Privacy Policy for recruitment using Teamtailor
1. Introduction
This privacy policy describes how Qliro AB (publ), reg. No. 556962-2441, (“Qliro”, “we”, “us”) processes your personal data when you apply for a job with us. Our recruitment and hiring process is managed using the recruitment system Teamtailor (the “Service”), provided by our data processor Teamtailor AB.
Your privacy is important to us. We are committed to processing your personal data securely and in accordance with the EU General Data Protection Regulation (GDPR) and other applicable data protection laws. This policy explains what data we collect, why we collect it and how you can exercise your rights.
1.1 Data Controller
Qliro is the data controller for the processing of personal data described in this policy. This means we are responsible for ensuring your data is handled correctly.
2. How and what personal data we process
2.1 Data you provide to us
We collect personal data that you provide to us when you:
You are not obliged to provide personal data to us. However, if you do not provide the information we need to assess your application, we may not be able to consider you for the position. Please do not include sensitive personal data (for example information about your health, religious beliefs, political opinions or trade union membership) in your application or CV.
2.2 Data we collect from other sources
Talent sourcing: Our recruiters may identify potential candidates through public sources, such as LinkedIn, and contact them there. If you are contacted by us in this way, we will inform you of our processing of your personal data in our first message to youan email after your interview. We only register your personal data in the Service if you have told us that you are interested in the position, and we have decided to proceed with you in the recruitment process after a first conversation.
Recommendations: In some cases, current Qliro employees may recommend potential applicants. If this happens, we will inform you that we are processing your personal data based on such a recommendation.
Background checks: If you are offered employment, we carry out a background check before the employment contract is signed.
Background checks are only carried out on candidates who have been offered employment and are not used to choose between candidates. The background check consists of a credit check through a credit reference agency (Creditsafe), and you will receive a notification from the credit reference agency when the check is carried out. We will also ask you to obtain an extract from the Swedish Police Authority’s criminal records register and show it to us in person. Please do not send the extract to us by email. We do not copy or save the extract or record its content. We only note that it has been shown to us. See section 3.5.
2.3 Categories of personal data we process
The categories of personal data we collect and process are those relevant to the recruitment process. This may include:
Application materials: Your CV/resume (including picture and/or video if provided), cover letter, grades, certificates and answers to application questions.
Professional information: Information about your education, work experience and skills that we obtain from other sources (see section 2.2), as well as information from references you have asked us to contact.
Assessment information: Notes and evaluations from interviews and, for certain positions, results of ability tests (such as logical reasoning tests). Test results are one of several factors in our overall assessment and are not used on their own to exclude you from the process.
3. Purpose, legal basis and retention period
We process your personal data for different purposes, each with a specific legal basis and retention period.
3.1 To manage your application
3.2 To defend against legal claims
Retention period: If you are not hired, we will retain your application data for 24 months from the date your application was registered in the Service. If you have been added to the Service by us and you do not give us permission to store your data, your data will be deleted 90 days after we asked for your permission (see section 3.5).
3.3 For future recruitment opportunities
Retention period: If you provide your consent, your data will be stored for 24 months from the date of your consent, or until you withdraw it. Before the period expires, we will ask you whether you wish to renew your consent.
3.4 Aggregated statistics
3.5 Talent sourcing and recommendations
Legal basis: Our legitimate interest in finding suitable candidates for our positions (Article 6(1)(f) GDPR). If you choose to proceed in a recruitment process with us, we process your data to take steps at your request prior to entering into a potential employment contract (Article 6(1)(b) GDPR), see section 3.1.
Retention period: If you do not wish to proceed in a recruitment process, we will not register your personal data in the Service. If we register you in the Service, you will receive an email asking for your permission to store your data. If you do not give your permission, your data will be deleted 90 days after the request was sent. If you give your permission, sections 3.1-3.3 apply.
3.6 Background checks
4. Automated processing and sorting
In the initial stages of our recruitment process, we may use an automated sorting tool within our recruitment platform to efficiently manage a large volume of applications. This sorting is based on your direct answers to a few objective questions that relate to mandatory requirements for the position (for example, language proficiency or ability to work from our office).
