Resurs recruitment privacy notice
It is highly important that privacy is respected and that personal data is processed in a satisfactory and correct manner.
The purpose of this information is, in accordance with the EU General Data Protection Regulation (“GDPR”), to provide information about the personal data processing that Resurs Bank Aktiebolag is the controller of when you apply for or are referred to a position with us, and to provide information to you if Resurs processes personal data about you (“data subject”) so that you can exercise your rights.
Who we are
Resurs Bank Aktiebolag, with corporate identity number 516401–0208 is the data controller responsible for processing your personal data. This means that it is our duty to ensure that processing is carried out securely and in accordance with applicable laws and regulations. Resurs has branches in Denmark, Finland and Norway. In case it is specifically stated that Resurs Holding AB (publ), with corporate entity number 556898-2291, is the recruiting company, this entity is the data controller. This privacy notice also applies to that processing. Independent of which branch or company that is processing your personal data, we refer the data controller as "Resurs", “we” “our” or “us” in this privacy notice.
Purposes of collected data
Resurs processes personal data when you submit a job application to us. Your personal data is processed so that we can identify suitable candidates, administer the applications and communicate with candidates, evaluating candidates and fill the position. Part of the recruitment process is also in necessary cases to conduct background checks in accordance with law.
If you choose to subscribe to e-mail notifications about new or open positions, or other career related topics with us, we will process your personal data to manage your subscription.
Resurs processes personal data also in order to fulfill legal obligations and to comply with our internal legal framework, for example avoiding unlawful discrimination.
Data may also be used by Resurs for statistical analysis to improve our application and recruitment process, marketing of new positions and opportunities within Resurs and business reporting purposes.
Collection of personal data The personal information that Resurs collects about you is handled responsibly with regard to your privacy. Resurs processes personal data that is provided directly by you when you apply for a job and throughout the job application or recruitment process. We also collect personal data when you subscribe to notifications for career related topics.
Resurs may also collect personal data that is provided via third parties such as employment agencies and recruiters, professional or academic references that you state, suppliers of background checks, publicly available sources of your professional information, such as social media profile and finally, another source of information is from employees of Resurs, in case an employee has referred you as a candidate.
Categories of personal data
The data that Resurs processes are: contact details, education, work experience, skills, other information in your CV, for example, personal identity number, publicly accessible profiles (such as LinkedIn, etc.), photos or videos provided by the candidate, log-in details and user names in recruitment systems, candidate evaluations and tests conducted in recruitment systems and all additional information provided by a candidate. If an employee of Resurs has referred a candidate, we may also process other information that comes from the employee who referred the candidate.
In the final stages of the recruitment process we perform background checks as deemed necessary for the type of roll that may be offered to you as a candidate. The background check includes for example verification of references, work permit, checks of non-payment (credit control), information in public records such as population registration, your connection to companies, such companies’ bankruptcy, vehicles registered on you, public court proceedings and criminal record, provided it is permitted under national law. ,
Legal basis for processing
Resurs has four legal bases for the processing that takes place during the recruitment process. These legal bases are: consent, entering into and performance of a contract, legitimate interest and legal obligation.
Entering into and performance of a contract
When you send in an application bases the processing of personal data in connection with an application for a position within the Resurs Group on entering into and performance of an (employment) contract.
Consent
We use consent as legal basis when you subscribe to email notifications for career related topics. If we request a reference from you, we rely on your consent on processing this data.
If you send sensitive personal data to us in a personal letter or a CV for example, this will also be processed under the legal basis consent. This data is processed in order to administer the application. However, data is processed only to the extent that the document is added to the candidate’s application documents and the data is not separately registered. Consent is the legal basis for processing personal data of a sensitive character in connection with an application for a position within the Resurs Group.
You may withdraw all or parts of the consent you have given at any time, with immediate effect. In this event, we will no longer have the right to process your personal data. However, we may be legally obligated to keep personal data for a certain period of time (such as during the period in which the candidate could potentially appeal the appointment of the position due to the recruitment process). In such a case, we may only use the data for the established legal requirement.
