicant personal data only for as long as necessary for the purposes described above:

• Applications to a specific open position: retained for six (6) months after the recruitment process ends, unless we are required to retain it longer by law or for handling potential claims.
• Open applications: retained for six (6) months from submission.
• Talent pool (future recruitment): retained for the period stated at the time consent is requested, or until you withdraw consent (whichever comes first).
  After the retention period, data is deleted or anonymised in a secure manner.

9. Is Providing Personal Data Mandatory?

Providing certain personal data (e.g., contact details, CV/resumé and relevant qualifications) is necessary to participate in recruitment. If you do not provide the data needed for evaluating your application, we may be unable to proceed with your candidacy.

Providing special categories of data (e.g., health data) is generally not required unless it is necessary and lawful for the role (e.g., specific checks), in which case we will inform you separately.

10. Automated Decision-Making

We do not make recruitment decisions based solely on automated processing that produces legal effects or similarly significant effects on you. If this changes, we will inform you and provide required information and safeguards.

11. Your Rights as a Data Subject

You have the right to:

• Receive information about processing
• Access your personal data
• Rectify inaccurate or incomplete data
• Request deletion of your data (when applicable)
• Restrict processing in certain situations
• Object to processing based on legitimate interests (we will assess your objection)
• Receive your data in a structured, commonly used format and request transfer, where applicable
• Withdraw consent at any time when processing is based on consent (withdrawal does not affect prior lawful processing)

You also have the right to lodge a complaint with the competent data protection supervisory authority if you believe your personal data has been processed unlawfully.

12. How to Contact / Exercise Your Rights

For questions or requests relating to your rights, contact our Data Protection Officer at dpo@sympa.com. We may need to verify your identity before fulfilling a request.

This privacy notice may be updated from time to time, for example due to changes in applicable legislation or our recruitment practices.

Last updated: 9.2.2026