Privacy statement - Teamtailor
For the individual being processed through Teamtailor
At Autorola Group we manage our employer branding and recruitment process through our Career site (the “Career Site”), and by using a related applicant tracking system.
This privacy statement is meant to inform you, the “data subject”, how we process your personal data that we collect when you use our Career Site. Protection of your personal data is important for us and we encourage you to read this privacy statement.
Your personal data is protected by law through the General Data Protection Regulation (REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation).
We may amend this statement from time to time. We encourage you to review this statement periodically, as changes will be posted on this page.
Application of the privacy statement
This privacy statement applies to you, the data subject, if:
1. You visit our Career Site (“Visitor”)
2. You connect with us via our Career Site, to create a profile with us and receive information about current or future vacancies with us (“Connecting Candidate”)
3. You apply for a position with us, via our Career Site or a third-party service (”Applying Candidate”)
4. We collect information about you from other parties, sites and services, since we believe your profile is of interest for our current or future vacancies (“Sourced Candidate”)
5. We receive information about you from our employees or partners, since they believe your profile is of interest for our current or future vacancies (“Referred Candidate”)
6. We receive information about you from a Candidate, who lists you as their reference (“Reference”).
When we use the term “Candidate” in this privacy statement, we are referring to each of Connecting Candidates; Applying Candidates; Sourced Candidates; and Referred Candidates, unless it is stated otherwise.
Purpose and legal bases of personal data processing
Our purpose of processing your personal data is for the recruitment of candidates for positions at Autorola A/S and we strive to only process personal data that are necessary for the purpose.
Legal bases of the processing of personal data
To be able to process your personal data lawfully for the purpose described in this privacy statement, we must have legal bases justified under the GDPR.
Legitimate interest
Our processing of the personal data is based on legitimate interest described in Article 6(1)(f) of the EU General Data Protection Regulation.
We have a legitimate interest in being able to recruit suitable candidates with the relevant competencies for our positions.
Consent
There may be specific circumstances when the processing is performed based on your consent described in Article 6(1)(a) and Article 7 of the EU General Data Protection Regulation.
We need your consent if we propose to record an interview with you or when we want to keep your CV for an extended period. You have the right to withdraw your consent at any time.
Data processing roles
For the processing of your personal data for recruitment purposes, Autorola A/S is the data controller and Teamtailor is acting as the data processor by providing us the Career site.
The data controller:
Autorola A/S
Skibhusvej 52A
5000 Odense C
Tel: +45 70 20 16 61
Email: gdpr@autorola.com
The data processor:
Teamtailor AB
Östgötagatan 16
116 21 Stockholm
Sweden
The supervisory authority of protection of personal data:
Datatilsynet
Carl Jacobsens Vej 35
2500 Valby
Tel: +45 33 19 32 00
Email: dt@datatilsynet.dk
Data origin and categories of personal data
Most of the information we process about you, we receive directly from you, for example when you apply for a position with us or connect with us. You can always choose not to provide us with certain information. However, some personal data is necessary in order for us to process your application or provide you with the information you request to get from us.
Below is the overview of the data processing for each data subject:
All candidates & visitors
Purpose of processing
To collect information on career site usage, to analyze career site usage and performance and to maintain, develop, test, and ensure security.
Data origin: Visit on career site
Categories of Personal Data: Device information; Technical and statistical data such as:
· IP address
· Browser type and version
· Session behavior
· Traffic source
· Screen resolution
· Preferred language
· Geographic location
· Operating system
· Device settings/usage
· Activity on the site
Retention:
· Visitors: 1 year
· Candidates: As long as needed to consider you for relevant vacancies and future job openings.
Connecting Candidates and Applying Candidates
Purpose of processing
To review profiles and applications, to provide updates about vacancies, to contact about specific, future vacancies, to record interviews and participation in surveys.
