SJR:s Integrity Policy
This Integrity Policy applies to candidates, clients, supplier/vendors and other external parties.
Valid as of April 23, 2019
Introduction
Personal integrity is essential for companies in SJR in Scandinavia AB (referred below as “SJR”, “we”, “us”). Individuals who have entrusted us with their personal data should feel secure in knowing how personal data is managed and protected.
SJR is responsible for ensuring that all personal data is processed correctly and in accordance with current data protection legislation.
This Integrity Policy describes SJR’s processing of all personal data.
We ask you to carefully read this Integrity Policy before you share any personal data with us.
Personal data controller and contact information
The following companies within the SJR Group can serve as the personal data controller (“controller”) for the processing of your personal data:
SJR in Scandinavia AB, org.no 556443-2929
SJR in Sweden AB, org.no 556652-3980
SJR IT in Scandinavia AB, org.no 559125-2381
Ogunsen AB, org.no 556735-4427
Women Executive Search Sweden AB, org.no 556850-1331
The companies have a joint data protection officer and you only need to avail yourself of one channel of communication in the event you have any questions regarding SJR’s processing of personal data. If you have any questions, please contact us as follows:
E-mail: dataskydd@sjr.se
SJR
Attn: Dataskydd
Box 7420
103 91 Stockholm
Policy scope
För vem gäller policyn
This Integrity Policy addresses the processing of the personal data for which SJR is the controller, i.e., in those instances where SJR has a specific purpose and means for processing. The Integrity Policy regulates how SJR collects and processes personal data for the range of services we offer, which include temporary employment, recruitment and other associated business activities (“the Service”). The Policy also regulates the management of personal data for individuals at the parties in which SJR has a business relationship, such as suppliers/vendors and clients.
Candidates
When you join SJR’s network by registering your personal profile with us or apply for a position or assignment, SJR will process your personal data.
In general, we do not recommend that you share any personal information with us, i.e., information regarding your ethnic origin, sexual orientation, political opinions, health status, religious beliefs, or trade union membership. In the event you choose to do so, we will only process this information in accordance with your expressed consent.
Please note that you must be over 18 years or older to join our candidate network. Please do not submit any personal data to us if you are under 18.
Given that you, as a candidate, use our web-based services to register or update your candidate profile or search for current services, information will be collected about your visits on our website. SJR uses cookies when you use our website in order to optimize your internet experience. Additional information about cookies and how you can block the storage and retrieval of cookies is available in our guidelines for cookies.
What is the purpose of processing personal data?
We collect and use your personal data to identify and evaluate you as a candidate and to determine whether you qualify for the posted position. We may also use your personal data to determine whether you are qualified for any other job vacancy for which we are recruiting but have not publicly announced or alternatively for a position that you have not applied for. We may also use your personal data to determine whether you are a potential candidate for a consulting or interim assignment.
We may also share your application and/or CV, and thereby your personal data, with clients that could be interested in you as a candidate to identify new career opportunities.
In summary, we process your personal data for:
- Communicating with you regarding job offers, new career opportunities, etc., as well as to manage any administrative tasks associated with you.
- Presenting you to a potential employer that matches your preferences for a new career.
- Recruitment processes where you may be a current candidate.
- Consulting or interim assignments where you may be appropriate for a specific assignment or as an employee.
- Any matters regarding discrimination, disputes and complaints.
- Service improvements and development of Services and our IT systems.
- In order to meet the legal requirements to which we are subject and to process the information requested from the authorities.
SJR only processes the personal data to the extent required for the business activities and for the areas stated above.
What personal data is collected and how is it processed?
It is our obligation to only process personal data that is correct, relevant and necessary in view of our legitimate purposes.
Personal data you provide to us
When you join SJR’s network, you will provide us certain information about yourself that we will store in our candidate database. This is considered as personal data that you have provided to us. This information includes information about your name, e-mail address, telephone number, current position and/or job title. This also includes the application documentation you have chosen to submit, such as your CV, cover letter or certificates. If you chose to retrieve your personal data from your LinkedIn profile when you registered in the SJR network, SJR will also have access to this information.
