Mehiläinen recruitment privacy statement

Created: 17.4.2018
Updated: 14.4.2021

1 Controller

Mehiläinen Oy, Business ID 1927556-5, Pohjoinen Hesperiankatu 17 C, 00260 Helsinki, Finland.

2 Contact person in matters related to registers

Data Protection Officer Kim Klemetti, tietosuoja@mehilainen.fi

3 Register name

Mehiläinen recruitment register

4 Purpose and grounds for the processing of personal data

The purpose of using personal data is the recruitment of personnel for an employment relationship or as a self-employed private practitioner operating in the premises of Mehiläinen. Depending on the circumstances, the purpose of processing personal data may be related to a vacant position or the data subject’s consent to be offered a job or to be contacted by Mehiläinen about any potential jobs that fit the data subject’s profile and which might become vacant in the future.
Depending on the circumstances, the grounds for the processing of personal data are either

a.) the applicant’s (data subject) consent to processing or
b.) Mehiläinen’s legitimate interest to process the necessary data related to the applicant for the purposes of recruitment based on the relevant and appropriate relationship between the recruitment candidates (data subjects) and Mehiläinen.

5 Register data content

The register contains data on potential Mehiläinen employees and private practitioners (hereinafter referred to as “candidates”). Data necessary for the recruitment process is stored in the register on a position-specific basis. Such data may include, for example, the applicant’s contact details, professional licences, work history and education, wishes concerning the employment relationship and the process information generated during the recruitment process as well as other information necessary for the purpose of the register.

6 Personal data retention period

If the personal data have been collected in connection with a particular job position applied for by a candidate, the personal data will be deleted after the recruitment process has ended, unless the data subject has expressed their wish that the data be retained, for example in order to be offered future job positions. The data subject has the right to request the deletion of their personal data at any time.
Other personal data will be retained for as long as is necessary for the purposes of the data.

7 Regular data sources

The primary source of data is the person themselves or other sources of data provided by the person, such as references. Furthermore, during the recruitment process, public registers related to the sector such as JulkiTerhikki may be used whenever necessary for the fulfilment of the obligations concerning Mehiläinen.

8 Regular data transfers and transfers outside the European Union or the European Economic Area

The personal data will be primarily processed within the European Union or the European Economic Area. If necessary, data may also be transferred outside the European Union or the European Economic Area, including the United States, in accordance with and within the limits set by the data protection legislation.

9 Description of the principles of register protection

Any printed materials will be stored in a locked space accessible only by persons who have been granted individual access. Access to digital material will be granted only by means of the personal username and password of the authorised person. There are different levels of access rights and each user is granted access that is sufficient but as limited as possible to carry out the task.

The data on a filled recruitment application form will be transferred to the recruitment process register. Information related to the progress of the recruitment process will be sent by e-mail to the address provided by the applicant or by telephone.

10 Profiling

The data are not used for profiling purposes.

11 Right of the data subject to object to the processing of personal data and direct marketing (prohibition right)

The data subject has the right, in relation to their special personal situation, to object to the processing operations, which Mehiläinen targets at the data subject’s personal data. The data subject may present their request for the prohibition in accordance with section 13 of this privacy statement. In connection with the request, the data subject must identify the special situation on the basis of which they object to the processing of data. Mehiläinen may refuse to implement the request for prohibition on statutory grounds.

12 Other rights of the data subject regarding the processing of personal data

12.1 The data subject's right of access (inspection right)

The data subject has the right to have the data concerning them inspected. The inspection right can be exercised free of charge a maximum of one time per year (12 months). The inspection request must be made in writing and signed by the person making the request or made in person to the controller. The inspection request must be addressed to the person responsible for matters related to the register.

12.2 The data subject's right to demand rectification or erasure of data or restriction of the processing of data

The data subject has the right to request the correction of inaccurate data in the register. The correction request must be made in writing and with adequate specificity. The correction request must be presented to the person responsible for matters related to the register in accordance with section 13 of this privacy statement.

The controller must, without undue delay and on its own initiative or at the data subject’s request, rectify, erase or supplement any personal data in the personal register that is inaccurate, unnecessary, insufficient or obsolete for the purpose of the processing of personal data.

The data subject also has the right to demand that the controller restrict the processing of their personal data, such as when the data subject is waiting for Mehiläinen’s response to the request concerning the rectification or erasure of the data concerning them in the register.

12.3 Data subject’s right to lodge a complaint with a supervisory authority

The data subject has the right to lodge a complaint with the competent supervisory authority if the controller has not adhered to the applicable data protection regulation in its operations.

12.4 Other rights

If the personal data are being processed on the basis of the data subject’s consent, the data subject has the right to withdraw the consent by notifying Mehiläinen of this in accordance with section 13 of this privacy statement. If the processing of personal data is based on Mehiläinen’s legitimate interest, the data subject has the right to object to the processing based on legitimate interest in accordance with the General Data Protection Regulation.

13 Contacts

In all matters related to the processing of personal data and all situations regarding the exercise of the data subject’s own rights, the data subject should contact Mehiläinen by e-mail at tietosuoja@mehilainen.fi, in the OmaMehiläinen service, in person at a Mehiläinen clinic or by mail at the address: Mehiläinen Oy / Viestintä, Pohjoinen Hesperiankatu 17 C, 00260 Helsinki, Finland. Mehiläinen can request that the data subject further specifies their request in writing, and the identity of the data subject can be verified before taking any other measures, if necessary.