Data origin: Upon registration and communication
Categories of Personal Data:
Contact details: Name, Email address, telephone number, physical address
Communications data:
· Education
· Work history
· Recommendations & references
· Content of Emails
· Video recordings
· Messages on social media
· Information you add to your account
· Surveys & assessments
· Interviews
· Salary requirements
Retention:
· Connecting candidates: As long as you remain connected with us
· Applying candidates: As long as needed to consider you for relevant vacancies and future job openings
Sourced Candidates
Purpose of processing: To collect and evaluate professional profiles
Data origin: Public sources (LinkedIn, websites)
Categories of Personal Data:
Contact details: Name, Email address, telephone number, physical address
Communications data:
· Education
· Work history
· Recommendations & references
· Content of Emails
· Video recordings
· Messages on social media
· Information you add to your account
· Surveys & assessments
· Interviews
· Salary requirements
Retention: As long as needed to consider you for relevant vacancies and future job openings.
Referred Candidates
Purpose of processing: To collect and evaluate professional profiles
Data origin: Referral by recruitment service providers ot partners
Categories of Personal Data:
Contact details: Name, Email address, telephone number, physical address
Communications data:
· Education
· Work history
· Recommendations & references
· Content of Emails
· Video recordings
· Messages on social media
· Information you add to your account
· Surveys & assessments
· Interviews
· Salary requirements
Retention: As long as needed to consider you for relevant vacancies and future job openings.
References
Purpose of processing: To gather information about a candidate
Data origin: Candidates
Categories of Personal Data: Contact details such as name, Email address and telephone number
Retention: Same duration as the Candidate's data for whom you acted as a reference.
Individuals affected by legal issues
Purpose of processing: To protect and enforce rights and interests
Categories of Personal Data: May include:
Contact details: Name, Email address, telephone number, physical address
Communications data:
· Education
· Work history
· Recommendations & references
· Content of Emails
· Video recordings
· Messages on social media
· Information you add to your account
· Surveys & assessments
· Interviews
· Salary requirements
Retention: Until the relevant legal issue has been fully and finally resolved.
How we may share data
Our service providers
We share your personal data with our suppliers who provide services and functionality in our employer branding- and recruitment process. For example, this includes recruitment service providers and the supplier of our Career Site and related applicant tracking system.
Use of AI in recruitment processes
Our recruitment system, Teamtailor, features AI elements to aid in optimizing recruitment processes. The AI features are provided through ChatGPT by Open AI, and they are opt-in features. We have ensured that your data is stored within the EU, and OpenAI does not perform any training of the AI mode based on your data.
At Autorola Group, we have chosen to activate the AI features; resume summary and suggestion of suitable candidates from the talent pool for specific positions. These features do not perform automated decision-making or profiling, and the decisions of selecting suitable candidates are always made by our recruitment and HR employees.
Our group companies
We share your personal data with our group companies, when they provide us services and functionality to our employer branding- and recruitment process, such as access to particular systems and software.
Companies providing cookies on the Career Site
If you consent to it, cookies are set by other companies than us, who will use the data collected by these cookies in accordance with their own privacy policy. You can find information about which cookies this applies to in our Cookie Policy.
To authorities and other public actors - when we are ordered to do so
We will share your personal data with authorities and other public actors when we have a legal obligation to do so.
To parties involved in legal proceedings
If needed to protect or defend our rights, we share your personal data with public authorities or with other parties involved in a potential or existing legal proceeding. This can for example be in case of discrimination claims.
Mergers and acquisitions etc.
In connection with a potential merger, sale of company assets, financing, or acquisition of all or part of our business to another company, we may share your personal data to other parties involved in the process.
Transfer of personal data
We always strive to process your personal data within the EU/EEA area.
However, some of our service providers process your personal data outside of the EU/EEA. We also use suppliers whose parent company, or whose subcontractor’s parent company, is based outside the EU/EEA. In these cases, we have taken into account the risk that the personal data may be disclosed to countries outside the EU/EEA, for example because of an authority request.
In cases where another recipient of your personal data is based outside the EU/EEA, this will also mean that your personal data is transferred outside the EU/EEA.
When we, or one of our suppliers, transfer your personal data outside the EU/EEA, we will ensure that a safeguard recognized by the GDPR is used to enable the transfer. We use the following safeguards:
· A decision by the EU Commission that the country outside of the EU/EEA to which your personal data is transferred has an adequate level of protection, which corresponds to the level of protection afforded by the GDPR. In particular, we rely on the EU Commission’s adequacy decision for the US via the EU-US Data Privacy Framework.