Personal data we collect
SJR can also search after appropriate candidates for Services through, for example, LinkedIn, company websites or recommendations. The search is only conducted on information that is relevant and essential to assess the candidate’s professional qualifications and to make contact with the candidate. When we collect information about you through such a search, this information will be stored in our database and you will be notified of this. If you do not want to be included in our network, we will delete your information from our candidate database once we have been notified.
In the event you proceed further in a recruitment or consulting appointment process, you may be asked to participate in a number of interviews. In conjunction with this, we will collect additional information about you, such as your responses to interview questions and references from relevant sources.
As a candidate, you may also be required to complete personality and/or skills tests provided by an external vendor. Given that a number of SJR’s clients set high standards on individuals, we may need to conduct a background check if you are a final candidate in the process to determine whether you are suitable for a position that justifies such a verification. Background checks are also conducted by an external vendor and SJR never processes any personal data from a background check and only obtains the results in the service vendor’s IT system. As a candidate, you will also be given the opportunity to obtain the background check results in the service vendor’s IT system.
You will be requested to submit a specific consent form before any tests or background checks are conducted.
SJR may request that you provide an extract from the criminal records registry for certain positions and assignments. You will need to request such an extract at the relevant authority. It is your decision whether or not you want to order an extract from the criminal records registry. The extract will be opened by you, together with SJR and/or SJR’s client. The information in an extract from the criminal records registry is held in strict confidence and will never be processed by SJR. However, SJR may verbally share the results of the information with SJR’s client for the purpose of providing the Service.
Processing of personal identity number
We avoid processing personal identity numbers if at all possible. However, in certain circumstances it is necessary, primarily when we need to have a definitive identification for the purposes of a background check, for example.
References
As a candidate, you are obligated to inform any of the references you have provided to us that their personal data has been disclosed and that they may be contacted by us or the employer who has the position or assignment you have applied for.
With whom do we share your personal data?
We may share your personal data with other companies within SJR and our suppliers/vendors who provide services to us, e.g., suppliers of the maintenance and support of our IT systems and test vendors. In those cases in which the supplier/vendor is viewed as the personal data processor to SJR, SJR remains responsible for the processing of your personal data that is provided by the supplier/vendor in SJR’s assignment and the supplier/vendor may not use the personal data for any other purposes than those stated.
When we share personal data in accordance with the above, the personal data may be transferred to companies within as well as outside of the EU/EEA. All such transfers are based on current directives. Data processing outside of the EU/EEA will be subject to appropriate safeguards in the form of, for example, the EU Commission’s standard clauses for the transfer of personal data. The EU Commission has decided that countries must have an adequate level of protection or that the receiving company is certified under the EU-US Privacy Shield.
As a candidate, your personal data that is processed by SJR may also be transferred to SJR’s clients or potential clients in the event your profile matches a current assignment or client need. When taking your integrity into account, SJR will only transfer your personal data after we have had a discussion with you regarding your interest in the assignment concerned. When we provide your personal data to the client, they are independently responsible for the processing of your personal data subsequent to its receipt from us.
We also share your personal data with certain other parties who are independent controllers, i.e., suppliers of background checks. When your personal data is shared with a party who is an independent controller, that organisation’s integrity policy and personal data processing applies.
Further, we can share personal data if we are obligated in accordance with current legislation, court decision or if such disclosure is necessary in a legal investigation.
