Privacy Policy for job applicants

This privacy policy describes how Custobar processes personal data of applicants who apply for jobs at Custobar. The controller for the processing described below is Custobar Oy.

1. Contact Details of the Controller

Custobar Oy (business ID 2645106-1)
Wonderland Work
Linnoitustie 6
02600 Espoo, Finland
recruitment@custobar.com
Laura Ek

2. Purposes and Legal Grounds for the Processing

The processing of personal data is based on Custobar’s legitimate interest that are linked to Custobar’s recruitment processes. In certain circumstances, the processing of personal data is also necessary for carrying out pre-contractual measures between Custobar and the selected candidate as well as for entering into an employment contract with the selected candidates.

In addition, where required by applicable legislation, Custobar may request the candidate’s consent for the collection of certain types of personal data or for the processing of certain types of personal data. Consent may be requested, for example, if a suitability assessment is carried out in connection with the recruitment process.

Personal data is processed for the purposes of receiving and handling job applications, assessing and selecting candidates for and conducting the further phases of the recruitment process. If the applicant does not wish to provide their data to Custobar, they may not be considered in the recruitment process.

3. Categories of Personal Data

The personal data of job applicants can be categorized as follows:

  1. Identification and contact information (e.g. name, email address, phone number).

  2. Application cover letter and resume/CV data (such as employment history, education, certifications, skills, language proficiency) and other application attachments.
  3. Custobar records of candidate interviews and other data that is generated during the recruitment process.
  4. Other information provided by the applicant during the recruitment process (including interviews and possible assessments).
  5. References and recommendations

4. Sources of Personal Data

The personal data processed during the recruitment process is primarily provided by the applicants themselves or created during the recruitment process. With the permission of the applicants, as required by applicable law, some data may be provided by references or other third parties, such as third-party candidate evaluations.

 

5. Data Retention

Custobar processes job applicants’ personal data during the recruitment process. After the recruitment process has ended, personal data is retained for as long as necessary for Custobar to exercise its rights and fulfil its obligations and to respond to any potential claims, however no longer than one (1) year from the date the recruitment decision is made. Open applications are retained, with the job applicant’s consent, for up to one (1) year for potential future recruitment.

6. Disclosures and Transfers of Personal Data

Custobar may disclose personal data of job applicants to service providers, such as IT providers or recruitment agencies. Where required, personal data is also disclosed to authorities.

Custobar processes personal data primarily in the European Union. However, some of our service providers operate globally and may also process some of the personal data outside the EU or reserve the right to do so if needed. In cases where processing takes place in countries not deemed to have an adequate level of data protection by the European Commission, Custobar requires the service providers to ensure a sufficient level of protection through the use of lawful transfer mechanisms, such as privacy frameworks, (e.g., the EU-US Data Privacy Framework), or standard contractual clauses approved by the European Commission and the implementation of additional safeguards, such as sufficient encryption of the processed data, or other similar measures recognized by the applicable data protection legislation.

7. Data Subject Rights

Right to withdraw consent

The data subject has the right to withdraw their consent to the processing of personal data where the processing is based on consent. Consent may be withdrawn by contacting us by email at recruitment@custobar.com.

Right of access

The data subject has the right to obtain information on what personal data relating to them has been stored. A request for access may be fulfilled once the data subject’s identity has been reliably verified.

Right to rectification

The data subject has the right to request the rectification of inaccurate, imprecise or outdated personal data relating to them. The data subject also has the right to have incomplete personal data relating to them completed.

Right to data portability

The data subject also has the right to receive, in a structured, commonly used and machine-readable format, the personal data relating to them which is processed by automated means and which is based on consent or on a contract. The data subject also has the right to have such data transmitted from one system to another.

Right to erasure

The data subject has the right to request the erasure of their personal data in the following situations:

  1. the personal data is no longer necessary for the purposes for which it was collected;

  2. the personal data has been processed unlawfully; or

  3. the personal data must be erased in order to comply with a statutory obligation.

Custobar has the right to refuse the request if the data is necessary for the exercise of rights and obligations arising from legislation.

Right to restriction of processing

The data subject has the right to request the restriction of the processing of their personal data in the following situations:

  1. the data subject contests the accuracy of the personal data, in which case the processing will be restricted for a period enabling Custobar to verify the accuracy of the personal data;
  2. the processing is unlawful and the data subject opposes the erasure of the data and requests the restriction of its use instead;
  3. the controller no longer needs the personal data for the purposes of the processing, but the data subject requires it for the establishment, exercise or defence of legal claims; or
  4. the data subject has objected to the processing of their personal data pending the verification of whether the legitimate grounds of the controller override those of the data subject.

Right to lodge a complaint with a supervisory authority

The data subject has the right to lodge a complaint with the competent supervisory authority (in Finland, the Office of the Data Protection Ombudsman) if they consider that their personal data has been processed in breach of applicable data protection legislation. The up-to-date contact details and instructions of the Office of the Data Protection Ombudsman are available at: https://tietosuoja.fi/.

Last update: 18.2.2026