· Entering into the EU Commission’s standard clauses with the recipient of the personal data outside the EU/EEA. This means that the recipient guarantees that the level of protection for your personal data afforded by the GDPR still applies, and that your rights are still protected.
When your personal data is transferred outside the EU/EEA, we also implement appropriate technical and organizational safeguards, to protect the personal data in case of a disclosure. Exactly which protective measures we implement depends on what is technically feasible, and sufficiently effective, for the particular transfer.
If you want more information about the cases in which your personal data is transferred outside the EU/EEA you can contact us using the contact details below.
Your rights
As described below, some of the rights only come into play when we process your personal data under a particular legal basis.
If you want to exercise any of the rights listed here, we suggest that you:
· Visit the Data & Privacy page on our Career Site, where we offer features to let you exercise your rights;
· Log in to your account with us, where you can use the settings in the account to exercise your rights; or
· If you have questions to this privacy statement, please contact our Group GDPR Compliance Manager at gdpr@autorola.com.
Below is an overview of your rights:
Right to erasure ('right to be forgotten')
What it means: Autorola will delete or anonymize your personal data when requested. The deletion of your personal data will be done as soon as possible within one month of receiving your request.
Exceptions: Autorola is only obligated to delete your data if we are not obligated by law to keep the data or one of the following applies;
1. personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
2. you withdraw the consent given for the collection and processing, and where there is no other legal ground for the processing;
3. your personal data has been unlawfully processed;
4. your personal data must be erased in compliance with a legal obligation in law to which Autorola is subject.
Right to restriction of processing
What it means: If you believe that the personal data we process about you is inaccurate, that our processing is unlawful, or that we don’t need the information for a specific purpose, you have the right to request that we restrict the processing of such personal data. When our processing of your personal data is restricted, we will (with the exception of storage) only process the data with your consent or for the establishment, exercise or defense of legal claims, to protect the rights of another natural or legal person, or for reasons relating to an important public interest.
Exceptions: Autorola is only obligated to stop processing your data while one of the following applies;
1. the accuracy of the personal data is contested by you, for a period enabling Autorola to verify the accuracy of the personal data;
2. the processing is unlawful, and you oppose the erasure of the personal data and request the restriction of their use instead;
3. Autorola no longer needs personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defense of legal claims;
4. you have informed Autorola of infringement on your interests, rights and freedom, pending the verification whether the legitimate interests of Autorola override yours.
Right to rectification
What it means: If you find that we have incorrect personal data, let us know and we will correct the data.
Right of access by the data subject
What it means: It is your right to have a copy of the personal data Autorola has on you.
We may ask for identity verification to ensure that we deliver the data to the right recipient.
We will provide it digitally unless requested otherwise, and the copy of your personal data will be delivered as soon as possible within one month of receiving your request.
Exceptions: Autorola may not be able to accommodate the request in following cases:
1. Disproportionate Effort:
If providing access is too burdensome, especially for archival, research, or statistical purposes.
2. Confidentiality Obligations: When data must remain confidential due to professional secrecy laws.
3. Legal Requirements:
If laws prevent disclosure to protect legitimate interests.
4. Repeated Requests: If the request is unfounded, excessive, or repetitive, it can be refused or charged for.
Right to objection
What it means: You have the right to object to any processing where you believe your rights are being violated or there is a threat to your freedom.
Exceptions: Autorola can continue to process your personal data where one of the following applies:
1. Autorola demonstrates compelling legitimate grounds for continued processing.
2. Autorola must process your personal data to establish, exercise or defend a legal claim.
3. The legal basis for the processing is not based on a legitimate interest or done in public interest.
Right to raise a complaint
If you have complaints about our processing of your personal data, you can raise a complaint with the data protection authority in Denmark, Datatilsynet, on +45 33 19 32 00 or at dt@datatilsynet.dk.
Right to withdraw your consent
What it means: When we process your personal data based on your consent, you have the right to withdraw that consent at any time.
Exceptions: It doesn’t affect the lawfulness of processing that was based on your consent before it was withdrawn.