Legitimate interest
For cases in which you as a candidate have been contracted by us with an invitation to apply for a position, the legal basis for processing is a legitimate interest. For those cases in which we process personal data based on the legal basis of legitimate interest, we have performed an analysis (weighing of interests) and considered our legitimate interest of finding a suitable candidate against the interests of the candidates and drawn the conclusion that our interest outweighs that of the candidates. The data that you as a candidate have made public (via LinkedIn for example) is processed under the legal basis of legitimate interest. Another processing activity where legitimate interest is used as legal basis, is to conduct tests on candidates (eg. ability test and personality test). If you are asked to participate in such test, you will always receive feedback on your test results. Finally, parts of the background check will be based on our legitimate interest, such as verifying references and academic credentials.
Finally, data may also be used by Resurs for statistical analysis and business reporting purposes, based on legitimate interest.
Legal obligation
Finally, Resurs processes personal data on the grounds of legal obligation, for example, when according to law we are obligated to keep personal data for the period of time during which a candidate could potentially appeal the appointment of the position. Another example of when we use legal obligation as a basis, is some parts of the background check on final candidates. Due to being a bank, we must ensure that employees with us will help us combat fraud and economic crimes, money laundering and financing or terrorism.
Length of time personal data is stored
Resurs only stores personal data for the time necessary. For candidates who were not recruited to the position, the data is stored for a maximum of two years after the appointment decision is made, which is the same length of time that a candidate could potentially appeal the appointment of the position due to the recruitment process. For applicants in Denmark, the data is stored for a maximum of three years after the appointment decision.
If a candidate has made tests as part of the recruitment process, the test result is stored for one year.
If backgrounds checks are made, these are deleted as soon as our HR has read the contents during the application process. Information that the background control has taken place is stored for the length of your potential employment and erased one month from when your employment ends.
Data will be stored for only 30 days for those candidates who are contacted by Resurs on its own initiative and who do not consent to further processing directly in connection with such contact.
Spontaneous applications that do not relate to a specific advertised position are discarded within two months unless further contact is made with the applicant.
Processing of personal data by a party other than Resurs
Information about a candidate’s application may also be processed by parties other than Resurs. We use a processor, for example, a service provider of the recruitment system, to conduct tests and IT suppliers. The processor engaged may only process personal data in accordance with the purposes and instructions that Resurs has provided for such processing. Also, the processor and those acting on the instructions of the processor may also never access more data than what is required for performing the service as covered under the scope of the agreement with Resurs.
Resurs may also engage an external recruitment firm in connection with a recruitment process. A recruitment firm is the only controller for the processing that takes place within the firm. Accordingly, to obtain more information about how the recruitment firm processes personal data in connection with an application, you must contact the recruitment firm in question, which is always stated on the advertisement for the vacant position.
Is your personal data processed outside the EEA?
Our goal is that the processing of your personal data is always based in the European Union or within the European Economic Area (“EEA”). In some limited cases, Resurs may transfer or share your personal data with third parties such as suppliers or subcontractors, whereby limited processing activities may be based outside the EEA, for example a situation of support cases to an IT environment. In such cases, we have an obligation to ensure that the transfer takes place in accordance with applicable data protection rules before the data is transferred, by meeting one of the following conditions:
- To ensure that the country to which the data is transferred meets an adequacy level of protection. The European Commission has decided that for approved countries, the level of protection is sufficiently high according to GDPR. Via this link you can find information on the countries outside the EEA that the European Commission has decided meet adequate levels of protection for the permitted transfer of personal data.
- To use Standard Contractual Clauses (SCCs) adopted by the European Commission, which ensure that appropriate measures are taken to safeguard your rights and freedoms. You can find more information about the standard contractual clauses on the Swedish Data Protection Authority’s (“IMY”) website here.
- To use Binding Corporate Rules (BCRs). Resurs itself has not adopted any of these. BCRs must be approved by a national data protection authority of an EU member country, and these are subject to a comprehensive review by a data protection authority(s). For further information, please contact us, as set out below under “Contact details”.
- That it is otherwise permitted under data protection legislation, such as in certain special situations and individual cases. For example, it may be that suppliers have signed up to an approved code of conduct or certification mechanism, more information can be found on IMY's website here, or exceptional situations such as your explicit consent or that we exercise or defend a legal claim. For further information, please contact us as set out below under “Contact details”.
