Privacy Policy for Groweo Recruitment

1. General

  1. In this Privacy Policy, we provide you (hereinafter ‘You’ or ‘Data Subject’) who are applying for a job at Groweo with the information required by Articles 13 and 14 of the European Union’s General Data Protection Regulation 2016/679 (hereinafter ‘GDPR’).
  2. The processing of the personal data of employed persons is governed by a separate Privacy Policy for Groweo Staff.

2. Data controller and its contact details

Groweo Oy, business ID 3256882-1
Address: Pohjoisesplanadi 35Aa, 00100 Helsinki, Finland
Telephone: +358 (0)10 7399 330
Contact person: Hanna Harjula

3. Purposes and legal basis for processing personal data

  1. The purpose of processing personal data is for the recruitment of staff. This includes receiving and processing job applications, evaluating and selecting job applicants, and fulfilling other needs related to the recruitment process. If a job applicant does not wish to disclose their data to Groweo, he or she may not be considered in the recruitment process.
  2. The processing of personal data is based on Groweo’s legitimate interest in processing personal data in a manner that is necessary for the recruitment process. In certain circumstances, the processing of personal data is also necessary for the implementation of measures prior to entering into a contract between Groweo and the job applicant and for the conclusion of an employment contract.
  3. In addition, Groweo may, where required by national law, request the job applicant’s consent to the collection or processing of certain types of personal data. Consent may be requested, for example, if an aptitude assessment is carried out during the recruitment process.
  4. The table below lists the purposes of processing, their legal basis and the categories of processed personal data.
Purpose of useLegal basisCategories of personal data
RecruitmentLegitimate interest of the data controller / implementation
of measures prior to entering into a contract at the request of the data subject		Personal details, CV including your work history and details of your current job, if any, education and training details,
any aptitude assessments and
segmentation performed by Groweo,
digital materials such as a portfolio and photograph, and any other information you provide on your own initiative.
RecruitmentLegitimate interest of the data controllerPersonal details of referees and other persons you have provided
RecruitmentYour consentInformation collected from referees
regarding the job applicant’s performance at work.


You do not have to provide us with your personal data, but refusal may affect your chances of being selected or we may not be able to continue the recruitment process.

    4. Categories of data subjects and categories of personal data processed

    1. Categories of data subjects: job applicants.
    2. Categories of personal data processed:
    Categories of personal dataData content of category
    Personal detailsName and contact details (email address, telephone number and home address), any social network addresses.
    Information about your work history and current jobInformation about your current and previous employers,
    the duration of previous employment relationships and the type of work performed and job title.
    Information on education and trainingCompleted degrees and training, transcripts of records, and degree certificates.
    Information on aptitude assessmentResults of aptitude assessment.
    Other information you have provided for your job applicationInformation contained in your application letter and CV, as well as other information you provide during the interview, such as information about your skills and expertise, salary expectations, age, date of birth, title, skills, hobbies and interests, and information about your leisure
    activities, such as voluntary work.
    PhotoYour photo.
    Details of refereesName, title, place of work and contact details of the referee.
    Data collected from refereesInformation on performance at work.

    5. Regular sources of data

    We obtain the data we process from you in connection with job applications, aptitude assessments, interviews and other encounters. With your consent, information may also be obtained from your nominated referees or other persons.

    We may also obtain information from public sources, such as public search engines, other public websites and social media.

      6. Recipients of personal data and categories of recipients

      Your personal data will only be processed by Groweo employees involved in the recruitment process. In addition, Groweo may disclose your personal data to companies that act as Groweo service providers for the recruitment platform or aptitude assessments.

        7. Geographical limitations

        Groweo does not routinely transfer personal data outside the European Union or the European Economic Area (“EU/EEA”). However, data may be transferred outside the EU/EEA in situations where our service providers or their parent companies are located in such third countries.

        If personal data is transferred outside the EU/EEA, transfers are subject to the conditions set out in data protection legislation, such as adequacy decisions of the European Commission, standard contractual clauses or any other transfer mechanism designated in the GDPR.

          8. Security of the processing of personal data

          Groweo implements and maintains the following technical and organisational security measures to ensure the protection of personal data:

            Manually processed material:Manual material is stored in a locked space accessible only to designated persons. As a rule, Groweo only processes digital material.
            Digitally processed materials:Digitally processed personal data is protected and stored in Groweo’s information system, where it is restricted to persons who need the data to perform their duties. These persons have personal user IDs and passwords.

            Personal data sent outside Groweo is encrypted. The workstations and storage media used by Groweo are encrypted.

            9. Retention period of personal data

            Recruitment records are kept during the recruitment process and for a maximum of three years after the end of the recruitment process. Your application and personal data will then be automatically deleted.

              10. Rights of the data subject

              You have the following rights:

                Right to withdraw consent (Article 7 of the GDPR)
                		You have the right to withdraw your consent if the processing of your personal data is based on consent. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.
                Right of access by the data subject (Article 15 of the GDPR)
                		You have the right to be informed about your personal data held by Groweo and the right to be informed about the processing of your personal data. You also have the right to receive a copy of the personal data processed.

                Right to rectification (Article 16) and right to erasure (Article 17)
                		You have the right to request the rectification of inaccurate or incorrect personal data and the completion of incomplete data. You also have the right to request the erasure of your personal data in accordance with data protection legislation. Please note that if personal data is stored, for example, to comply with a legal obligation, the request for erasure cannot be accepted.
                Right to restriction of processing (Article 18)
                		In certain circumstances, you have the right to request restriction of the processing of your personal data in accordance with data protection legislation. In addition, where personal data believed to be inaccurate cannot be corrected or deleted or there is uncertainty about the request for deletion, we will restrict access to the data.
                Right to data portability (Article 20)
                		Under data protection legislation, you have the right to receive your personal data in a structured, commonly used and machine-readable format, and to request the transfer of your personal data to another data controller. Please note that the right to data portability applies in principle only to personal data processed on the basis of your consent or agreement and only when such data is processed automatically.

                Right to object (Article 21)

                		You have the right to object to the processing of personal data based on legitimate interests. We may refuse a request if there is an important and legitimate ground for the processing which overrides the interests, rights and freedoms of the data subject, or if it is necessary for the establishment, exercise or defence of legal claims.

                Right to lodge a complaint with a supervisory authority (Article 77)
                		You have the right to lodge a complaint with the competent data protection authority if you believe that your personal data has been processed in breach of the law. However, please contact us in the first instance if you have any questions about the processing of your personal data.
                In Finland, the supervisory authority is the Office of the Data Protection Ombudsman (https://www.tietosuoja.fi).

                11. Changes and updates to the Privacy Policy

                1. We are constantly developing our business and may therefore need to change and update this Privacy Policy. Changes may also be based on changes in legislation.

                  Updated 20 December 2024