Privacy notice for recruitment applicants

Aalto University collects from the applicant the information necessary for the given recruitment, such as:

• Personal details (name, gender, date of birth, nationality)
• Address and contact information (street address, locality, postcode, country, email address and telephone number)
• Education
• Prior work experience
• Language proficiency, IT skills and other competencies important for the open position
• Application appendices (CV, motivation letter, recommendations and references)
• Social media profiles, if any (LinkedIn or similar)
• Information given in an interview (including in video-recorded interviews)

Special categories of personal data

Aalto University does not collect or ask for special categories of personal data (also referred to as ‘sensitive personal data’) in recruitment. If an applicant does provide this kind of information, the university will not utilize it in recruitment decisions. Special categories of personal data may include information relating to racial or ethnic origin, physical or mental health, political opinions or religious beliefs, sexual orientation or trade union membership.

Aalto University collects personal data mainly by obtaining it directly from the applicants themselves. 

Aalto University may also collect applicants' personal data from the sources listed below. The purpose is to contact potential applicants about job opportunities, carrying out publication analysis, and verify the accuracy of the information provided in an application (publicly available professional information). When necessary, Aalto University will ask for the applicant's consent before processing personal data.

• Profiles or sources in the public domain 
• The university’s contacts, collaborative partners or external recruitment agencies 
• Professional social networks (e.g. LinkedIn) and public databases and sources (e.g. Google Scholar, Web of Science, Scopus, ResearchGate).
• Websites of organisations
• Other public registers, such as Finder (work-related information only).

• Contract (GDPR Article 6(1)(b)): Processing is necessary for the performance of a contract or to take steps at the request of the data subject prior to entering into a contract.
• Legal obligation (GDPR Article 6(1)(c)): Processing is necessary to comply with the controller's legal obligations or to exercise its rights, including, without limitation, under labour, data protection, equality, non-discrimination and criminal law.
• Consent (GDPR Article 6(1)(a)): The job applicant and/or a third party has consented to the processing.
• Legitimate interests (GDPR Article 6(1)(f)): Processing is necessary for the controller's legitimate interests, namely filling vacant positions.

Aptitude assessment: This assessment is performed by an Aalto University contract partner using reliable testing methods. The partner is also responsible for the retention and deletion of the data. Aalto University receives a report from the partner regarding the applicant’s suitability.

Credit check: If a position requires a credit check of the selected candidate, Aalto University will state this in the job advertisement. With the candidate’s consent, their credit history is checked against a credit data register.  

Security clearance: If the position requires the selected candidate to have a security clearance, Aalto University will state this in the job advertisement. The security checks are performed by the Finnish Security and Intelligence Service (Supo). More about security clearances:  Security clearances | Finnish Security and Intelligence Service (Supo)

Aalto University processes job applicants’ data primarily during the recruitment process, i.e. when receiving applications and performing interviews or individual assessments as well as any background checks and other measures necessary for recruitment.

The main purposes of processing job applicant data:

• To fill vacant positions
• To source potential candidates 

Applicant data is also processed for the following purposes:

• Reporting and statistics
• Development of IT systems and processes
• Protection of the rights of applicants and of the university, ensuring compliance with the regulations and legal obligations applicable to the recruitment

The personal data of job applicants is not used for direct marketing or any other purposes than those stated in this privacy notice.

Applicants' data is processed only by those employees of Aalto University, and those persons acting on the University's behalf and on its instructions, who are authorised to process personal data. The rights to access and view data in the digital recruitment systems are defined and provided only to those individuals who need the personal-data-filing-system information contained in the data system in order to perform their assigned work tasks. Subcontractors may also be used in the recruitment process, such as a company that offers candidate sourcing services.

In certain academic recruitments, personal data is processed on behalf of Aalto University by external experts who may operate outside the EU/EEA. 

Aalto University may use subcontractors to carry out its recruitment activities, such as companies that offer candidate sourcing services. During a recruitment process, personal data may be disclosed to recruitment consultants, aptitude assessment service providers, or the Finnish Security and Intelligence Service (Supo). 

Aalto University may also disclose an applicant’s data to third parties for the following purposes:

• Statistical compilation and reporting, as required by law, to Statistics Finland and the Ministry of Education and Culture.
• Compliance with legal requirements or those of a competent law-enforcement authority, government agency, court or third party, in order that Aalto University may satisfy the requirements of judicial proceedings or law enforcement, or to exercise or defend its own legal rights.
• Responding to requests for information regarding recruitment

As general rule, Aalto University processes the personal data of applicants only within the EU or EEA. In certain academic recruitments, personal data is processed on behalf of Aalto University by external experts who may operate outside the EU/EEA. Aalto University ensures that the external experts acting as processors undertake to comply with the university’s data protection and information security guidelines. Transfers of personal data outside the EU and EEA are done in accordance with the requirements of the GDPR.

The retention times for personal data and recruitment-related documentation are based on law and the Aalto University Records Management Plan. In accordance with its data protection policy, Aalto University does not retain data that has become outdated or is no longer needed.

Aalto University retains data on work applications for three years after the date of a recruitment decision. This data is specific to the work duties concerned. After the three period, Aalto University deletes direct identifiers from the data as well as any appendices to the application. 

