Mehiläinen Recruitment Privacy Statement

Mehiläinen Oy
Business ID 1927556-5
Arkadiankatu 6
00100 Helsinki, Finland

Mehiläinen Recruitment Register

The purpose of using personal data is the recruitment of staff for employment or as private practitioners operating within Mehiläinen's facilities. Depending on the situation, the use of personal data may relate to a specific open position or the data subject's expressed desire to be contacted by Mehiläinen or to receive job offers for positions that may later become available and are suitable for the data subject.

The basis for processing personal data depends on the situation and may be either:

a.) the consent given by the job applicant (the data subject) for the processing, or

b.) Mehiläinen's legitimate interest in processing the necessary information of job applicants for recruitment purposes, which arises from the relevant and appropriate relationship between the recruitment candidates (the data subjects) and Mehiläinen.

The register covers data about potential Mehiläinen employees and practitioners (hereinafter referred to as candidates). Information necessary for the recruitment process is stored in the register as deemed appropriate for each position. Such information may include the applicant's contact details, professional rights, work history and educational background, preferences regarding employment, information generated during the recruitment process, and other information necessary for the purpose of the register.

If personal data has been collected in relation to a specific position the candidate has applied for, the personal data will be deleted after the recruitment process has ended, unless the data subject has expressed a desire to retain the information for potential future job offers. However, personal data may be retained for a longer period if there is a specific reason, such as for the preparation, presentation, or defense of legal claims. In such cases, the retention period is influenced by the general statutes of limitations based on legislation. The data subject has the right to request the deletion of their personal data at any time. Otherwise, personal data will be stored for as long as is necessary for the purposes of the data. For this register, the data will be stored for 10 years after the last active contact.

The primary source of information is the individual themselves or other sources of information indicated by the individual, such as references. Additionally, public registers related to the industry, such as JulkiTerhikki, may be used during the recruitment process as necessary to fulfill Mehiläinen's obligations.

Personal data is primarily processed within the EU or the European Economic Area. If necessary, data may also be transferred outside the European Union or the European Economic Area, including to the United States, in accordance with data protection legislation and within its limits. In such cases, the primary basis for transfer is the European Commission's decision on the adequacy of data protection in the United States. If personal data is transferred to a country for which the Commission has issued an adequacy decision on adequate level of data protection (Article 45 of the EU General Data Protection Regulation), the primary basis for transfer is the adequacy decision.

Personal data is not routinely disclosed to third parties.

Mehiläinen has appropriate technical and organizational security measures in place to protect personal data. Any paper material is stored in a locked space accessible only to individuals with specific authorization. Access to digital material is restricted to authorized individuals with personal usernames and passwords. Access rights are tiered, and each user is granted a level of access that is sufficient for their tasks but as limited as possible.

Information from completed recruitment applications is transferred to the recruitment process register. Communication related to the progress of the recruitment process is conducted via email to the applicant's provided email address or by telephone.

Personal data is not used for profiling purposes or automated decision-making.

The data subject has the right, on grounds relating to their particular situation, to object at any time to the processing of personal data concerning them, which is based on Mehiläinen's legitimate interests. The data subject can submit their objection in accordance with section 12 of this privacy statement. In their request, the data subject must specify the particular situation on which they base their objection. Mehiläinen may refuse to comply with the request for objection on grounds provided by law.

11.1 Right of Access by the Data Subject (Right to Inspect)

The data subject has the right to obtain confirmation from Mehiläinen as to whether or not personal data concerning them are being processed. If their personal data is being processed, the data subject has the right to receive information about the processing of their personal data, such as the purposes of the processing and the categories of personal data concerned. Mehiläinen provides information about the processing of personal data in its privacy statements. The data subject can also contact Mehiläinen regarding the processing of personal data in the manner specified in section 12 of this privacy statement.

The data subject has the right to inspect the personal data concerning them. An inspection request can be made in accordance with section 12 of this privacy statement. The right to inspect can be denied on grounds provided by law. The exercise of the right to inspect is generally free of charge. However, Mehiläinen may charge a reasonable fee based on administrative costs under certain conditions.

11.2 Right of the Data Subject to Request Rectification, Erasure, or Restriction of the Processing

The data subject has the right to request the rectification of inaccurate data concerning them. The data subject can make a rectification request to Mehiläinen in accordance with section 12 of this privacy statement.

The data subject has the right, under certain conditions, to request the erasure of their personal data, for example, if the processing is based on the data subject's consent and the data subject withdraws their consent, and there is no other legal ground for the processing, or if the data subject objects to the processing and there is no justified reason for the processing. An erasure request can be made in accordance with section 12 of this privacy statement.

The data subject also has the right to request the data controller to restrict the processing of their personal data, for example, when the data subject is awaiting a response from Mehiläinen to a request for rectification or erasure of their data.

11.3 Right of the Data Subject to Data Portability

To the extent that the data subject has provided data to Mehiläinen which is processed based on the data subject's consent and the processing is carried out by automated means, the data subject has the right to receive such data in a structured, commonly used, and machine-readable format and has the right to transmit those data to another data controller.

11.4 Right of the Data Subject to Lodge a Complaint with a Supervisory Authority

The data subject has the right to lodge a complaint with the competent supervisory authority (in Finland, the Office of the Data Protection Ombudsman) if the controller has not complied with the applicable data protection legislation in its operations.

11.5 Other Rights

If personal data is processed based on the data subject's consent, the data subject has the right to withdraw their consent at any time by notifying Mehiläinen in accordance with section 12 of this privacy statement. However, the withdrawal of consent does not affect the lawfulness of consent-based processing carried out before its withdrawal.

For issues related to registered patient and personal data, one can turn to Mehiläinen's Health Information Management team.

Health Information Management
info.terveystiedot@mehilainen.fi

Please note that we can only accept requests from data subjects in writing. Your identity will be verified at a Mehiläinen service point with a photo ID or alternatively through the OmaMehiläinen online service. This ensures that information is only released to individuals who have the right to it.

You can also submit a data request through the nearest Mehiläinen service points, where your identity will be verified with a photo ID. You can find the nearest Mehiläinen service point on our website at https://www.mehilainen.fi/en/locations.

If you are sending sensitive information by email, you can use Mehiläinen's secure mail if necessary.

Data Protection Officer

The Data Protection Officer at Mehiläinen is Kim Klemetti (tietosuoja@mehilainen.fi).