Updated 27.04.2026
This privacy notice describes the principles PlanVera Oy (“PlanVera”) applies to the processing of data subjects’ personal data during the recruitment process. The purpose of this privacy notice is to inform the data subject about, among other things, what personal data is collected, for what purposes, and the extent to which the individuals involved in processing and any related third parties may process personal data at any given time.
1. Data Controller and Contact
PlanVera Oy
Business ID: 3551505-5
Kehäkatu 35, 70600 Kuopio, Finland
For all questions relating to the processing of personal data, and in matters relating to the exercise of your own rights, data subjects should contact the data controller in writing by emailing customer service at [email protected]
2. Name of the Personal Data File
Recruitment
3. Basis and Purposes of Personal Data Processing
Personal data collected by PlanVera during the recruitment process is processed for recruitment purposes. The processing of personal data is based on PlanVera’s legitimate interest in processing applications received by PlanVera and assessing an applicant’s suitability for the position applied for, on the data subject’s own consent, or on legislation binding on PlanVera.
PlanVera’s legitimate interest may, for example, involve assessing an applicant’s education, skills, and work experience, or their suitability for an open position. If an applicant in the recruitment process does not wish to provide the requested information, it may not be possible to continue the recruitment process. Providing certain personal data is therefore necessary in order to take part in the recruitment.
Personal data may be processed at various stages of the recruitment process, such as when processing job applications, during the interview stage, and in any potential suitability assessment. Open applications are processed in order to identify potential candidates for positions that are open or that may become open.
4. Personal Data Processed
PlanVera may process the following personal data in recruitment:
- First and last name
- Date of birth
- Phone number
- Address
- Email address
- Work experience and other skills
- Education and/or other qualifications
- Information related to personality and suitability assessment tests, e.g. answers provided by the data subject and the results of the assessment
- Job application, as well as other attachments or information submitted by the candidate
- Job interview notes, or, for example, email correspondence during the recruitment process
- Information collected through cookies or other similar technologies used in the recruitment system or on the website (IP address, cookie data)
- Credit information, where required by the nature of the position and where permitted by law, for the purpose of assessing the candidate’s reliability (significant financial responsibility or positions of trust)
Data is primarily collected from the applicant themselves. In addition, depending on the situation, data may also be collected on the basis of PlanVera’s legitimate interest, statutory obligations, or the applicant’s consent from other approved sources, such as authorities, potential references, or the party carrying out a suitability assessment, as well as from public websites linked to by the applicant in their application (such as LinkedIn). If a person is recruited for a position, other data not mentioned above may also be collected in order to fulfil PlanVera’s statutory obligations as an employer.
5. Security of Processing and Principles of Protection
The data controller is responsible for ensuring that stored data is processed in accordance with good data security practices and the instructions issued by the data controller.
The systems PlanVera uses in recruitment are browser-based and have appropriate technical protection mechanisms as well as access control restricted on a need-to-know basis. Data collected during recruitment is generally processed electronically within the systems, and any paper printouts are stored in locked facilities. Personnel involved in the processing of personal data are given guidance and training in the processing of personal data.
6. Recipients of Personal Data and Regular Disclosures and Transfers of Data Outside the EU or EEA
During the recruitment process, an applicant’s personal data is processed by the recruiting managers, as well as by PlanVera’s HR representatives involved in the recruitment for the position in question.
If a position involves the use of, for example, a suitability assessment or testing, the candidate’s data may also be disclosed, with consent, to service providers selected by PlanVera. As a rule, PlanVera does not disclose data outside the European Union or the European Economic Area. However, data may be transferred outside the EU or EEA, for example, in cases where a person involved in recruitment on behalf of the data controller is located outside the EU or EEA.
7. Use of Artificial Intelligence
PlanVera may use artificial intelligence in the initial processing of applications. After this, a human reviews the applications and decides whether to move the application forward to the next stage of the recruitment process. Artificial intelligence does not make recruitment decisions.
If artificial intelligence is used in the recruitment process, the applicant will be asked for their consent to this in connection with the application. As an applicant, you may also choose not to take part in the AI-assisted process, in which case your application will be processed entirely using traditional methods by the people handling the recruitment. This choice will not negatively affect the applicant’s chances of being employed by PlanVera.
8. Retention Periods
As a rule, PlanVera retains personal data collected during recruitment for 12 months from the date the recruitment decision is made, unless deletion of the data is requested earlier. However, we retain data for longer if this is necessary to establish or defend against potential legal claims relating to the recruitment process. Data may be processed for even longer, for example, in situations where the data subject has been selected to join the organization as an employee or substitute. In such cases, recruitment-related data is transferred into the HR records and is retained during the employment relationship and thereafter for the period required by law (e.g. the Accounting Act, the Employment Contracts Act). Open applications are retained for one year from the date of submission, unless the applicant requests earlier deletion of their data.
9. Rights of the Data Subject
Unless otherwise provided by data protection legislation, the data subject has:
Right of access (right to access personal data)
The data subject has the right to know whether or not their personal data is being processed, and what personal data about them has been stored.
Right to rectification
The data subject has the right to request that incorrect, inaccurate, or incomplete personal data concerning them be corrected or completed without undue delay. In addition, the data subject has the right to request the deletion of unnecessary personal data.
Right to erasure
The data subject has the right to request the deletion of personal data concerning them if:
a. the personal data is no longer necessary for the purposes for which it was collected;
b. the data subject withdraws the consent on which the processing of personal data was based, and there is no other legal basis for the processing; or
c. the personal data has been processed unlawfully.
Right to restriction of processing
In certain situations, the data subject has the right to request that the processing of their personal data be restricted for as long as it takes for their data to be properly verified and corrected or completed.
The data subject has the right to restrict the processing of personal data concerning them if:
a. the data subject contests the accuracy of their personal data;
b. the processing is unlawful, and the data subject opposes the deletion of their personal data and instead requests the restriction of its use; or
c. the data controller no longer needs the personal data for the original purposes of processing, but the data subject needs it to establish, exercise, or defend a legal claim.
Right to object
In certain situations, based on their particular personal circumstances, the data subject has the right to object to the processing of their personal data at any time.
Right to data portability
In certain situations, the data subject has the right to receive the personal data concerning them, which they have provided to the data controller, in a structured, commonly used, and machine-readable format, and the right to transfer that data to another data controller.
Right to lodge a complaint with a supervisory authority
The data subject also has the right to lodge a complaint with the national supervisory authority. The website of the Data Protection Ombudsman is www.tietosuoja.fi.
10. Changes to Privacy Practices
The data controller continuously develops its operations and may therefore need to change and update its privacy practices as necessary. Changes may also be based on amendments to data protection legislation.
If any changes involve new purposes for the processing of personal data or otherwise change significantly, the data controller will request consent where necessary.