PRIVACY STATEMENT (March 5, 2025)
This privacy statement is based on the EU General Data Protection Regulation (GDPR), which concerns the rights of EU citizens regarding data protection and the confidential processing of their personal data.
DATA CONTROLLER
ATA Gears Ltd
Business ID: 0153826-7
Address: Aitolahdentie 75, 33580 Tampere
Phone: 040 757 5449
Email: postmaster@atagears.fi
PERSON RESPONSIBLE FOR THE PERSONAL DATA REGISTER
Name: Nora Duncker
Phone: 050 596 4864
Email: nora.duncker@atagears.fi
NAME OF THE REGISTER
ATA Gears Ltd Job Application Register
PURPOSE OF PERSONAL DATA PROCESSING
The data controller (“ATA Gears”) offers job and internship positions to private job seekers and students. Providing job and internship opportunities requires the processing of applicants’ personal data. Personal data constitutes the job and internship applicant register of ATA Gears. The purpose of processing the personal data contained in ATA Gears’ job and internship applicant register is to manage, administer, and maintain the relationships between individuals applying for jobs and/or internships at ATA Gears, manage employment and internship agreements, validate application events, and enhance customer service and business development. Additionally, personal data may be used for marketing purposes. For electronic direct marketing purposes, personal data is processed only based on the explicit consent of the data subject, which can be revoked by the data subject by contacting the person responsible for the personal data register at ATA Gears.
LEGAL BASIS FOR PERSONAL DATA PROCESSING
The processing of personal data is based on national legislation and the EU General Data Protection Regulation (GDPR). The legal bases for processing personal data are the consent given by the job or internship applicant, the agreement between the applicant and ATA Gears, and ATA Gears’ legitimate interest based on the employment relationship. Processing of personal data may also be necessary for the compliance with the data controller’s statutory obligations.
Personal data is processed only to the extent necessary for the data controller’s business and to provide services. If the processing of personal data is based on the applicant’s consent, the applicant has the right to withdraw their consent at any time. However, the withdrawal of consent does not affect the lawfulness of the processing prior to the withdrawal.
INFORMATION CONTAINED IN THE REGISTER
The following information may be stored in the register about the data subject:
– Applicant’s name, phone number, postal address, email address, and in some cases, personal identification number
– Information related to agreements between the parties, such as the jobs or internships applied for
– Information related to online behavior on the data controller’s websites
– Any other information collected with the explicit consent of the applicant
– Information related to marketing and sales promotion, which may include targeted marketing actions toward the applicant and participation in them (e.g. newsletters or competitions)
– Call recordings from applicant interviews as part of personal audio recordings
Stored call recordings are used to verify the events of the application process and to monitor them. The recordings also allow ATA Gears to perform internal quality control and enhance its services. Stored call recordings may also be used for training employees working in personnel administration services. For training purposes, recordings are used in a way that does not unnecessarily reveal the identity of ATA Gears’ administrative employees or the applicant. Participants in training sessions are informed that the recordings are subject to confidentiality obligations, and they agree to keep the information confidential.
REGULAR SOURCES OF INFORMATION
The regular and primary source of information for the register is information collected from the applicants themselves. Information is gathered during application events and contract negotiations. Additionally, applicant information may also be collected from the applicants themselves by phone, via the internet, email, or other similar means. Information may also be obtained from ATA Gears’ subcontractors or partners. Applicant information may be collected using programmatic cookies, technical devices, or other similar technologies.
REGULAR DISCLOSURE OF INFORMATION
Personal data may be disclosed to the data controller’s subcontractors and other similar collaborators who have entered into an agreement with the data controller for the processing of personal data.
Personal data will not be disclosed to third parties for direct marketing purposes without the explicit consent of the individual concerned nor for opinion or market research or other similar inquiries. Personal data of registered individuals who have given consent for direct marketing may be disclosed to ATA Gears’ partners for marketing purposes relating to ATA Gears’ products.
