suomeksisuomeksi

Data protection notice regarding VR’s data on job and training applicants

  1. Controller
    VR Group
    PO Box 488
    00101 Helsinki, Finland
    tel. +358 (0)307 10
  2. Data Protection Officer and contact information
    Contact person for HR data protection:
    Heini Toivonen
    VR Group Ltd, HR unit
    PO Box 488, FI-00101 Helsinki, Finland

    Contacts by email: Sf-tuki@vr.fi
    Contacts by phone: +358 (0)40 862 1278

    VR Group’s Data Protection Officer:
    Tanja Kalliojärvi
  3. Purposes of the processing of personal data
    Personal data is processed in VR Group’s and its Group companies’ recruitment and training application processes. In addition, personal data is processed in order to take care of VR Group’s rights and obligations.

    The processing of job and training applicants’ personal data is based on the following legal grounds:

    Contract
    A job or training applicant’s data is processed to take steps at the request of the data subject prior to the performance of the employment contract between the data controller and the data subject.

    Consent
    Job or training applicants’ data is processed with the applicant’s consent in the recruitment or training application process. For job applicants, the processing may be related to an individual position or alternatively to several positions as an open application. For training applicants, the processing of personal data is related to the specified training application.

    Legal obligation
    VR retains job applications and related data after the recruitment process to fulfil its legal obligation regarding job applicant equality, for instance.
    On a position-by-position basis, VR processes, as required by law or on the basis of law, data related to position-related psychological aptitude.
  4. Sources of data
    Data is mainly collected from the applicants themselves. Data may also be collected from other parties, such as reference contacts given by the applicant and health and aptitude assessment providers, with the applicant’s consent. In addition, data is collected from parties participating in recruitment, such as VR Group’s interviewers or external parties taking care of recruitment on VR Group’s assignment.
  5. Data subjects and the categories of personal data
    Regarding this data protection notice, the groups of data subjects and the related categories of personal data are described below:

    Data subjects
    1. Persons who have applied for a specific position at VR Group
    2. Persons who have applied for any position at VR Group (open application)
    3. Persons who have applied for training organised by VR Group

    Data
    • Personal data
    • Contact details
    • CV, incl. work experience
    • Application
    • Photo
    • Basic training level and related details
    • Courses and qualifications
    • Language skills
    • Free-form additional information
    • Driving license details
    • Reference contacts and their contact details
    • Comments and assessments from parties participating in recruitment, e.g. interviewers (when necessary)
    • Video interview (when necessary)
    • Psychological aptitude assessment (when necessary)
    • Health assessment (when necessary)

  6. Data processing participants outside VR
    We use external parties to support the processing of personal data in the maintenance and development of IT systems, aptitude assessments, health assessments and outsourced recruitment processes, for instance. These service providers process personal data commissioned by us and on our behalf. The data processing follows current legislation and is always carried out in accordance with this data protection notice. This is ensured, among other things, through contracts between the organizations.
  7. Data disclosure
    Data is not disclosed, without statutory grounds, to parties outside VR Group or to parties other than those participating in taking care of VR Group’s rights and obligations as an employer. When it comes to the training application process, data concerning the persons selected for training is disclosed to the training organization.
  8. Transfer or disclosure of data outside the EU or the EEA
    Data will not be transferred or disclosed outside the EU or the European Economic Area or outside countries which the European Commission considers as having an adequate level of data protection, unless the adequate level of data protection has been ensured with contracts or in another manner required by law.
  9. The data retention period or the definition criteria for the retention period
    An applicant’s personal data will be retained for twelve (12) months after the recruitment process or an update made by the applicant in VR’s recruitment system.
  10. Rights of the data subjects
    Job and training applicants have rights concerning the data processed by VR. The rights can be exercised as follows:
    1. Request a data protection request form from sf-tuki@vr.fi.
    2. Submit the data protection request with the form. You can also submit the request by phone.
    3. VR carries out measures to identify the submitter of the data request and to ensure that action is taken on the data of the correct applicant.
    4. If the identification is successful, the request will be processed (as described in more detail below).
      1. If the identification is not successful, you will receive a message from VR stating the reason for rejecting the request.
      2. If the request is not processed for another reason, we will send a message stating the reason for rejecting the request.

    VR responds to all requests related to data subjects’ rights at the latest within one month of receiving the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. If the period is extended, we will inform all requesters of delay and its reasons within one month of receiving the request.

    Below, we describe the rights of job and training applicants and related principles and practices:
    1. Right to access data
      A job or training applicant has the right to obtain confirmation whether their personal data has been processed by VR and to receive a copy of their personal data. The primary method for delivering the copy is encrypted email or alternatively mailing the document as a registered letter.
    2. Right to rectification
      A job or training applicant has the right to request VR to rectify inaccurate and erroneous data about them. The erroneous nature of data is to be decided on a case-by-case basis by resolving whether the data is erroneous from the viewpoint of its processing (unnecessary, incomplete, outdated).
      Please note that you can update your data directly in VR’s recruitment system.
    3. Right to erasure (“right to be forgotten”)
      As a rule, job applicant data will be retained for twelve (12) months after the recruitment process or an update made by the applicant in VR’s recruitment system. After this period of time, the personal data will be erased. Before this, there is no right to erasure if the processing is required for compliance with a statutory obligation, based on the legislation applicable to VR, that requires such processing. An example of this kind of legislation is the Non-discrimination Act, which restricts the exercise of certain rights, in which case VR has the right and obligation to reject the request.
      Please note that you can delete your data in VR’s recruitment system yourself before the end of the application period.
    4. Right to restriction of processing
      A job or training applicant has a right in certain special situations stipulated by law to request the restriction of the processing of their personal data
    5. Right to object
      A job or training applicant has the right to object to the processing of their personal data if the processing is based on the controller’s legitimate interest.
    6. Right to data portability
      A job or training applicant has the right to request their personal data in machine-readable file format to have them transmitted to another service provider. This right concerns data that is in electronic format and whose processing is based on consent or the performance of a contract.
      Upon request, the applicant’s data is delivered to them as encrypted email.
      Please note that you can download your data directly from VR’s recruitment system.
    7. Right to withdraw consent
      A job or training applicant has the right to withdraw their consent at any phase of the application process. After consent withdrawal, the processing of personal data as part of the recruitment process will be terminated. However, note that personal data related to a job application will be retained for twelve (12) months after the recruitment process to fulfil statutory obligations. For instance, the Non-discrimination Act restricts the exercise of certain rights, in which case VR has the right and obligation to reject the request.
      Please note that you can withdraw your consent in VR’s recruitment system before the application period for a certain position ends and, in case of an open application, at any time.
    8. Right to lodge a complaint with an authority
      We seek to resolve any disputes primarily directly with data subjects. If a job or training applicant finds that we have not processed personal data as stipulated by law, they may lodge a complaint with a data protection authority.
  11. Principles of data protection
    The data security of VR’s personal data processing as well as personal data confidentiality, integrity and accessibility are ensured with appropriate technical and organisational measures in accordance with VR’s data security principles. Personal data is protected against unauthorised access and illegal or accidental processing. Personal data is processed only by persons specifically appointed by VR to such tasks who have received personal data processing training.
    Only employees participating in VR Group’s recruitment and selection processes have access rights to the information systems used in the job and training application process.
  12. Profiling and automated decision
    Automated decision making is not used in the service.

    Analytics tools (Google Analytics) are used for creating usage statistics and for development of the service.
  13. Cookies
    Cookies are used for providing the service and its statistics. Cookies can be restricted by changing browser settings. However, restricting cookies may lead to failures using the service.
  14. Updated 23.3.2020