Modified
21.05.2026

Recruitment register

Privacy Policy

Data controller

SOLEMO Oy (0790905-7)
Vanha talvitie 19 A
00580 Helsinki

Contact person for matters concerning the register

SOL Tietosuoja

tietosuoja-asetus@sol.fi

Registry

Recruitment register

Preparation date

2025-05-06

Legal basis for processing

Legitimate Interest

Purpose of processing personal data

The purpose of the register is the recruitment of the company’s personnel. The recruitment register has been established for the recruitment of employees and trainees by the data controller.

The data controller has the right to use subcontractors in the recruitment process. In such cases, personal data may be transferred to subcontractors to the extent necessary for the provision of the services (e.g. for storing data on a server managed by a third party on behalf of the data controller).

In personnel assessments, psychological evaluations and similar activities, the legal basis for processing is the data subject’s consent.

Basis of legitimate interest

The job applicant (and employee) may reasonably expect that their personal data will be processed for the purposes described in this notice, and such processing is deemed justified on the basis of a balancing of interests between the data controller and the data subject, as the impact on the data subject is favourable (processing of personal data related to recruitment), and measures have been implemented to safeguard the data subject’s interests (balancing test).

The data controller has the right to process personal data based on legitimate interest, except where such interests are overridden by the data subject’s interests or fundamental rights and freedoms requiring the protection of personal data.

Personal data categories concerned

Name, contact details, visual information, and information on education and professional background

Recipients and recipient groups

The data controller’s personnel who require access to the personal data for the performance of their duties. In addition, data may be disclosed to service providers who process personal data on behalf of the data controller, in accordance with confidentiality obligations and data protection requirements set out in their agreements.

Personal data may also be disclosed within the limits permitted and required by applicable legislation, for example to authorities that are entitled to receive such data.

Consent

Right to withdraw consent, where the legal basis for processing is consent:

By contacting the data controller using the contact details provided at the contact point.

Data content of the register

Personal data filing system contains the following information:
- Basic personal details of the individual (including name, address, phone number, email address, nationality, and place of residence)
- Work experience information (including employer, job title, and job description)
- Information related to the position applied for (including why the applicant is applying for the position and the applicant’s availability/start date)
- Education information (including completed degrees and qualifications)
- Recruitment-related notes / assessments made by the person responsible for recruitment
- Skills and competencies information (including language skills, licenses and certificates, IT skills, and other special expertise)
- Cover letter / Application letter
- Curriculum Vitae (CV)
- Other attachments provided by the applicant
- Photograph or video
- References / Referees
- Possible employment or study certificates
- Other information voluntarily provided by the data subject
- Other information generated during the recruitment process (including email messages and text messages)

Regulatory data sources

The primary source of the data stored in the register is the data subject themselves, i.e. the job applicant. In addition, the data consist of information recorded during the recruitment process. Other possible data sources are used within the limits laid down by law.

Providing personal data is a statutory requirement for the job applicant for the conclusion of an employment contract.

Personal data retention period

Recruitment information is kept for 24 months, after which the information is destroyed in a secure manner.

Regulatory data transfers

Data in the filing system will not be disclosed to third parties unless it is necessary for recruitment or entry into employment.

Transfer of data outside the EU or EEA

Data in the filing system will not be transferred outside the EU or the EEA.

Principles of register protection A: Manual data

Recruitment informations are stored in a locked cabinet to which only the archivist has access.

All other data related to the filing system is only kept in electronic format, and data are only processed electronically. Access to the data stored in the filing system is given only to such persons and in such scope that is required for the purposes of recruitment and other tasks related to start employment relationship. The filing system is kept on a protected server which is located in the EU area.

The protection of all data in the filing system is carried out in accordance with the applicable data protection legislation, instructions issued by authorities, and good data processing practices.

Principles of register protection B: Electronic material

Access to the data stored in the filing system is given only to such persons and in such scope that is required for the purposes of recruitment and other tasks related to start employment relationship. The filing system is kept on a protected server which is located in the EU area.

The protection of all data in the filing system is carried out in accordance with the applicable data protection legislation, instructions issued by authorities, and good data processing practices.

Automatic processing and profiling

The processing of personal data in recruitment does not involve solely automated decision-making carried out without human involvement, where such decisions produce legal effects or similarly significantly affect the data subject

Right of inspection, i.e. the right to access personal data

The data subject has the right to check what data has been stored about him or her in the filing system. A request for data access must be given in writing by contacting the company’s customer service or the filing system’s contact person either in Finnish or English. The request for data access must be signed.
The data subject has the right to prohibit the processing of his or her data and its disclosure for the purposes of direct marketing, distance marketing or opinion polls by contacting the company’s customer service.

The right to transfer data from one system to another

The data subject has the right to transfer his or her own data from one system to another.

The transfer request can be addressed to the registry contact person.

The right to demand correction of information

Taking into account the purposes of processing, any data stored in the filing system that is inaccurate, unnecessary, incomplete, or outdated must be erased or rectified.

A written request for rectification, signed by hand, should be sent to the company’s customer service or the personal data filing system’s administrator.

The request should specify what information should be rectified and on what grounds. Rectification shall be carried out without delay.

Notification of rectification will be sent to the party who provided the inaccurate data or to whom the data were disclosed.

If a request for rectification is denied, the responsible person of the filing system will provide a written document stating the grounds for the denial of the request for rectification. The data subject concerned may then pass the matter along to the Data Protection Ombudsman.

Right to restriction

The data subject has the right to request that the processing of their personal data is restricted for example if data stored in the filing system is erroneous. Requests should be sent to the responsible person of the filing system.

Right to object

The data subject has the right to request for personal data pertaining to them, and the data subject has the right to request for the rectification or erasure of said data. Request can be sent to the contact person of the filing system.

The data subject has the right to prohibit the disclosure of processing of personal data for the purposes of direct marketing or other marketing, the right to demand the anonymization of data where applicable, as well as the right to be completely forgotten.

Right to lodge a complaint with a supervisory authority

If you consider that an infringement of the General Data Protection Regulation has occurred in the processing of your personal data, you have the right to lodge a complaint with a supervisory authority.

The complaint can also be lodged in a member state where you are a permanent resident or where you are employed.

Contact information for the Finnish national supervisory authority: Office of the Data Protection Ombudsman PL 800, Lintulahdenkuja 4, 00530 Helsinki tel. +358 29 566 6700 tietosuoja@om.fi www.tietosuoja.fi/en/

Other rights related to the processing of personal data

The data subject has the right to object to the disclosure and processing of their personal data and/or to request erasure (the right to be forgotten), where the legal basis for processing and other applicable requirements permit.