Privacy Statement – Recruitment and Employment at Barona Sweden

 

1. Introduction

The protection of your privacy is important to us. Barona Human Resource Services AB,  Barona Professionals AB, Barona Teknik & Installation AB, Finstallation AB and Barona Contact Center AB, together referred to as “Barona”, “us” or “we”, are committed to protecting your privacy in the best way possible, and to processing your personal data transparently, in accordance with the law in force at a given time and with good data protection practices.
This Privacy Statement describes how personal data is being processed when a user registers on our recruitment system to create a professional profile for recruitment and hiring purposes. In addition, this Privacy Statement describes how personal data is processed when our registered users apply for an open position advertised on our recruitment system. This Privacy Statement also applies to our data processing practices regarding personal data of our current staff members, as well as our ex-employees as required by tax, insurance and employment law.
Thus, if you are a registered user, job applicant, staff member or ex-employee, this privacy statement describes how we collect, process and protect your personal data throughout our business.
 

2. Use and purpose of processing personal data

We collect and process your personal data only to the extent that this data is necessary for managing job applications and employment relationships, as well as fulfilling employer obligations. The purpose of processing personal data is to manage affairs related to the employment relationship of personnel who are employed at Barona and companies that, at a given point in time, belong to the same corporate group.
The purpose of the processing determines what types of personal data we collect in each situation.

A. Purpose of processing personal data in the context of recruitment and hiring

Purpose of processing personal data	Legal basis of processing
Communicating with you in context of recruitment activities	Consent Legitimate interest
This includes, primarily, providing you information about available vacancies relevant to you, communication throughout the recruitment process as well as provision of our newsletters. For this purpose, we process: Basic mandatory information necessary for registration: first name(s) and surname(s) e-mail address Optional basic information provided by the job seeker him-/herself contact information (e.g. phone number/s, address) personal ID nationality
Management and development of our recruitment activities	Consent Legitimate interest Statutory requirement
We process your personal data to assess your suitability for the role that you have applied. We also perform data analytics, including analysis of our applicant pool in order to better understand who is applying to positions at Barona and how to attract top talent. For these purposes, we process the following information: qualifications trainings employment history information about work positions, such as title and work descriptions educational achievements, such as diplomas, certificates and licenses, transcripts of records skills any data you provide us during interviews professional and social media accounts, such as LinkedIn Any personal data provided to us about you by your referees (if applicable). Data obtained from the results of personal and aptitude assessment tests Barona provides recruitment services. Therefore, it is in our legitimate interests to match the right person with a right job.

 
 After registration to our recruitment system, we will regularly send email notifications regarding relevant open positions to our registered users and active job applicants via email. By deactivating your profile, you will no longer receive notifications about open positions from us.

These emails are clearly differentiated from any marketing emails, containing newsletters and/or marketing campaigns, for which we require your express consent. You can withdraw your consent from direct marketing at any time by unsubscribing from our list.

In order to be able to perform our recruitment tasks in a fair, transparent, non-discriminatory and the most objective way possible, we advise you to provide as much information about your skills and qualifications as possible, to the extent it is relevant for the open position you are interested in and applying for.
Please note, that if you do not provide information, which is necessary for us to consider your application, such as evidence of qualifications or work history, we may not be able to assess adequately your skills and aptitudes, and therefore we will not be able to take your application for further consideration. For example, if you are applying for a truck driver role and you fail to provide us with a copy of your driving license, which is required by law to have for this position, your profile is likely to be disregarded due to lack of evidence. Respectively, the recruitment process cannot be continued.
 