This sorting is not an automated decision or profiling. It serves only as an administrative tool to organise applications. All applications, including those filtered by this tool, are subsequently subject to a manual review by a human recruiter, who makes the final decision on whether an applicant proceeds in the process.
Because a human is always involved in making the determinative decision, our process does not constitute solely automated decision-making as defined in Article 22 of the GDPR.
We also use an AI feature in the Service that creates a short summary of your CV and a timeline of your education and work experience, to help our recruiters get an overview of applications. The summary is generated by Teamtailor’s sub-processor OpenAI Ireland Ltd within the EU/EEA and Switzerland. The AI feature does not assess, score or rank you, and it does not make any decisions. Our recruiters always have access to your full CV and make the assessment themselves.
5. Data sharing and international transfers
We do not sell your personal data. We may, however, share your data with trusted recipients in the following situations to provide the Service and fulfill our legal obligations.
5.1 Data recipients
Data Processors (our suppliers): We use suppliers who act as our data processors, processing your data on behalf and according to our specific instructions. We carefully select our partners and ensure they provide sufficient guarantees for data protection. We have legally binding data processing agreements (DPAs) in place with all our processors.
Our processors fall into the following categories:
In certain situations, we may also be required to share your data with other third parties who are not our processors. This will only be done when we have a legal basis to do so.
Legal advisors and/or in disputes: We may share your data with our legal advisors (e.g. law firms) or other parties in the context of establishing, exercising or defending a legal claim, for example, in a discrimination dispute.
5.2 International transfers
Your personal data is primarily stored and processed within the EU/EEA. Teamtailor’s hosting and storage take place in Ireland, Germany and Finland. However, as we use the recruitment platform Teamtailor, Teamtailor may engage sub-processors located outside the EU/EEA to provide parts of the Service.
When we, or our supplier Teamtailor, transfer your personal data outside the EU/EEA, we will ensure that a safeguard recognized by the GDPR is applied to enable the transfer. We use the following safeguards:
When your personal data is transferred outside the EU/EEA, we, or our supplier Teamtailor, also implement appropriate technical and organizational safeguards, to protect the personal data in case of a disclosure.
6. Your rights as a data subject
Under the GDPR, you have several rights concerning the processing of your personal data.
To exercise your rights, kindly use the provided functionality for right to access and right to erasure respectively in the Service, or please contact us using the details in Section 9.
7. Security
We implement and maintain appropriate technical and organizational security measures to protect your personal data against accidental or unlawful destruction, loss, alteration and unauthorized disclosure or access. While we strive to protect your data, it is also important that you take responsibility for your own data security. It is your responsibility to keep your login information to the Service secret.
8. Cookies
Our career site (https://career.qliro.com), which is provided through the Service, uses cookies. Cookies are small text files that are stored in the browser on your device, such as your computer, mobile phone or tablet, when you visit the career site. We use the following categories of cookies:
Analytics cookies: These cookies help us understand how visitors use the career site, for example which link brought you to the site, so that we can improve it. They are provided by Teamtailor and are only set if you consent.
We only use analytics and marketing cookies if you have given your consent (Chapter 9, Section 28 of the Swedish Electronic Communications Act (2022:482) and Article 6(1)(a) GDPR). Where strictly necessary cookies involve the processing of personal data, the processing is based on our legitimate interest in providing a functioning and secure career site (Article 6(1)(f) GDPR).
When you first visit the career site, you can accept all cookies, decline all non-necessary cookies or choose which categories to accept under “Cookie preferences”. You can change or withdraw your consent at any time via the “Manage cookies” link at the bottom of each page of the career site. You can also block or delete cookies in your browser settings, but if you block strictly necessary cookies, parts of the career site may not work.
9. Contact information
If you have any questions about this policy, our processing of your personal data or if you wish to exercise your rights, please contact our People Team or our Data Protection Officer using the contact details below.
Address: Qliro AB, Sveavägen 151, 113 46 Stockholm
10. Changes to this policy
We may update this privacy policy from time to time. The latest version is always available through the Service and on our career site https://career.qliro.com/. If we make changes that materially affect how we process your personal data, we will inform the candidates concerned before the changes take effect, for example by email .