Laglig grund för behandlingen
Purpose of the processing |
Legal grounds for the processing |
|
To register the candidate’s personal data in the candidate database to identify suitable assignments for the candidate. |
Consent |
|
To collect personal data about the candidate from other sources than the actual candidate, e.g., LinkedIn, company websites, etc. |
Necessary for our legitimate interest of identifying suitable candidates. |
|
To process supplemental information from references. |
Necessary for our legitimate interest of ensuring that we identify the right candidate. |
|
To communicate via e-mail. |
Consent or alternative necessary for our legitimate interest of ensuring that candidates can communicate with us and receive information about current assignments. |
|
To conduct a credit check if required for the position or assignment. |
Necessary for our legitimate interest of ensuring that our systems meet the candidate’s requirements. |
|
To conduct system tests, business and methodology development. |
Nödvändigt för vårt berättigade intresse av att säkerställa att vi hittar rätt kandidat. |
|
To transfer the candidate’s personal data to the client. |
Consent |
|
To transfer the candidate’s personal data to the test vendor and to be able to receive the results of the tests. |
Consent |
|
To transfer the candidate’s personal data to a supplier of background checks. |
Necessary for our legitimate interest of ensuring that the candidate is suitable for the position or assignment. |
|
To archive the candidate’s personal data for two years from the appointment of the position due to provisions in the anti-discrimination law. |
Legal obligation |
How long do we store your personal data?
We process your personal data as long as it is necessary, while taking into account the purpose for which the personal data was collected. As a result, the storage periods may vary based on the type of information concerned.
Information in your profile in our candidate database
The information you registered in your personal profile in our candidate database will be purged if you have not been active during the last 24 months (active status means that you have, for example, updated your contact information or CV or have applied for a position or assignment).
Information linked to a specific recruitment or consultant staffing process
If you have been a final candidate in a recruitment or consulting process, your personal data for the specific assignment, such as application documentation, references and interview notes, etc., will be stored for two years after the position or assignment has been appointed for the purpose of addressing any discrimination matters.
Information from any background checks and credit checks concerning candidates are not stored by SJR.
Personal data collected through searches are stored in SJR’s candidate database for a limited period, to a maximum of 12 months, for the purpose of creating a relationship between you and SJR, with the objective of developing the contact into a recruitment or consultant staffing process.
References
To be able to conduct well-substantiated recruitment and consultant staffing processes, SJR will process personal data about you as a reference, such as name, contact information and title. The processing is based on SJR’s legitimate interest to be able to contact references provided to conduct recruitment and consultant staffing processes that are as well-substantiated as possible.
With regard to your integrity, SJR’s practice is to summarise all of the statements of the references and de-identify these in a reference report that is provided either orally or in writing to the client of the current assignment.
Your personal data may be stored for 2 years after the concerned position is appointed.
Contact person at the client
Maintaining business relationships with clients is an integral part of SJR’s business activities. SJR only processes personal data of the client contacts that are necessary to maintain and follow up the Service as well as to enable future business relationships, e.g., name, title and contact information. This processing is based on the company’s legitimate interest to conclude and fulfil the contract with the client.
As a general rule, we store client data for the purposes stated above as long as the client relationship exists and up to 12 months thereafter. We may also store this information for a longer period for specific purposes, such as accounting purposes. As a general rule, SJR will store personal data included in client contracts as well as information concerning business events during the contractual period and 10 years thereafter.
Your personal data may be used for marketing purposes. In the event you no longer wish to receive marketing material you may contact us and indicate that you no longer wish to be contacted for marketing purposes.
Contact person at potential clients
Establishing business relationships with new clients is a part of SJR’s core business. For the purpose of being able to contact you as a representative for a potential client to offer the Service, SJR collects personal data about you, e.g., name, title, contact information and previous employer (if you are a former client). The data, which we collect via our website, internal network, company websites, public registers and social media, is stored in our CRM system, with the objective of establishing a business relationship with the company you represent.
The processing of your personal data is based on SJR’s legitimate interest to be able to establish business relationships and develop our services.
If SJR contacts you and you decline further discussions, your personal data will be marked in our CRM system with a note to not resume contact.
SJR will process your personal data until it is no longer necessary to fulfil the purposes above or until that time you request its removal from our CRM system. If a business relationship has not developed within one year of SJR’s initial contact and there are no ongoing discussions, your personal data will be deleted.