B.  Purpose of processing personal data in the context of employment relationship
 

Purpose of processing personal data	Legal basis of processing
Management of employment relationship
When we enter into an employment contract and agree on an employment relationship, we collect from you the information necessary to manage the employment relationship. These are 1) Basic information first and last name(s) personal ID number contact information (e.g. address information, e-mail address, and phone numbers) contact information of a close relative designated by the employee bank account information 2) Information related to the employment relationship, such as results of drug screening, security screening and/or personal credit information, insofar as it is necessary from the standpoint of managing the employment relationship employment contract and other possible commitments and contracts associated with the employment relationship documents related to citizenship and the right to work information that concerns the employer’s responsibilities (e.g. data related to the insuring and taxation of personnel, data related to collaborative procedures, and data concerning procedures motivated by the former, and concerning capacity to work) information concerning occupational health, such as the employee’s health status information related to work equipment (e.g. data related to computers and other mobile devices designated for the personnel member, data related to the use of these, personnel’s e-mail addresses and telephone numbers, data related to access- and ID cards and keys, and data related to other tools, protective equipment and work clothing handed over to the person) information on user licences related to work duties, and the user IDs and passwords associated with these licences information related to the provision of employment benefits information concerning termination of employment relationship (e.g. an agreement concerning the termination of the employment relationship, a work certificate, data related to retirement, exit surveys)	Consent Legitimate interest Statutory requirement
Payment of wage and other compensations	Statutory requirement Legitimate interest
information related to compensation payable on the basis of an employment relationship (wages, fringe benefits, and other means of remuneration and data related to the former, taxation, information related to employer contributions, transport invoices and reimbursements per kilometre) information related to the tracking of work hours and to absences (data obtainable from access management systems, sickness-related absences, annual leave, and other leaves or agreed-on absences)
Management of competence and performance	Consent Legitimate interest Statutory requirement
information regarding the development within person’s work duties (data related to training and to performance appraisals and other development-related discussions) information concerning employees’ ability to fulfil their work duties (e.g. information on proficiency and language skills) information related to the performance of work duties (e.g. recordings of customer service calls that are a part of a person’s work duties, documents and reports related to the ability of a given person to fulfil his/her work duties)
Communication, contact and staff events	Consent Legitimate interest
We process personal data (e.g. contact information, telephone numbers, and e-mail addresses) in our communications to our personnel concerning matters related to a given employment relationship, and when organizing staff events. We may record telephone calls to ensure the quality of the customer service. Your profiled personal data may be used to improve the efficiency of communication between us. In order for us to serve you in the best way possible, we may, for example, direct your phone calls to the customer service staff member who is, at a given moment, the best person to address the matters concerning when we were previously in contact. Profiled data will not be used for automated decision making.
Use and processing of personal data in Barona companies outside Sweden in the area of the EU	Statutory requirement
In Barona companies outside Sweden that, at a given point in time, belong to the same corporate group, the processed personal data may include (in addition to the aforementioned data) data that is required by local legislation, such as a person’s passport number, local social security number, and parents’ full names.

 

3. Sources of personal data

In principle, personal data is collected directly from you throughout the recruitment process and during your employment relationship. In certain situations, we also collect information from other, external sources with your express consent, and within the bounds permitted by law.
Barona obtains your personal data from the following sources:

• Directly from you, for example when you submit us documents, such as CVs, diplomas, or documentation that we require by the applicable labour, tax and insurance laws.
• From companies that belong to same corporate group

• From conversations with referees indicated by the job applicant, from whom we collect the following categories of data about you: full name, periods of previous employment, performance during previous employment.

• From conversations with recruiters and interviews with hiring managers and other Barona personnel or representatives, some of which may be recorded
• From professional networking websites (e.g. LinkedIn, etc.) or other social media you may have made available to us in our recruitment system;
• From background checks, as applicable. Where permitted by law, Barona may contract with a third party to perform a pre-employment background screening. The content of background check information varies by country to comply with local requirements, but may include information gathered from publicly available sources, credit reporting agencies, and criminal records databases. You will receive more information about the nature of such a background check before it begins. Where required by applicable local law, you may be asked to provide certain background check information, (which may include sensitive data) directly to Barona.
• From third-party recruiters or staffing companies: Barona does not accept unsolicited resumes from 3rd party recruitment agencies, but does sometimes use such agencies subject to a written agreement. Any resume or other candidate information submitted outside of Barona companies’ recruitment guidelines (including sending an email to any Barona employee) unless expressly indicated otherwise, will be deemed to be provided for Barona’s use, and no fee will be paid should the candidate be hired by Barona;

 

4. Automated decision-making

Processing of your personal data does not entail any automated decision-making. The term “automatic decision-making” refers to decisions made entirely automatically, without a person participating in the decision-making process. You will not be subject to decisions that will have a significant impact on your rights based solely on automated processing.
 

