Privacy notice - Job applicants

We collect and process various types of personal data, such as:

• Personal details: including your contact details (such as your name, address, phone number, and email address)
• Recruitment information: such as your application and resume, interview information, video interviews, references from previous employers and other third-party references, information about your competencies, qualifications, skills, work experience, and education. As we take steps prior to entering into a possible employment contract, we may also collect results of the necessary health, drug, background, psychometric, and aptitude tests and credit checks depending on the position for which you are applying, and where necessary for the recruitment activities. In these cases you will always be informed about such activities in advance. In final stages of recruitment we also collect demographic data, such as your gender, age, language and citizenship.
• Identification information: such as proof of identity and your national identity number.
• Online data & identifiers: data that is collected with cookies or similar technologies about your use of services, including your IP address, cookie ID and mobile device ID.
• Security and IT service management data – data that is used for securing the use of our services and our premises, such as your password and login details, security and IT logs, facility entry logs, and camera surveillance recordings (CCTV).

The personal data which we process about you comes from different sources:

• You: when you create an account in our recruitment portal, submit us your application or resume or when you otherwise interact with us.
• Third parties: such as recruitment agencies, assessment agencies, your references and previous employers, medical or health check providers and authorities or other parties providing background and credit checks. We will obtain your consent for such collection when required by applicable law.
• Fortum Group companies: which share information for purposes mentioned in this notice.

We will use your personal data for predefined purposes based on legitimate interest and legal obligation. Also, we may use your personal data based on your consent in addition to reliance on a legitimate interest (this especially if additional consents are needed under applicable law).

The main purposes for which we process personal data are listed below:

• Recruitment and resourcing: We use your personal data to contact you, for instance, to inform you about the status of your application or to obtain additional information. We also use your personal data to set up and conduct interviews and assessments, evaluations, reference, credit and background checks as permitted by applicable law.
• Contact and inform you regarding a different position that you applied for, in case you gave us permission to be contacted for this reason. 
• Creating an employee record: If Fortum hires you, the personal data you have given during the application process may become part of your employee record and be used to manage your career at Fortum.
• Service development and analytics: We may use your personal data to improve and develop our recruitment processes and other related services, and to create analytics. We endeavour to use de-identified data when possible.
• Security of our services and others: Personal data is used for ensuring the information security of our services, for example, by keeping access logs and system backups, authenticating users, and preventing attacks.
• Legal obligations: We process personal data to comply with our legal obligations, for example, accounting and tax laws.

If we use automated decision-making with legal or similarly significant effects on you, we will inform you in advance. If such automated decision-making is not authorized by legislation or necessary for the performance or entering into a contract, we will ask for your consent. 

You can always express your opinion or contest a decision based solely on automated processing, as well as request a manual decision making process instead by contacting us using the contact details provided below.

We delete or de-identify personal data when it is no longer necessary for the defined purposes. If we hire you, your personal data may become part of your employee record. Your personal data will not be kept for longer than two years from your application, unless you are selected for the vacancy, or unless you have consented to the extended use of your application for new vacancies.

You can also delete your candidate account or withdraw your application any time by going to your application profile or by contacting People Services.

Your personal data may be accessed by our data processing subcontractors or by other third parties as described below to the extent permitted by applicable law.

Data processors – We use data processing subcontractors to provide us services. Such subcontractors may have access to your personal information and process it on our behalf. We ensure that the processing of personal data by our subcontractors is done in accordance with this notice through appropriate contractual arrangements. Typical service providers that process personal data include for example recruitment agencies and IT software & service providers. 

Where applicable, we may share your personal data with other data controllers based on our legitimate interest, our contract with you, or our legal obligations, including:

Fortum Group companies -  Our Group companies may use your personal data for the purposes defined in this notice. Your job application may be used for recruitment purposes by other Fortum companies only in case you have given a consent for this.

Commercial partners, subcontractors and other authorized third parties – We may share your personal data with authorized third parties who process personal data for Fortum for the purposes described in this notice when necessary for the recruitment process. These may include recruitment consultants, test assessment providers, and others who help us fill vacancies and assess the suitability of job applicants. These authorized third parties are not permitted to use the personal data you submit to Fortum for any other purposes than the recruitment process. 

Authorities, legal proceedings and law -– We will disclose your data to certain competent authorities, such as government agencies responsible for statistical information, or to the police other law enforcement agencies, if required by law. We may also disclose your personal data in connection with legal proceedings, a court order, a trial, or an authority process, or as otherwise required or permitted by law. 

Fortum is a global company that has affiliates, business processes, management structures and technical systems that cross national borders. This means that your data may be transferred to countries other than the one where you are employed by Fortum, including also outside of the European Economic Area. We rely on appropriate safeguards, such as the European Commission’s adequacy decisions and the EU-US Data Privacy Framework or standard contractual clauses issued by the European Commission, to protect your data when transferring it. You can obtain more information about the international transfers by using the contact details listed below.

We employ appropriate organizational and technical security measures to protect your data from loss or misuse. We have a cybersecurity governance model which describes roles and responsibilities on the group level, and our instructions give detailed information on how personal data must be handled within our Group. By conducting awareness programs, we engage our employees in privacy and security considerations. Where we contract with third-party suppliers to provide services that may enable them to access your personal data we require them by contract to have similar security controls in place.

When you use our digital services or visit our websites, Fortum can collect data about your devices using cookies and other similar technologies. Our websites and applications may use cookies and other similar technologies set by third parties. You can get more information about how to manage cookies and online data use by reading our cookie and online data policy.

You have the following rights regarding personal data that Fortum processes about you.  If you have any questions about your rights or want to exercise them, please contact our People function. Please note that some rights may not be applicable for example if the data cannot be connected to you.

•            Right to access personal data – You have the right to be informed about the processing that we do and to request a copy of your personal data.

•            Right to correct personal data – You can ask information about you to be corrected if it is not accurate or needs to be updated.

•            Right to data portability – You are able to take with you the personal data you provided to us. A selected set of the data is delivered in a machine-readable format, where the basis of processing has been consent.

•            Right to deletion – We will delete the data at your request if it is no longer legitimately needed.

•            Right to withdraw your consent – If you have given consent for data processing, you are always entitled to withdraw your consent.

•            Right to object to the processing – You have the right to object to the processing of your personal data on Fortum’s legitimate interests such as developing of our recruitment process.

•            Right to restrict the processing – In certain circumstances, you have the right to have the processing restricted.

In specific circumstances, there are limitations to these rights. If we do not take action in accordance with your request, we will inform you of the reasons. If you are not satisfied with our response or with the way we handle personal data, please let us know. You can also always contact your national data protection authority. 

Fortum reserves the right to amend this Privacy Notice. Possible amendments to the Privacy Notice will be notified on this site, or by communicating directly to you. 

Fortum has appointed a Data Protection Officer, whom you may contact by using the contact details given in this chapter.

The data controller who is responsible for your data is Fortum Corporation and the company for which you are applying for work. If you want to exercise your rights or have any queries about the processing of your personal data, kindly contact People Services.

You can address any further questions and comments regarding your privacy to our dedicated privacy team by using the privacy contact form, or in writing to the address below: 

Fortum Corporation
Privacy
Keilalahdentie 2-4, 02150 Espoo 
Finland

You may also contact Fortum’s Data Protection Officer through the channels provided above.