Date updated: 2018-06-11
In order to apply for a position within the NCC Group ("NCC", "we" or "us"), you will be required to provide NCC with information relating to you ("Personal data"). As a controller of your Personal data, we are committed to safeguarding the privacy of our applicants ("you" or "applicant(s)"). This notice will inform you about the processing we undertake with your Personal data during your application.
Throughout this Privacy Notice the term "processing" is used to cover all activities involving your Personal data, including collecting, handling, storing, sharing, accessing, using, transferring and disposing of information.
"Applicable Data Privacy Laws" means data protection laws and regulations implementing the Data Protection Directive 95/46/EC and as of 25 May 2018 the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (the "GDPR").
"Personal data" is defined as any information relating to an identified or identifiable natural person.
This notice will outline for you:
- what Personal data we collect;
- for what purposes we use your Personal data;
- which legal basis we rely on for processing your Personal data;
- to whom we provide your Personal data;
- how long we store your Personal data;
- the rights you have in relation to your Personal data;
- where you can ask questions and make remarks.
1. Why do we collect and process personal data and what personal data do we collect about you?
Information submitted by you will be used to identify and evaluate you for the position you applied for.
We may in some instances collect your name, basic professional experience and contact details from yourself, research companies or business related social media accounts such as LinkedIn, for contact purposes in headhunting situations. Our legal basis for the processing of such Personal data is to fulfil our legitimate interest in finding suitable candidates for an open or a future position within NCC.
As part of the hiring process we may also perform background checks on you in order to further evaluate and validate your application. Such background checks may include criminal records, credit reports, reference checks etc. If background checks are performed, NCC will at all times ensure that Applicable Data Privacy Laws are complied with. As a result of this, NCC will not retain criminal records if not permitted by Applicable Data Privacy Laws.
We will not use information submitted by you for any other purpose and neither will we disclose your Personal data to third parties which would not process your Personal data for evaluating your candidacy for NCC.
The processing of your Personal data is necessary for performing our evaluation of your candidacy. We will ask your consent in case we would need to process Personal data of a sensitive nature. If such information is not specifically required by us in the individual case, we ask you to avoid submitting information which may qualify as sensitive Personal data (such as health information, political opinions, religious beliefs or other beliefs of a similar nature, membership of a trade union, physical or mental health or condition or sexual life)
If you are hired as a result of your application some of the Personal data collected as part of this recruitment process may be transferred to your personnel file.
We will only request information from you which is necessary for your identification and the evaluation of your candidacy.
The Personal data we may collect in this context include:
Our legal basis for the processing of your personal data is to fulfil our legitimate interest of identifying and evaluating you for the position you applied for (article 6.1 f) GDPR) and in order to take necessary steps at your request prior to entering into a contract with you (article 6.1 b) GDPR).
You will have provided us directly with your Personal data through your application but we may also receive further Personal data in an indirect manner (e.g. through your interaction with third party recruitment agencies, or subject to your consent (article 6.1 a) GDPR), references from former employers as well as, when applicable, financial information such as credit reports from background research companies). Personal data relating to credit reports and social media profiles will only be processed when necessary due to the hiring for a leading position or a position with a certain financial responsibility within NCC and only if allowed under Applicable Data Privacy Law.
If you are hired at NCC as a result of your application we may process some of your Personal data necessary for the performance of the employment contract, article 6.1 b) GDPR.
There may be positions in which the Personal data that you will need to provide to us in the context of your recruitment is considered sensitive Personal data under Applicable Data Privacy Laws. Sensitive Personal data for example include Personal data from which we can determine or infer an individual's racial or ethnic origin, political opinions, religious beliefs or other beliefs of a similar nature, membership of a trade union, physical or mental health or condition or sexual life. Note that in the recruitment process for certain positions, the collection of such Personal data may be essential for our evaluation and we will therefore ask you to explicitly consent if applicable(article 9.2 a) GDPR).
Future opportunities Pool
If you agree and give your consent (article 6.1 a) GDPR) we will keep your Personal data mentioned above (except notes from interviews and references) for up to one year in a pool for future opportunities to evaluate you for other positions which may become vacant within the mentioned time period.
2. Who has access to your personal data and who do we share your personal data with?
Access within NCC
We strive to strictly limit the access to your Personal data and to protect your Personal data. Only persons who have a specific need to know within the context of their function within NCC will have access to your Personal data. The following functions may be able to access your Personal data:
- human resources functions and managers responsible for positions for the purposes of evaluation;
- Group Risk Management;
- in certain cases, IT-staff may also gain access to your data, but only to the extent necessary to ensure the proper functioning of our position website.
NCC group companies
With your agreement and consent (article 6.1 a) GDPR) we may for up to one year share your Personal data mentioned above (except notes from interviews and references) with other NCC group companies for the purpose of evaluating you for other positions in the NCC group which is or may become vacant within the mentioned time period.