5. Sensitive data

Special forms of personal data, so-called “sensitive personal data” include personal data from which race or ethnic origin, political opinions, religious or philosophical conviction, trade union membership, genetic and biometric information, or information related to health status, sexual behavior and/or sexual orientation of a natural person become apparent.
At the recruitment stage, we will only process your sensitive data for strictly defined purposes and as long as we are allowed by applicable law to do so:

• We may collect data about applicant’s nationality or ethnicity, if he/she voluntarily decides to provide such information in written in their CV or elsewhere in his/her application documents, as well as in verbally throughout the recruitment process. If required for the specific role, we will only use such data to assess whether a work permit or visa will be necessary for the role. Under no circumstance we will exercise discriminatory or otherwise prohibited by law practices.
• We may use data about your disability status if the information is required for the specific role, or to consider whether we need to provide appropriate adjustments during the recruitment process.

The processing of sensitive data in the context of employment relationship is only permitted if such processing is necessary for the purposes of compliance with our obligations in the area of labour law, social security or social protection, or if you have given your express consent.

• Trade union membership: If the employee wishes, and provides written permission for it, trade union membership fees can be deducted from an employee’s wages and accounted to the employee’s trade union.
• Health data: Data concerning an employee’s health status may be processed if the data was collected from the employee him-/herself, or from elsewhere with the employee’s written consent, and the processing of the data is necessary in order to investigate sick-leave wages or benefits associated with a comparable health condition, or to investigate whether there is a justified reason for absence from work, or if the employee expressly wishes to have his/her capacity to work investigated on the basis of health status-related data.

 

6. Sharing and transfer of data

We process your personal data confidentially, and do not hand it over to third parties, except in the following cases:

• To enable efficient cooperation, your personal data is shared between the Barona companies and processed in shared recruitment system.
• To our customers: given the nature of our recruitment services, when an applicant applies to a given job offer posted on our platform, the candidate grants us permission to comprise relevant information about him/her, which we will facilitate to the respective customer.
• To third parties: personal data, related to the employment relationship, stored in our records may be handed over, in a manner permitted and/or required by legislation currently in force, to (i) law enforcement authorities, either to comply with a legal obligation or to fulfil Barona's or a third party's legitimate interest by responding to a request from such authority for e.g. investigative purposes to establish, exercise and defend legal claims, (ii) other public authorities and legal entities associated with the fulfilment of employer’s obligations that have a legally-founded right to obtain data from the records, such as the Swedish Tax Agency (Skatteverket) or the Social Insurance Institution in Sweden (Försäkringkassan) and (iii) other parties associated with the management of affairs concerning employment relationships, such as pension- and accident insurance companies, trade unions and occupational health service providers.

• Mergers and acquisitions: when corporate acquisitions or corporate reorganisations take place, the acquiring party may obtain access to essential data that may affect the transaction.

Barona uses subcontractors and service providers that have the right to process your data to the extent required by the contracted services. This means that they may not use your data for their own purposes. We contractually require them to guarantee a sufficient level of data protection, as well as to ensure the legality of the processing. All our third-party service providers and other entities in the group are required to take appropriate security measures to protect your personal data in line with our policies.
The data we collect is in part stored and processed outside the European Economic Area in cases where e.g. our service provider is located or stores data outside the European Economic Area. The service providers are contractually bound to ensure an adequate level of data protection in all processing of your personal data.
 

7.  Data security

We have appropriate technical and organizational means of data security in order to safeguard personal data from loss, misuse or other equivalent illegal access or disclosure. Such means include e.g. the use of firewalls, encryption techniques, and secure areas for IT hardware.
Access to your personal data is also internally restricted through physical and electronic access control, the granting of user licenses, and the monitoring of such licenses. Your personal data is only processed by employees who have the right to do so within the framework of their work duties, including that of confidentiality.
 