Exceptional retention times

• The account on an applicant will be deleted after 12 months if there has been no activity on it (Note: job alerts do not count as activities) or if the person has not applied for the job.
• Contact details from direct recruitment are retained for 12 months after the end of the recruitment process.
• Open (unsolicited) applications are retained for 12 months from the date of submission. 
• ‘Business developer’ applications are retained for 12 months from the date of submission.
• Personal data from direct recruitment is retained for 6 months following the conclusion of the recruitment processes.

Indefinite retention times

• The application data of applicants shortlisted for professorial positions 
• The application data of applicants shortlisted for academic leadership positions
• The application data of applicants shortlisted for service management positions
• The application data of applicants chosen for Staff / Senior Scientist, Professor of practice, Adjunct professor and lecturer positions
   

Statistics collected on applicants in the recruitment of professors (year of birth, gender, nationality, date of graduation, degree details, etc.) are retained permanently. Personal data contained in the statistics is retained in pseudonymised form.

Aalto University collects personal data both from the data subject directly and from sources other than the data subject. Data is collected in two ways:

1. From public databases and sources (e.g. Google Scholar, Web of Science, Scopus, ResearchGate, LinkedIn, company websites and public registers such as Finder).

2. From University contacts, i.e. asking individuals knowledgeable in the given field. These may be Aalto University employees or collaborative partners in outside organisations.

The purpose of collecting personal data is to find potentially suitable persons for the position, contact them and enquire their possible interest in the position. In addition, the purpose is to enhance the visibility and appeal of Aalto University and thereby support the university’s recruitment efforts. At the same time, Aalto University sources individuals who may be interested in collaborative work with or in later open positions at Aalto University.

The processing of the information generates anonymous statistical data for the university’s internal use. 

Legal basis for the processing of personal data

The legal basis for the processing of personal data (identifying and contacting potential candidates) is the university’s legitimate interest in ensuring the recruitment of competent staff and in increasing the university’s societal engagement and visibility.

Further processing of the personal data of potential candidates is based on consent in cases where data subjects have themselves offered extra information, applied for a position or expressed an interest in future open positions.

Data collected from potential applicants

• The person’s given name and family name 
• The person’s contact details (email, link to their website, if applicable)
• Current employment, employment history, education
• Information from public sources (Google Scholar, Web of Science, Scopus, LinkedIn, etc.) on the potential applicant’s publications
• Information on the contacts made with the potential applicant and the discussions had.

Information on specialists with expertise in the field

• Name and contact details, affiliations

According to the GDPR, applicants have the right to know what information on themselves is stored in the personal data filing system. Applicants have the right to request that any inaccurate or erroneous data on themselves be rectified without undue delay. If an applicant wishes to have data maintained by an Aalto University partner rectified or erased, Aalto University will require the partner to take appropriate measures.

With certain exceptions, the GDPR guarantees that data subjects shall have the right to have data concerning themselves erased; this is also known as the ‘right to be forgotten’. This right does not obtain in cases where the university’s right, as controller, to process personal data is based on the exercise of public authority or on compliance with a statutory obligation. In cases of personal data processing based on consent, applicants have the right to withdraw the consent they gave. In such cases, the data subject may request their data be erased from the systems. It will then be erased, barring any other legal basis for processing it.

Applicants who contest the accuracy of the data, the lawfulness of the processing, or who have exercised their right to object to the processing may request that Aalto University restrict the processing of the personal data to that required for retention only. The processing of the data is then confined to its retention only until, for example, the accuracy of the data is verified. Applicants who lack the right to request erasure of the data may instead request that Aalto University limit the processing to that required for retention only. Applicants always have the right to object to the processing of personal data when the processing is for marketing purposes, for example. 

Applicants may exercise their rights as data subjects by submitting a GDPR-compatible request via Aalto University’s personal data portal:

Aalto University personal data portal

If the matter concerns changes to contact details, other routine changes or general questions relating to data processing, the data subject may call or email the contact person for the personal data filing system, as specified in the privacy notice. 

In matters concerning data protection and the processing of personal data, the data subject may contact the university’s data protection officer.

Data protection officer: Sirpa Syrjälä
Tel. (exchange): +358 9 47001
Email: dpo@aalto.fi

If applicants as data subjects consider the processing of their personal data to be an infringement of data protection legislation, they have the right to lodge a complaint with the data protection ombudsman (https://tietosuoja.fi/en/home), which is the supervisory authority.

Aalto University has an obligation to personally communicate any personal data breach to those data subjects to whom the breach concerns. Aalto University informs the data subjects if the breach is likely to pose a high risk to the rights and freedoms of the individual, such as a risk of identity theft, payment fraud or other criminal activity.

Personal data is processed electronically in information systems administered by Aalto University and by its partners.

Due diligence is observed in the processing of personal data and information security measures are followed as appropriate. Technical solutions such as firewalls and encryption are employed, and they comply with current standards. Aalto University as the controller ensures that stored information, user permissions and other data critical for the security of personal data are processed confidentially and in conformity with instructions. Applicant data is processed by only those Aalto University employees or individuals acting on behalf of the university who have a right to process the data. Aalto University ensures that the external experts who act as processors comply with the university’s data protection and information security guidelines.

For personal data processing, Aalto University has selected only those service providers whose processors adhere to best practices in personal data processing through appropriate technical and organisational measures, who meet the GDPR requirements and who are able to ensure that the rights of the applicants are upheld.