Data processors acting on behalf of NCC
Moreover, NCC may transfer Personal data to external parties, such as vendors and service providers which process Personal data under the instructions of NCC (for example IT-service providers). Where such disclosure entails transfers of Personal data outside the EU/EEA, NCC will ensure that standard contract clauses have been entered into between the transferring NCC entity and the receiving external party. Alternatively, other safe guards will be put in place prior to such transfers.
Appropriate Safe Guards to countries outside the EU/EEA-area
You are according to Applicable Data Privacy Law upon request entitled to receive a copy of any documentation demonstrating that appropriate safeguards have been taken in order to protect your Personal data during a transfer outside the EU/EEA.
If you would like know more about the processing of your Personal data and whether your Personal data is transferred outside the EU/EEA, please contact us on the contact details as set out below under section 9.
When you share your Personal data with us through the recruitment and assessment agencies, you are deemed to have read and accepted this privacy notice and we will instruct our recruitment agencies to inform you thereof. We will ask these third parties to only use your Personal data in the context of the recruitment and selection services for us but we are not responsible for the processing activities that they undertake for their own purposes with your Personal data. Hence for these activities, we will ask you to check their privacy notices.
3. How long will we store your personal data?
Your Personal data will be retained as long as necessary to achieve the purpose for which it was collected, namely for evaluating your candidacy or as legally required or permitted by applicable law.
We will retain Personal data collected from candidates whose applications did not result in an employment only for as a long as strictly necessary for the purposes set out above and in accordance with applicable laws. This is normally the maximum statutory period in which a claim arising out of the recruitment process may be brought against us.
If you are hired at NCC as a result of your application some of the Personal data collected as part of this recruitment process may be transferred to your personnel file and maintained for a longer period.
If you agree that we may save your Personal data in the pool for future opportunities, we will maintain your Personal data for a period of one year or until you withdraw your agreement to remain in the pool for future opportunities or if you object to the use of your Personal data for this purpose.
4. What are your rights?
Right of rectification
NCC will take steps in accordance with Applicable Data Privacy Law to keep your Personal data accurate, complete and up-to-date. If you identify that any Personal data related to you is inadequate, incomplete or incorrect, you are entitled to have the Personal data corrected.
Moreover, you also have the right to request access to the Personal data that we process about you.
Further rights as of 25th May 2018
As of 25th May 2018, you are also under Applicable Data Privacy Law in addition to rectification entitled to:
You may request confirmation whether or not Personal data is processed and if that is the case access to your Personal data and additional information such as the purposes of the processing. You are also entitled to receive a copy of the Personal data undergoing processing. If the request is made by electronic means the information will be provided in a commonly used electronic format if you do not request otherwise.
(ii) Object to certain processing
You may object to processing of your Personal data processed on the basis of a legitimate interest, on grounds relating to your particular situation and to processing for direct marketing purposes.
You may have your Personal data erased under certain circumstances such as when your Personal data it is no longer needed for the purposes for which it was collected.
(iv) Restriction of processing
You may ask us to restrict the processing of your Personal data to only comprise storage of your Personal data under certain circumstances such when the processing is unlawful, but you do not want your Personal data erased.
(v) Withdrawal of consent
You have the right to at any time withdraw your consent to processing of Personal data to the extent the processing is based on your consent, for example if you have provided us with sensitive Personal data (such as health information) relevant for the specific position you applied for.
(vi) Data Portability
You may ask to receive a machine-readable copy of the Personal data processed on the basis of your consent or on the basis that the processing is necessary in order to perform an agreement with you, and which Personal data have been provided to NCC by you (data portability) as ask for the information to be transferred to another data controller (where possible).
Complaints to the supervisory authority
You acknowledge that you always have the right to lodge complaints pertaining to the processing of your Personal data to the competent data protection authority if so provided under Applicable Data Privacy Law. The data protection authority can be reached here.
We will ensure that the access to your data is accurately secured by applying appropriate safeguards, depending on the circumstances taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk. In support of this commitment, we have implemented appropriate technical, physical and organizational measures to protect your personal data against: unauthorized or accidental destruction, alteration or disclosure; misuse; damage; theft or accidental loss; or unauthorized access.
6. Contact information
If you have any questions or concerns regarding the processing of your Personal data or wish to exercise any of your rights under Applicable Data Privacy Law or withdraw your agreement to stay in the pool for future opportunities, please contact NCC on the contact details set forth below.
The data controller for Personal data is NCC AB org: 556034-5174
Att: NCC GDPR Team
170 80 Solna, Sweden
7. Other notices
We reserve the right to update this policy, if necessary, for example to comply with legislative changes, regulatory changes, new practices and procedures, or requirements imposed by any authority. The most recent version is always available on this page and the revisions will apply from the date of their publication or via the position page on the website. The date on which this text was last changed can be found in the header of the document.
You are responsible for your own information and for the consequences of their posting. You agree not to submit information infringing on the privacy, publicity, confidentiality, or intellectual property rights of others, including information revealing trade secrets, unless you own the rights or have the owner's permission so to do. For clarity, we will not be responsible or liable for any violation of third party privacy, confidentiality or intellectual property rights arising from the information you submit to our position website.