Job applicant Privacy Notice

The NCC company that is recruiting for the position is responsible for the use of your personal data. In this Notice "we", "us" and "our" refer to the relevant company that is responsible for the use of your personal data.

We collect personal data from the following sources:

• Yourself. We collect the personal data you provide to us in your application and CV.
• Reference persons. We normally carry out reference checks as a part of the recruitment process and collect the personal data that reference persons share with us about you.
• Group companies. The companies within the NCC group cooperate with each other and can share personal data with each other
• Publicly available sources. We can also collect personal data about you from publicly available sources.
• Recruitment agencies. We use, when applicable, various recruitment agencies to help us recruit for certain positions and we collect, in such a case, the personal data that they share with us.

We only process the information that we need depending on the position you have applied for and how you interact with us. We process and use the following categories of personal data:

• Contents of communications with us. e.g., e-mails
• Identity information. Information that makes it possible to identify you, such as your name and, where applicable, social security number or equivalent.
• Contact information. Personal data which makes it possible to contact you.
• Information on qualifications. Personal data about your qualifications such as education, work experience, professional certifications and driver’s license.
• Profile information. Information regarding your profile, for example your gender and age, current position, employment history with NCC or other employers.
• Test information. Personal data from test results that you have completed as a part of the recruitment process, e.g., type of test, date of test and test result.

We process personal information of applicants for the overall purposes described in this section. Please not that not all processing activities may apply to you, it might vary depending on how you interact with us and what position you have applied for.

Manage the recruitment process.

We use personal data to manage the recruitment process for example to collect and review your application (including resume and cover letter) and to evaluate your application and communicate with you during the recruitment process.

Carry out reference checks

We use personal data for candidates and reference persons to carry out reference checks, for example to communicate and verify the candidate's qualifications and learn more about the candidate's background, experience, and skills.

Carry out pre-employment tests

Where applicable, we carry out pre-employment tests (for example screening tests) as a part of the recruitment process. If pre-employment tests are necessary, we will inform you of this and obtain your approval to participate in such checks and tests.

Evaluating background checks results

We receive and evaluate the results from background checks carried out by external background check agencies. The background check will include different verification points depending on the position you have applied for. The legal basis for the processing is our legitimate interest of receiving and analyzing results from background checks.

The background check agency will inform you in detail of the sources for the personal data. NCC and the background check agency will ask for your approval for such background checks to be carried out.

Follow up and evaluate the recruitment process

We use personal data to follow-up on and evaluate the recruitment process, for example to create reports and statistics on the number of applicants for a position. Information around the candidate experience can be collected through a voluntary survey.

Establish, exercise and defend legal claims

If needed, we use your personal data to establish, exercise and defend legal claims for example in connection with a dispute or court proceeding. For this purpose, we will share personal data with various recipients, please see below.

Fulfil legal obligations

We use personal data, if needed, to fulfil legal obligations and to comply with law, for example to satisfy employment and data protection obligations.

We take steps to ensure that the personal data we process is always protected and that our processing of it is in accordance with the applicable data protection rules and our internal guidelines and procedures. Information security and ensuring appropriate protection of personal data is vital for us. We strive to implement security measures according to the international standard security framework ISO 27000 to set appropriate level of protection of information and to prevent and detect disclosure of personal data to unauthorized parties.

When necessary, we share your personal data with different recipients for different reasons. Which recipients we share your personal data with depends on how you interact with us. Unless we have stated otherwise below the recipient is responsible for its own use of your personal data.

Service providers

To process personal data for the purposes described in this Notice, we share personal data with service providers that we have engaged. These service providers provide, for example, IT services to us. When the service providers process personal data on our behalf, they act as data processors for us, and we are responsible for the processing of your personal data. They must not use your personal data for their own purposes and are contractually and legally obliged to protect your personal data.

Recruitment agencies

Where we use recruitment agencies to manage the recruitment process, we share personal data with them for the same purpose. To the extent they act as data processors for us, we are responsible for the processing of your personal data.

Background check agencies

When we use background check agencies to carry out background checks (see above), we share your basic information with them in order for them to carry out the background check and report the result back to us. The result from the background check is only retained 14 days after communicated result to the candidate.

Group Companies

Companies within the NCC group collaborate with each other and therefore we may share personal data between them.

Other recipients

If needed, we share your personal data with other recipients for the following purposes:

• to manage a merger or sale of the business,
• to manage and defend legal claims and rights,
• to fulfil legal obligations,
• to respond to a request, and
• to protect and ensure the safety of our staff.

We always strive to process your personal data within the EU/EEA area, but your personal data may in some cases be transferred to and processed in a country outside the EU/EEA area by our service providers. In these cases, a data protection agreement is used to protect and safeguard the personal data transferred. We will ensure that there are adequate safeguards in place to protect your personal data in light of the laws of the receiving country. Normally we rely on the EU Commission's Standard Contractual Clauses for transfers of personal data to recipients outside the EU/EEA.

Information about the countries to which we, where appropriate, transfer your personal data and the safeguards implemented can be obtained upon request.

We store your personal data only as long as we need to in order to fulfil our purpose for processing it and to meet any applicable legal requirement. We will then safely erase or anonymise your data so that it can no longer be linked to you. The main principles for assessing the retention period for personal data we apply are:

• the period which the recruitment process in on-going,
• the period we need to retain personal data in order to fulfil legal requirements (e.g. in the area of employee co-determination),
• the period which personal data may be needed in order to establish, exercise and defend legal claims (i.e. with reference to statutory and other periods of limitation) and
• the period which we have another legitimate business purpose to store the personal data (e.g. to evaluate the recruitment process).

Personal data processed in background checks will only be processed during the recruitment process and will not be documented or stored.