Your rights as a data subject
You have rights in relation to Resurs and how we process your personal data. Information about your rights and how you can exercise them is presented below.
We ask you to note that your rights apply to the extent they comply with applicable data protection legislation and that there may be, in some circumstances, exceptions to these rights. We also ask you to note that Resurs may require more information from you in order to, for example, confirm your identity before we proceed with your request to exercise your rights.
Right of access – register extract
You have the right to be informed that Resurs is processing personal data about you. In this case, you also have the right to request a copy of the personal data (a data subject access request), as well as further information about the data undergoing processing, such as the purpose or purposes of the processing, the specific categories of personal data and the recipient of the personal data.
A prerequisite if you are to receive a copy of your data, is that Resurs can securely identify you to ensure that unauthorised parties are not given the opportunity to access your data.
Right to rectification
You have the right to the rectification of inaccurate personal data about yourself and also to provide additional personal data if this is incomplete.
Right to object
You have the right to object to the processing of your personal data if the legal basis for processing is a legitimate interest. Resurs will then no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.
If your personal data is processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning yourself for such marketing, which includes profiling to the extent that it is related to such direct marketing.
Right to withdraw consent
You may withdraw all of some of the consent you have given at any time, with immediate effect. In case you want to redraw your consent for email subscription service, you can either do this by using the unsubscribe option in the email or contact us as stated under Contact information.
Right to restriction of processing
You have the right to request that Resurs restricts the processing of your personal data if:
- You challenge the accuracy of your data within a time limit that allows us to check the accuracy of the data we have collected;
- The processing is unlawful and you oppose that Resurs erases your personal data and instead request that processing is restricted;
- Resurs no longer needs to process the data for the original purpose it was collected, while you require the data for the establishment, exercise or defence of legal claims; and
- You have objected to the processing that Resurs carries out on the grounds of a legitimate interest, and are waiting for a decision regarding whether your objection overrides the legitimate grounds for continued processing by us or a third party.
Right to erasure (‘right to be forgotten’)
You may request that Resurs erases your personal data without delay if:
- The personal data is no longer necessary for the purposes it was originally collected or otherwise processed;
- Resurs’ processing of personal data takes place with your consent and you withdraw your consent for that specific processing;
- You object to the processing that Resurs carries out on the grounds of a legitimate interest, and your objection overrides the legitimate grounds for processing by us or a third party;
- The data has been unlawfully processed; or
- The personal data must be erased to comply with a legal obligation.
Please note that Resurs may be required to save some of your personal data due to a legal obligation, for example during the period in which a decision on a job appointment may be appealed. In such cases, Resurs may not process personal data for any reason other than to fulfil that legal requirement.
Right to data portability
If we process your personal data as part of a contract with you (or in preparation for such contract) or with your consent, you have the right to receive the personal data that you have provided us and is held electronically. You have the right to request that your personal data transferred from Resurs to another controller (the right to data portability) when this is technically feasible. We ask you to note that this right to data portability does not apply to such data that is manually processed by us. Requests and complaints
To exercise your rights to request more information about how we process your personal data, please contact us by sending an e-mail to the address provided below under “Contact information”.
You also have a right, at any time, to contact Resurs or a data protection authority to lodge a complaint about our processing of your personal data. If you believe that Resurs is processing your personal data incorrectly, we urge you to contact us in the first instance so that we can respond to your request. However, you may always lodge a complaint directly with the data protection authority in the relevant country on the following websites:
Sweden: imy.se
Denmark: datatilsynet.dk
Norway: datatilsynet.no
Finland: dvv.fi
Contact information
You can send requests, complaints or provide opinions on Resurs’ processing of personal data to the following addresses:
Resurs Bank
Box 223 54,
250 25 Helsingborg
SwedenIf you have any questions, you are welcome to contact us and our Data Protection Officer at GDPR@resurs.se.
The General Data Protection Regulation is also available on the website of the Swedish Authority for Privacy Protection: https://www.imy.se/en/.
This information was updated on 2 September 2024.
