DATA PROTECTION STATEMENT – University of Helsinki recruitment 1 November 2020

1. Controller of the data file Name: UNIVERSITY OF HELSINKI Address: Fabianinkatu 32, 00014 UNIVERSITY OF HELSINKI

2. Contact person in matters concerning the data file Enquiries pertaining to the data file should be sent to recruitment@helsinki.fi.

3. Contact details of the data protection officer: tietosuoja@helsinki.fi

4. Purpose and justification for processing personal data Purpose of processing personal data: Processing of applications, assessment of aptitude, and communication related to appointee selection. We also wish to promote equality in our recruitment as well as ensure smooth integration into Finnish society for employees arriving from abroad. The processing of applicants’ personal data is based on consent given by the data subject. All data are processed confidentially. Personal data can only be processed by persons employed by the University of Helsinki involved in the recruitment process, as well as by experts from outside the University, when necessary.

5. Content of the data file Applicant’s personal data (name, gender, date of birth, nationality) Applicant’s address and contact details (street address, country, locality, postcode, email and phone) Applicant’s internet addresses (e.g., applicant’s LinkedIn profile) Applicant’s educational background Applicant’s prior work experience Applicant’s language skills, IT skills and other skills relevant to the position Applicant’s employment preferences Attachments related to the application (e.g., CV, list of publications) Other details the applicant considers relevant to the position Certain data are required for related processes and communication. The rest, provided voluntarily by the applicant, help us assess the applicant’s aptitude for the position in question. For external assessors involved in University of Helsinki recruitment processes, names and email addresses are stored in the system.

6. Regular sources of data Data are collected from the data subject. In the case of persons employed by the University of Helsinki, their name, date of birth and contact details are transferred to the recruitment system from the University of Helsinki’s SAP HR human resources information system. In certain recruitment processes, data are also collected with the applicant’s consent from separate external assessors in, for example, aptitude assessments or, in professor recruitment, external academic assessments.

7. Processing and protection of sensitive personal data No sensitive personal data are processed for recruitment purposes.

8. Duration of personal data storage and removal of unnecessary personal data In the case of applicants from outside the University, applicant profile data are stored for 24 months from the last login to the recruitment system. As a rule, application documents (attachments and personal profiles) are stored for 24 months from the appointment decision, with the exception of shortlisted applicants to professorships, whose data are stored permanently for archiving purposes. In the case of applicants employed by the University, personal data are stored for the duration of employment, and for no longer than 12 months from the termination of employment. Data subjects have the right to access their personal data stored in the system by logging in to it. Data subjects can update and rectify their personal profile data at any time.

9. Automated processing of personal data and profiling The data contained in the data file are not used for profiling, nor are any decisions by automated means carried out using the data.

10. Disclosure of data In the case of recruitment processes including an aptitude assessment or another assessment by experts, personal data can be disclosed to the assessors involved in the process. In such cases, data can be processed by the assessors within or outside the European Union. As an institution under public law, all recruitments made by the University are public. This means that, when requesting data from applicants, the Act on the Openness of Government Activities (621/1999) requires the University to disclose application documents and any data pertaining to the recruitment process.

11. Transfer of data outside the EU or EEA The data contained in the data file are stored within the European Union, and they are not transferred outside the EU or the European Economic Area. As an exception, personal data can be processed by external assessors outside the EU in conjunction with assessments associated with recruitment.

12. Rights of data subjects

Withdrawal of consent and the right to erasure If the processing of personal data is based on consent, you have the right to withdraw your consent. In the case of recruitment, this means that you withdraw your application to the position you have applied for. This does not yet automatically mean that your data will be erased from the system (see Right to erasure).

Right of access You have the right to obtain confirmation as to whether or not personal data concerning you are being processed and which details are being processed. You can log in to the recruitment system using your personal credentials and access the data included in your applicant profile, including any attachments and your application history. In the case of other data not accessible in the system, you can submit a specified request for access by email: rekrytointi@helsinki.fi.

Right to rectification of data in the data file If there are inaccuracies in your personal data being processed, you have the right to rectify or complete your data. You can rectify or complete your data by logging in to the recruitment system (https://rekry.helsinki.fi/start).

Right to erasure You have the right to have your personal data erased on the following grounds:

1) The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

2) You withdraw the consent on which the processing is based, and there are no other legal grounds for the processing;

3) The personal data have been unlawfully processed. You can remove your applicant profile from the recruitment system (https://rekry.helsinki.fi/start), after which your personal data will no longer be processed for recruitment purposes. Please note that after removing your profile, your application will no longer be considered in any ongoing or future recruitment processes.

Right to restriction of processing You have the right to restrict the processing of your personal data. This means that we will store your data, but will not process it in any other way. You can restrict the processing of your personal data by withdrawing from the recruitment process. You can influence the processing of your personal data by making your applicant profile available for recruitment processes associated with other vacant positions within the University.

Right to data portability You have the right to receive the personal data concerning you, which you have provided to the University, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the University. This can be done by logging in to the recruitment system (https://rekry.helsinki.fi/start) and creating a PDF file of your application.

Right to lodge a complaint If you have any questions about the processing of your personal data, you can write to rekrytointi@helsinki.fi. If you consider that the processing of your personal data has been carried out in breach of valid data protection legislation, you also have the right to lodge a complaint with the Office of the Data Protection Ombudsman. Contact details: Office of the Data Protection Ombudsman Phone (switchboard): +358 2956 66700 Email: tietosuoja@om.fi