Integrity policy

Below is information about Cruitive's processing of your personal data within the candidate account.

Your personal privacy and the security of your personal data are important to Cruitive AB, which is responsible for ensuring that all personal data is processed correctly and in accordance with applicable data protection legislation. Protecting your personal data and privacy is part of our employees' job. Cruitive, as the data controller, is responsible for the processing of your personal data and how and for what purposes it is done.

Data Controller and Contact Information

Cruitive AB, org. no. 559161-2159, is responsible for processing your personal data in the candidate account. We have a Data Protection Officer, and you only need to use one contact method if you have questions and concerns about Cruitive's personal data processing. If you have any questions, please feel free to contact us at gdpr@cruitive.com.

What personal data we process in your candidate account and how it is collected

When you register your CV and profile with Cruitive and thus register a candidate account, Cruitive will process personal data about you and how you use our services. The personal data processed when you register a candidate account includes name, email address, phone number, and information in the CV, such as work experience, previous workplaces, personal identification number, certificates, photographs, and any other information you voluntarily provide to us.

A candidate account can be created by you via our website, when applying for external positions through our system, in an app, or by Cruitive at your request after, for example, a phone call between you and Cruitive's staff. We collect and process personal data:

• that you provide when creating an account (or give to Cruitive for us to create an account for you),
• that we obtain from you during the time you have a candidate account, e.g., information about career ambitions, personal and social characteristics, industries you want to work in, desired working hours, etc.
• that we obtain from other sources, e.g., information from references you have provided.
• through third parties, such as Facebook or LinkedIn when you add and approve such links yourself.

What we use the personal data in your candidate account for

Cruitive processes your personal data only for the purposes stated below.

Purpose of processing (indent = Legal basis for processing)

To provide and administer the services you requested by creating a candidate account, i.e., to find suitable assignments for you. Necessary to fulfill our contractual obligations to you.

To process additional information from, for example, references or other contacts. Necessary for our legitimate interest to ensure finding the right candidate.

To handle inquiries you make to our support. Necessary for our legitimate interest to ensure that candidates can communicate with us.

To conduct a credit check if it is necessary for the position or assignment you have applied for. Necessary for our legitimate interest to ensure that the candidate is a suitable candidate for the position or assignment.

To perform market analyses, system tests, business and method development. Necessary for our legitimate interest to ensure that the services and our systems meet the needs of candidates and our customers over time.

To provide direct marketing and offers from Cruitive. Necessary for our legitimate interest to maintain good candidate relationships. You can always opt out of direct advertising and offers from us, see below under your rights.

Processing of additional personal data during assignments/processes

When we perform services for you, we may, due to requirements from our customers and/or legislation, process additional personal data about you. This may include personality tests, information on whether you have undergone alcohol or drug tests, background checks, and health checks. Before collecting such personal data, you will receive information about the processing and, where applicable, you will be asked to give your consent.

In some cases, we may ask you to provide an extract from the criminal records. It is you yourself who orders and receives such an extract from the police authority, and you choose whether you want to show the extract to us. In such case, the extract will be opened by you together with Cruitive. We will not process this information in any form, but may verbally check the result with our customer.

Who we share your personal data with

We may share your personal data with other companies and subcontractors that provide services to us, e.g., suppliers of operation and support of our systems. Cruitive remains responsible for the processing of your personal data that we or subcontractors perform on Cruitive's behalf, and subcontractors may not use personal data for purposes other than those we specify; in such case, they are themselves responsible for requesting consent from you. Sharing of personal data within Cruitive or to a subcontractor is done to fulfill the Agreement between us, i.e., for us to be able to provide the agreed services to you.

When we share personal data as described above, personal data may be transferred to companies both within and outside the EEA. All such transfers are based on applicable law, and processing done outside the EEA will be subject to appropriate safeguards in the form of, for example, EU Commission model clauses for such transfer, that the EU Commission has decided that the country has an adequate level of protection, or that the receiving company is certified under the EU-U.S. Privacy Shield.

Personal data about you will also be shared with Cruitive's customer(s) when necessary to perform our services to you, i.e., to find employment or placement for you with a customer. If we provide your personal data to our customer, the customer is independently responsible for their processing of your personal data after such receipt from us.

How long we keep your personal data

We process your personal data for as long as necessary considering why the personal data was collected. This means that different data may be stored for different lengths of time.

Your candidate account, and other personal data we process regarding you, will be deleted if you have not been active for 36 months (e.g., by updating contact information, logging in, applying for work, or contacting Cruitive through other channels). The data is then deleted from all our servers and services, which also means that our customers' and subcontractors' information about you disappears as long as they have not extracted the information from our system and thus bear responsibility for deleting any personal data about you. Information that has been collected in the context of credit assessment is deleted after three months. If you have been a final candidate for an assignment, certain general information about you as well as references, interview notes, and test results for the specific assignment are stored for 5 years after the specific assignment with our customer has ended so that we can fulfill all our obligations. Information about any health checks, conducted alcohol or drug tests, and background checks is stored for a shorter period. You will receive detailed information about this when such data is collected.

Security

Cruitive has taken, and will take, appropriate technical and organizational measures to protect personal data against loss, misuse, unauthorized access, disclosure, alteration, and destruction. To ensure that personal data is processed in a secure and confidential manner, we use data networks that are intrusion-protected with, among other things, firewalls and password protection according to industry standards. To ensure the integrity of the personal data you provide via the internet, we may use encryption technology when we transfer such personal data over the internet between our servers. Cruitive's employees and suppliers are bound by confidentiality agreements and are required to follow Cruitive's rules for information and IT security, internal policies regarding the processing of personal data, and other internal regulations and guidelines that further regulate the processing of personal data.

Your rights

You have certain rights under the General Data Protection Regulation regarding your personal data:

• Right of access - you have the right to receive certain information about our processing of your personal data. Such information is provided through this information document. You also have the right to access a copy of the personal data we process about you.
• Right to rectification - you have the right to have inaccurate personal data about you corrected.
• Right to erasure - under certain circumstances, you have the right to have your personal data erased. This is sometimes called "the right to be forgotten". However, the right to erasure is conditional and a request may be left without action.
• Right to restriction of processing - under certain circumstances, you have the right to require that the processing of your personal data be restricted. However, the right to restriction is conditional and a request may be left without action.
• Right to data portability - you have the right to obtain personal data you have provided to us (or request direct transfer of the data from us to a new data controller) in a structured, commonly used, and machine-readable format.
• Right to object - you have the right to object to our processing of your personal data if the processing is based on a balance of interests, if you do not believe that Cruitive has a legitimate interest in processing the personal data. The right to object also applies to the processing of personal data for direct marketing.

Please read more about the rights on the Swedish Data Protection Authority's website.

You also have the right at any time to lodge a complaint with the Swedish Data Protection Authority if you believe that Cruitive processes your personal data in violation of applicable data protection legislation.

Updated 2018-12-27