1) Introduction

The privacy policy for job applicants in connection with the recruiting process (the “Policy”) describes how the Organization ("us", "we", or "our") collects and processes personal data relating to job applicants as part of the recruiting processes. We are committed to being transparent about how we collect and use your personal data and meeting our data protection obligations. As a controller, we collect and process personal data about you when we handle your job application and during the recruiting process.

This Policy is prepared and made available to you to comply with the (EU) General Data Protection Regulation (2016/679 of 27 April 2016) (“GDPR”) and, where we process personal data of individuals in the United Kingdom, the UK GDPR and the Data Protection Act 2018.

The controller

The controller under data protection law is:

Flatpay ApS

Hørkær 16, 3. Floor, 2630 Herlev, Denmark

Phone: +45 88773939

Commercial register entry number: 42718033

2) Types of personal data we process about you

We process personal data about you when this is necessary and in accordance with the applicable legislation. Depending on the specific circumstances, the processed personal data include the following types of personal data: address, CV, date of birth, email address, IQ and/or personality tests, name, National identification number/ information, nationality, phone number, profile picture, references from former employers, civil status, educational documents.

We do not process sensitive personal data, i.e., the special categories of personal data, as defined in GDPR, Article 9(1).

If we need to collect more personal data than what is specified above, we will inform about this. Such information may be provided by updating this Policy.

3) Purposes for processing the personal data

The personal data we collect about you are processed for the following purposes:

To process job applications and recruit relevant candidates.

4) Use of AI in recruitment

We may use AI tools to support parts of the recruitment process, e.g., screening and interviews. These tools help identify candidates whose experience and qualifications match the requirements of the role. Final hiring decisions are always made by humans.

5) Legal basis for processing personal data

We only process your personal data when we have a legal basis to do so in accordance with the GDPR. Depending on the specific circumstances, the processing of personal data is done on the following legal bases:

a) The processing is necessary and carried out in the Organization’s legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms, in accordance with GDPR, Article 6(1)(f).

b) If we have asked for your consent to process some specific personal data, the legal basis for the processing of such personal data is your consent, in accordance with GDPR, Article 6(1)(a). You can always withdraw your consent by contacting us via the contact details provided at the end of this Policy. If the consent is withdrawn, the personal data processed on the basis of your consent will be deleted, unless it can or must be processed, for example, to comply with legal obligations.

6) Disclosure and transfer of personal data

We only transfer personal data to other entities when allowed or required to do so by applicable legislation.

We transfer personal data to the following recipients from the EU/EEA:

a) Processors

From time to time we use various eternal and professional organizations (third parties) as suppliers and collaborators to assist us in delivering our services and products. The third parties will not receive or process personal data unless the applicable law allows for such transfer and processing. Where the third parties are processors, the processing is always performed on the basis of a data processing agreement and in accordance with the requirements under GDPR. Where the third parties are controllers, the processing of personal data will be performed based on the controller’s data privacy policy and legal basis that the external parties are obligated to inform about unless the applicable legislation allows otherwise.

We transfer personal data to countries or international organizations outside the EU/ EEA. We transfer Personal Data to Japan, Canada, New Zealand, USA (DPF-certified recipient). The basis for such transfers is an adequacy decision by the European Commission and, for transfers from the UK, the corresponding UK adequacy regulations. For transfers to the USA, we rely on the EU-US Data Privacy Framework and, for UK transfers, the UK Extension to the Data Privacy Framework, where the recipient is certified accordingly. Personal data is transferred to the following countries: Australia, Brazil, Ireland, India, Mexico, Malaysia, Philippines, Turkey. Where no adequacy decision applies, transfers are based on the EU Standard Contractual Clauses approved by the European Commission and, for UK transfers, the UK International Data Transfer Addendum to those clauses (or the UK IDTA), ensuring a sufficient level of protection.

If you have any questions about our use of processors, cooperation with other controllers, including subsidiary companies, or transfer of data to third countries, please contact us for more information or documentation of our legal basis for such transfers.

7) Erasure and retention of personal data

We ensure that your personal data is deleted when it is no longer relevant for the processing purposes as described above. We always retain personal data to the extent that we have a legal obligation, such as for example in the case of accounting and bookkeeping materials and records.

If you are offered a position and become an employee in the Organization, your personal data from the job application and data from the recruiting process are transferred/moved to our regular HR management system.

If you are not offered a position in the Organization, your personal data is erased after 6 months in accordance with applicable law. Notwithstanding the above, specific reasons related to employment law may necessitate the continuous processing of personal data. This may have different implications. For example, we may process the applications for a longer period to prove that there was no unlawful discrimination in the selection process when we consider this necessary. Similarly, it may be relevant to process the personal data for a limited period if a similar relevant position may become available during this period, or if another candidate opts out of the recruiting process.

If you have any questions about our retention of your personal data, please contact us by using the email mentioned under the last section of this Policy.

8) Your rights as a data subject

As a data subject under GDPR, you have a number of rights:

You have the right to request access to the personal data we process about you, the purposes we process the personal data, and whether we disclose or transfer your personal data to others.
You have the right to have incorrect information rectified.
You have the right to have certain personal data deleted.
You may have the right to restrict our processing of your personal data.
You may have the right to object to our processing of your personal data based on reasons and circumstances that pertain to your particular situation.
You have the right not to be subject to a decision based solely on automated means, without human interference unless the decision is necessary for your employment, the decision has a legal basis, or is based on your explicit consent.
If the processing of your personal data is based on your consent, you are entitled to withdraw such consent at any time. Withdrawal of your consent will not affect the lawfulness of the processing carried out prior to your withdrawal of consent.
You are entitled to receive personal data which you have provided to us in a structured, commonly used, and machine-readable format (data portability).
You can always lodge a complaint with a supervisory authority.
Your rights may be subject to conditions or restrictions. Accordingly, there is no certainty that you will be entitled to for example data portability in the specific situation; it will depend on the circumstances of the processing.

In connection with inquiries concerning your rights, we ask that you provide us with adequate information to process your inquiry, including your full name and your email address, so that we may identify you and respond.

9) Changes to this Policy

We reserve the right to update and amend this Policy. If we do, we correct the date and the version at the top of this Policy. In case of significant changes, we will provide notification in the form of a visible notice, for example on our website or by direct message.

10) Contact

You may contact us at the email address below if you:

disagree with our processing or consider our processing of your personal data infringes on the law, have questions or comments to this Policy, or want to invoke one or more of your rights as a data subject described in this Policy.

If you have questions or comments to this Policy or if you would like to invoke one or more data subject rights, please contact our legal department at legal@flatpay.com.

Unsolicited applications (Flatpay Finland)

Want to join Flatpay?

Documents