8. Data subjects rights

In this paragraph we list all the rights you count with as a data subject and explain how we exercise them efficiently.

• Right to revoke consent

If the processing of personal data is based on your consent, you have the right to revoke your consent at any time. Please note that, we may not be able to delete data, until the retention period mandated by law has expired. For instance, with regards to your employment relationship, the employer has the legal obligation to retain certain data both while your employment relationship is active as well as for a definite period of time after the relationship comes to an end.

• Right of access to data

You have the right to review, at any time, what data we have collected regarding you, or to receive confirmation that there is no personal data about you in our records.

• Right to correction

If the personal data we hold about you is erroneous, inaccurate or insufficient, you may send us a request for correction or addition.

• Right to restriction of processing

If data we hold about you, on the ground of legitimate interest, is inaccurate in some aspect, you have the right to temporarily restrict the processing of your data in its entirety. For example, until we are able to ensure the accuracy or to define the reasons for processing your personal data.

• Right to object the processing of your personal data

Additionally, you may prohibit the processing of your data for the purposes of automated decision-making, including profiling, by unsubscribing from direct marketing at any time.

• Right to be forgotten

In certain situations, you have the right to be forgotten. We will delete all data that we have collected regarding you if the personal data is no longer needed for the purposes for which it was originally collected. We will also delete the data if the processing of personal data was based on consent and you revoke your consent, or if you are opposed to the processing of your personal data, unless there are other grounds for the processing. However, with respect to data related to the employment relationship, the employer is bound by the same obligations as in the section “Right to revoke consent”.

• Right to transfer data from one system to another

You may request a transfer of your personal data, in which case we will deliver your personal data to you in machine-readable form, so that you may keep it yourself or transfer it to another data controller (e.g. to another service provider). If it is technically feasible, we will also transfer your data directly to another data controller upon your request. This is possible only in situations where we process your personal data on the basis of your consent or a contract, and it only applies to data that you yourself have submitted to us.

• Right to lodge a complaint

If after contacting us, you are not satisfied with the processing of your personal data, you have the right to lodge a complaint with your local Data Protection Authority (DPA) at any time.
If you have any questions related to your rights as a data subject or if you wish to review your data, please contact us at privacy@barona.se
 

9. Retention of data

We retain your personal data for as long as is required to fulfil the purposes specified in Section “Use and purpose of processing personal data” always within the bounds set by the applicable laws currently in force.
After you register to Barona’s recruitment system, we will retain your profile for recruitment purposes for 2 years after your candidate profile has last been active. This period allows us to exercise or defend any legal claims, for example to show that we have not discriminated candidates based on prohibited grounds and that we have conducted the recruitment process in a fair and transparent way. We encourage our candidates to keep their data up to date at all times. If you delete your profile, we will securely destroy your personal data in accordance with our data retention policy.
All data related to your employment relationship will be retained in our records for the period of time required by applicable employment, tax and insurance laws. For instance,

• Employment contracts and other documents related to the
  employment relationship and management thereof are stored 10 years after the termination of the employment
• Sick leave certificates are stored 2 years after receiving them
• Tax cards are stored until the accounts for the year in question have been closed

After the specified periods have expired, the personal data will deleted or, if this is not possible, they will be made unidentifiable, via being irreversibly modified into a form from which the individual person is no longer recognizable.
For more information about how your personal data is stored, do not hesitate to contact us.
 

10. Changes to this privacy statement

We are continually developing our data protection practices, and for this reason, we may change this data protection privacy statement from time to time. The changes may also be based on a change in legislation. We recommend that, from time to time, you revisit this page containing the data protection privacy statement in order to keep informed of any changes. If needed, we may also notify you of changes directly.
 

11. Data controller and contact information

The controller of your personal data is the Barona company that you are applying to, or the company that you are employed by:

• Barona Human Resource Services AB
• Barona Professionals AB
• Barona Teknik & Installation AB
• Finstallation AB
• Barona Contact Center AB

If you have any questions or queries regarding data protection at Barona companies, please contact us by sending an email to privacy@barona.se.