Privacy Policy: Recruitment

Updated 23 May 2018

Controller Geological Survey of Finland
P.O. Box 96, FI-02151 Espoo, Finland
Tel. +358 29 503 0000, gtk@gtk.fi
Contact person for register matters Sirkka Almgrén
Contact details of the data protection officer tietosuojavastaava@gtk.fi
Register name Recruitment
Purpose of and legal grounds for processing personal data Personal data is processed for recruiting new employees. Processing is based on the consent of job-seekers (article 6.1a of the GDPR) when applying for a vacancy.
Data content of the register and groups of personal data Recruitment consists of many phases. Job seekers apply for a vacancy on the valtiolle.fi website, where they must provide their personal data (name, contact information, date of birth, gender), work and educational history, references and other CV-related data. Once the application period has ended, the aforementioned data is processed at GTK on paper, verbally during interviews and, for example, in Excel as summarised application data. Data can be distributed internally via email between employees taking part in the recruitment process. In some recruitment processes, GTK uses aptitude tests, in which case personal data obtained while conducting the tests is processed. Certain personal data may be obtained referees.
Storage period for personal data or, if this is not possible, criteria for defining the storage period Personal data is stored for two years after the recruitment process. Data about the selected person is stored until further notice.
Regular sources of data Data is obtained from job seekers. If job seekers have indicated any referees, they may also provide personal data.
Recipients of personal data or groups of recipients No personal data is regularly disclosed to parties outside GTK other than Palkeet (maintenance of the valtiolle.fi website) and any service provider conducting aptitude tests.
Information about the transfer of data to third countries and protection used (including information about the existence or nonexistence of the Commission’s decision on the sufficiency of data protection), and opportunities to obtain a copy or information about content. No data is transferred to third countries.
Principles of register protection (manual material and electronic processing) Paper material is located in a locked facility. Electronic processing is based on access control (username + password). General information security employees of Valtori have access to the data.
Rights of data subjects

  • Right to access personal data
  • Right to have data rectified
  • Right to have data erased
  • Right to restrict processing
  • Right to object
  • Right to transfer data from one system to another
 Every data subject has the right to access data and, if possible, have it rectified. Furthermore, every data subject has the right to request their data to be erased if they withdraw their consent to processing their data (i.e. withdraw their job application).
If processing is based on consent (article 6.1a) or explicit consent (article 9.2a), information about the right to withdraw consent at any time Data subjects can withdraw their consent (job application) at any time by sending a notification to GTK’s official email address (gtk@gtk.fi, registry office) or to the appointed recruiting supervisor, if the data subject knows the identity of that person.
Right to file a complaint with the supervisory authority Data subjects have the right to file a complaint with the supervisory authority of the member state in which their permanent place of residence or business is or in which the suspected breach of the GDPR has taken place.

If the data controller refuses the right of data subjects to access personal data or have the data rectified, data subjects have the right to file a complaint with the Finnish Data Protection Ombudsman.
Is the provision of personal data a statutory or contractual requirement or a requirement needed to enter into an agreement? Do data subjects need to provide personal data? What are the consequences of any nonprovision of personal data? The provision of personal data is based on voluntariness and the consent given by each data subject when applying for a
vacancy. The non-provision of data means that the specific person’s possibilities to succeed in the recruitment process are significantly lower.
Information about the existence of automated decision-making, including profiling, and significant information about the processing-related logic, at least in these cases, and the significance of specific processing and any consequences for data subjects No automated decision-making is used.