The purpose of this privacy policy is to provide you with information about the processing of your recruitment-related data at Columbia Road. The information is provided pursuant to Articles 13 and 14 under the General Data Protection Regulation (GDPR), but we want to give you an even better and more detailed view than what is required. Please note that this document is subject to change and may be updated from time to time.
 
This privacy policy explains how we process your data if you are applying or have applied for a job at Columbia Road. For other situations, please see Columbia Road’s General Privacy Policy.

We are always committed to protecting your privacy as described in this privacy notice.

Who are we and how can you contact us?

Recruitment-related personal data is controlled by Columbia Road. If you have any questions in relation to recruitment data or privacy at Columbia Road, you can send an email to recruitment@columbiaroad.com.

What data do we process and why?

We collect and process your data to evaluate you as an applicant and to make recruitment-related decisions. The processing is based on Columbia Road’s legitimate interest - we evaluate the possibility of hiring you for one of our open job positions, or any possible job positions if you have sent us an open application. 

Data provided by you:

• Name
• Contact details (email, phone number)
• Your CV, Cover Letter and other attachments, which may among other contain information on education, work experience and skills
• Profile links (LinkedIn, GitHub, portfolio)
• Information on how you found the position or Columbia Road
• Possible requests for special accommodations during the recruitment process
• Any other information provided by you
• Applied position(s)
• Possible consent to use your application for other positions

Data collected by Columbia Road recruitment:

• Internal notes related to the recruitment process
• Recommendations and evaluations by the possible references you shared with us
• The source which your application was sent
• Messaging between Columbia Road recruitment and you
• Your LinkedIn profile, in case you were approached by Columbia Road on the platform and have allowed the export and/or download of your profile in your LinkedIn settings. This transfer is done manually only.

We may also contact you based on a recommendation by a Columbia Road employee. In such a case, we process your details to preliminarily evaluate your fit to Columbia Road and to contact you. Possible further processing will be based on the information given or referenced by you.

In addition to the above, we may also ask for additional information about you in the application form or surveys for statistical purposes. Such information is not connected to your candidate profile, and you will not be identified from such additional information.

Who processes your data?

Your data is processed by Columbia Road. We may also use external recruitment experts and consultants in the recruitment process. As a main rule, the personal data we collect is processed only within the European Union. However, in some cases, personal data might be transferred outside the EU to the United States, but only if necessary for the purposes set out in this Privacy Policy, and always in accordance with applicable laws and legal requirements. 

The United States does not have the same data protection laws as the EU, and there might therefore be some risks that are not present in the EU. Due to this, possible transfers of personal data are made pursuant to appropriate safeguards, such as standard data protection clauses adopted by the European Commission, in order to ensure a high level of data protection. We also ensure compliance with applicable data protection laws and a high level of data protection with other measures, such as contractual and technical measures. Other than this, we will not process your personal data outside the EU. 

If you would like to have further information regarding this, please contact us at the email address provided above.

We use the following service providers for processing recruitment data:

• Teamtailor
  • Purpose: Applicant tracking system 
  • Location: EU
  • Read more: Teamtailor trust center 
• HiBob
  • Purpose: HR operating system used if we offer you a position
  • Location: EU
  • Read more: Privacy policy at HiBob
• Google Workplace
  • Purpose: Email accounts, calendar management, and surveys
  • Location: EU and US
  • Read more: Google Cloud & the General Data Protection Regulation
• LinkedIn Recruiter
  • Purpose: Finding suitable candidates and identifying existing candidates in our applicant tracking system through system integration
  • Location: EU, EEA, US, UK and Switzerland
  • Read more: LinkedIn Privacy Policy

How long do we keep your data?

Your application and interview details are stored for 36 months. We store the data:

• to assess you for the specific position you have applied for,
• to assess you for possible future positions that you may apply for,
• to consider you for future roles that might suit your profile, and
• to contact you about new possibilities at Columbia Road.

The storage time can be extended if a new activity (e.g., messages between the candidate and Columbia Road) has taken place within the past 3 months. 

What are your rights?

You can at any time ask us:

• to confirm if we process any personal data related to you and to deliver an electronic copy of such data,
• to correct any inaccurate personal data related to you,
• to erase any personal data related to you,
• to restrict our processing of any personal data related to you.

You can also request that we do not contact you for future opportunities, even if you wish us to retain your personal data.

You can make requests by sending a message to the email mentioned at the beginning of this privacy policy.

What if I want to file a complaint?

If you disagree with our decision in relation to your request or you think your rights have not been respected, you can always contact us. You can also file a complaint with your local data protection authority:

• Finland: Tietosuojavaltuutettu (Data Protection Ombudsman)
• Sweden: Integritetsskyddsmyndigheten (Swedish Authority for Privacy Protection)

What information is required, and what if I don’t provide it?

You must always give the information marked as “required” in the application form. Required information includes name, email address, and documentation of your professional skills and experience. If you do not give the required information, we cannot, unfortunately, accept your application.