Data from the register may be disclosed to authorities as provided for by special legislation. Statistical usage data may be disclosed to third parties in a format that does not allow the identification of individual personal data.
The data controller may use a service provider for the processing of personal data (e.g. recording server), which may have access to personal data from outside the EU/EEA. The data controller ensures that the transfer of data is carried out properly and lawfully in accordance with the legislation concerning the processing of personal data.
Personal data will be transferred outside the EU/EEA only on one of the following lawful bases:
– The European Commission has decided that the relevant recipient country ensures an adequate level of data protection
– The data controller has implemented appropriate safeguards for the transfer of personal data using standard contractual clauses approved by the European Commission, of which the customer is entitled to receive a copy by contacting ATA Gears, or
– The customer has given explicit consent for the transfer of their personal data, or there is another lawful basis for transferring personal data outside the EU/EEA, such as the Privacy Shield arrangement approved by the European Commission for the United States.
Personal data will not be disclosed for purposes other than those mentioned above unless required by law. ATA Gears’ website may use so-called cookie functionality, i.e. cookies. A cookie is a small text file sent to the user’s computer and stored there, allowing the website administrator to recognize frequent visitors and compile aggregate information about visitors.
If a user visiting the website does not want ATA Gears to receive the aforementioned information via cookies, most browser programs allow the cookie function to be turned off. This is generally done through the browser settings. However, disabling cookies may affect the functionality of ATA Gears’ websites.
DATA RETENTION PERIOD
Personal data will be retained only as long as necessary to fulfill the purposes of processing personal data as defined in this privacy statement or as long as required by law. Outdated and unnecessary data will be disposed of appropriately.
PRINCIPLES OF REGISTER PROTECTION
The protection and processing of the information contained in the register is carried out in accordance with the provisions and principles of the data protection regulation and other data protection regulations, as well as other authorities’ regulations and good data processing practices.
Electronic material in the register is stored in databases protected against abuse and intrusion attempts by firewalls, passwords, and other technical and application solutions typically used in business.
Both electronic and physical register materials are located in access-controlled, locked, and monitored premises. Access to the register is monitored by user-specific usernames and passwords. Only individuals whose job responsibilities include the use of the register are allowed access. The staff of the data controller and subcontractors are subject to confidentiality obligations.
RIGHT TO ACCESS
Everyone has the right to check their own information stored in the register. The right to access is free of charge once a year. A written and signed or otherwise reliably verified access request must be sent to the person responsible for maintaining the personal data register mentioned above. Before disclosure, the individual’s identity will be verified by a photo ID or another reliable means.
At the discretion of the data controller, information about the content of an audio or video recording may be presented to the requester either for listening or viewing at the data controller’s premises or in written form for the audio recording.
RIGHT TO REQUEST CORRECTION OF INFORMATION
If a data subject notices that their personal data stored in the register is incorrect, incomplete, or has been processed contrary to the purpose of the register or applicable legislation, they have the right to request the correction, restriction, or deletion of the incorrect data in the register. The request must be made in writing and sent to the person responsible for maintaining the personal data register mentioned above. The request for correction must be specified as accurately as possible.
RIGHT TO DATA PORTABILITY
The data subject has the right to have their personal data transferred from one system to another. The request for transfer can be made to the person responsible for maintaining the personal data register mentioned above.
RIGHT TO LODGE A COMPLAINT WITH A SUPERVISORY AUTHORITY
Anyone who believes that their rights under the EU General Data Protection Regulation have been violated also has the right to lodge a complaint with supervisory authorities. The national supervisory authority in Finland is the Office of the Data Protection Ombudsman, whose contact information is:
Office of the Data Protection Ombudsman
P.O. Box 800, Ratapihantie 9, 00521 Helsinki
Phone: 029 56 66700
Email: tietosuoja@om.fi
Website: www.tietosuoja.fi
CHANGES TO THE PRIVACY STATEMENT
The data controller continuously develops its operations and reserves the right to change this privacy statement. Legislation may also change, so the content of the privacy statement should be reviewed regularly.