Policy regarding the processing of personal data for recruitment at Resurs Bank

It is highly important that privacy is respected and that personal data is processed in a satisfactory and correct manner.

The purpose of this information is, in accordance with the EU General Data Protection Regulation (“GDPR”), to provide information about the personal data processing that Resurs Bank Aktiebolag is the controller of when you apply for or are referred to a position with us, and to provide information to you if Resurs Bank processes personal data about you (“data subject”) so that you can exercise your rights.

Controller and purpose of processing

Resurs Bank, Corporate Identity Number 516401–0208, is the controller responsible for processing your personal data. This means that it is our duty to ensure that processing is carried out securely and in accordance with applicable laws and regulations. Resurs Bank processes personal data when you submit a job application to us. Your personal data is processed so that Resurs Bank can identify suitable candidates, administer the applications and fill the position. Resurs Bank also has branches in Denmark, Finland and Norway. Data may also be used by Resurs Bank for statistical analysis, marketing and business reporting purposes.

Categories of processed personal data

The data that Resurs Bank processes are: contact details, education, work experience, skills, other information in your CV, for example, personal identity number, publicly accessible profiles (such as LinkedIn, etc.), photos or videos provided by the candidate, log-in details and user names in recruitment systems, candidate evaluations conducted in recruitment systems and all additional information provided by a candidate. If an employee of Resurs Bank has referred a candidate, we may also process other information that comes from the employee who referred the candidate.

Resurs Bank performs background checks (such as contacting the candidate’s former employer), various tests based on the position in question, such as personality tests and possibly a check of any record of non-payment and criminal record, provided it is permitted under national law, as the final stage of the recruitment process. This background control includes processing additional information deemed to be relevant to the roll that may be offered to the candidate. The candidate’s contact person at Resurs Bank will inform the candidate about the specific nature of any such background control.

Legal basis for processing

Resurs Bank has four legal bases for the processing that takes place during the recruitment process. These legal bases are: consent, entering into and performance of a contract, legitimate interest and legal obligation.

Consent

Sometimes sensitive personal data is sent to Resurs Bank in a personal letter or a CV for example. This data is processed in order to administer the application. However, data is processed only to the extent that the document is added to the candidate’s application documents and the data is not separately registered. The legal basis for processing personal data in connection with an application for a position within the Resurs Bank Group is consent. You may withdraw all of some of the consent you have given at any time, with immediate effect. In this event, Resurs Bank will no longer have the right to process your personal data. However, Resurs Bank may be legally obligated to keep personal data for a certain period of time (such as during the period in which the candidate could potentially appeal the appointment of the position due to the recruitment process). In such a case, Resurs Bank may only use the data for the established legal requirement.

Entering into and performance of a contract

Resurs Bank also bases the processing of personal data in connection with an application for a position within the Resurs Bank Group on entering into and performance of an (employment) contract.

Legitimate interest

For cases in which candidates have been contracted by Resurs Bank with an invitation to apply for a position, the legal basis for processing is a legitimate interest. For those cases in which Resurs Bank processes personal data based on the legal basis of legitimate interest, we have performed an analysis (weighing of interests) and considered our legitimate interest of finding a suitable candidate against the interests of the candidates and drawn the conclusion that our interest outweighs that of the candidates. Only the data that the candidates themselves have made public (via LinkedIn for example) is processed under the legal basis of legitimate interest. Data that may also be used by Resurs Bank for statistical analysis, marketing and business reporting purposes takes place based on the grounds of legitimate interest.

Legal obligation

Finally, Resurs Bank processes personal data on the grounds of legal obligation, for example, when according to law we are obligated to keep personal data for the period of time during which a candidate could potentially appeal the appointment of the position due to the recruitment process.

Length of time personal data is stored

Resurs Bank only stores personal data for the time necessary. For candidates who were not recruited to the position, the data is stored for a maximum of two years after the appointment decision is made, which is the same length of time that a candidate could potentially appeal the appointment of the position due to the recruitment process. For applicants in Denmark, the data is stored for a maximum of three years after the appointment decision.

Data will be stored for only 30 days for those candidates who are contacted by Resurs Bank on its own initiative and who do not consent to further processing directly in connection with such contact.

Spontaneous applications that do not relate to a specific advertised position are discarded within two months unless further contact is made with the applicant.

Processing of personal data by a party other than Resurs Bank

Information about a candidate’s application may also be processed by parties other than Resurs Bank. We use a processor, for example, a service provider of the recruitment system and IT suppliers. The processor engaged may only process personal data in accordance with the purposes and instructions that Resurs Bank has provided for such processing. Also, the processor and those acting on the instructions of the processor may also never access more data than what is required for performing the service as covered under the scope of the agreement with Resurs Bank.

Resurs Bank may also engage an external recruitment firm in connection with a recruitment process. A recruitment firm is the only controller for the processing that takes place within the firm. Accordingly, to obtain more information about how the recruitment firm processes personal data in connection with an application, you must contact the recruitment firm in question, which is always stated on the advertisement for the vacant position.

Your rights as a data subject

You have several rights as a data subject. If you are registered with Resurs Bank and want to exercise your rights or have questions about the processing of your personal data, please contact GDPR@resurs.se.

Right of access – register extract

You have the right to receive information about Resurs Bank’s processing of your personal data and in such a case receive a copy of such information, known as a register extract. A prerequisite if you are to receive a register extract is that Resurs Bank can securely identify you to ensure that unauthorised parties are not given the opportunity to access your data.

Right to rectification

You have the right to the rectification of inaccurate personal data about yourself and also to provide additional personal data if this is incomplete.

Right to object

You have the right to object to the processing of your personal data if the legal basis for processing is a legitimate interest. Resurs Bank will then no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

If your personal data is processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning yourself for such marketing, which includes profiling to the extent that it is related to such direct marketing.

Right to withdraw consent

You may withdraw all of some of the consent you have given at any time, with immediate effect.

Right to restriction of processing

Under certain conditions, you have the right to request that the processing of your personal data be restricted. For example, if you believe that the data about you is incorrect and you have requested rectification of such data, you can request that we restrict our processing while the matter is being investigated. This could be, for example, incorrect contact details and you request that you not be contacted while the matter is being investigated.

Right to erasure (‘right to be forgotten’)

In certain cases, you can have your personal data erased. However, Resurs Bank is unable to erase your data when Resurs Bank is, according to law, obliged to save some of your personal data (such as during the period in which a decision on a job appointment may be appealed). In such cases, Resurs Bank may not process personal data for any reason other than to fulfil legal requirements.

Right to data portability

If you have given consent or if Resurs Bank bases processing on entering into, or performance of, a contract with you, you have the right to receive an electronic copy of your personal data that we process electronically. You can also request that the personal data is transmitted to another controller, where technically feasible. Such a request for data portability can be made in the same way as for a request for a register extract.

Right to lodge a complaint

If you have any complaint regarding our processing of your personal data, you have the right to lodge a complaint with the data protection authority in the relevant country on the following websites:

Sweden: imy.se

Denmark: datatilsynet.dk

Norway: datatilsynet.no

Finland: dvv.fi

Contact information

You can provide opinions on Resurs Bank’s processing of personal data at the following address or e-mail:

Resurs Bank

Box 22209

SE-250 24 Helsingborg, Sweden

If you have any questions, you are welcome to contact us and our Data Protection Officer at GDPR@resurs.se.

The General Data Protection Regulation is also available on the website of the Swedish Authority for Privacy Protection: https://www.imy.se/en/.

This information was most recently updated on 30 March 2022.