Contact person at suppliers/vendors
SJR only processes personal data, such as name, title and contact information, if the contacts at the suppliers/vendors are necessary for the contractual relationship. This processing is based on the company’s legitimate interest to conclude and fulfil the contract with the supplier/vendor.
As a general rule, we store personal data as long as the contractual relationship exists. We may also store this information for a longer period for specific purposes, such as accounting purposes. As a general rule, SJR will store personal data included in supplier/vendor contracts as well as information concerning business events during the contractual period and 10 years thereafter.
Use of e-mail
SJR uses e-mail to facilitate communication and effectively communicate with our candidates, references, clients, suppliers/vendors and other external parties. The processing of personal data in e-mail is subject to consent, contract or legitimate interest.
We recommend that you do not send us sensitive personal data or integrity-related sensitive information via e-mail. Our e-mail account is purged periodically in accordance with our guidelines for e-mail. Personal data that is included in e-mail may be transferred to other registers and systems within SJR.
Protection of personal data
SJR has undertaken appropriate technical and organisational measures to protect personal data against loss, abuse, unauthorised access, disclosure, alteration and destruction.
SJR’s employees and suppliers/providers are bound by a confidentiality agreement and are obliged to comply with SJR’s rules for data protection, information and IT security, this Integrity Policy and other internal directives that further regulate the processing of personal data.
SJR as personal data processor
There may be situations in the delivery of the Service where SJR is not the personal data controller, but is only a personal data processor for a client of SJR. This applies to the Second Opinion and Team Development services. Additional information is available under the heading “Responsibility for personal data in our services” on our website.
When SJR processes personal data as a personal data processor, this occurs on behalf of the personal data controller and SJR is then bound by the instructions SJR has received from the personal data controller. In such situations, SJR is unable to guarantee that the processing will occur in accordance with this Integrity Policy; however, SJR will ensure at all times that the processing is conducted in accordance with current legislation and in accordance with this Integrity Policy where possible.
Your rights
It is our obligation to only process personal data that is correct, relevant and necessary in view of our legitimate purposes, and that you have the right to verify that this has occurred.
You have certain rights in accordance with the General Data Protection Regulation with regard to your personal data.
- Right to withdraw consent – You have the right to withdraw your consent submitted for the processing of personal data. However, a withdrawal of consent does not affect the legality of the processing that occurred prior to the withdrawal of your consent.
- Right of access – You have the right to receive information concerning our processing of your personal data. Such information is provided through this Integrity Policy. You also have the right to receive a copy of the personal data undergoing processing, i.e., an extract from the register.
- Right to rectification – You have the right to request that inaccurate data about yourself be rectified. You also have the right to supplement any incomplete data by providing the information.
- Right to erasure – Under certain circumstances you have the right to request the deletion of your personal data. This is referred to as the “right to be forgotten”. However, the right to erasure is subject to conditions and a request can be dismissed without taking action.
- Right to limitation of processing – In certain cases, you have the right to demand that the processing of your personal data be limited. However, the right to limitation of processing is subject to conditions and a request can be dismissed without taking action.
- Right to data portability – You have the right to receive the personal data you have provided to us (or request a transfer of the information directly from us to a new controller if this is technically possible) in a structure, commonly used and machine-readable format.
- Right to object – You have the right to object to the processing of your personal data when the personal data is processed on the basis of our legitimate interests if you do not believe that SJR has a legitimate interest in the processing of the personal data. The right to object also applies to the processing of personal data for direct marketing purposes.
Read more about your rights in the link below:
You also have the right to lodge a complaint with the Swedish Data Protection Authority at any time if you believe that SJR has processed your personal data in violation of current data protection legislation.
Changes to this Integrity Policy
SJR reserves the right to revise this Integrity Policy from time to time. The date of the most recent change is stated at the beginning of the Integrity Policy. Changes to the Integrity Policy will be published on the website. We recommend that you review this Integrity Policy regularly so that you are up-to-date on any changes to the Policy.