Cambri Recruitment Privacy Notice
Cambri respects your privacy and is dedicated to protecting your personal data in accordance with the General Data Protection Regulation (“GDPR”) in the UK and EU.
This Recruitment Privacy Notice informs you how Cambri collects, uses, or shares your personal data only in connection with our recruitment process, for which Cambri is the Data Controller. You can find our full Privacy Notice on the Cambri website at https://www.cambri.io/privacy-policy. Our contact details are:
Cambri Oy
Business ID: 2628434-7
Address: Salomonkatu 17B, 00100 Helsinki, Finland
For any queries regarding data protection in connection with our recruitment process you can contact Head of People, Gaelle Malet: gaelle.malet@cambri.io
Cambri manage our candidate and recruitment process through our “Career Site” and our applicant tracking system. When we use the term “Candidate” in this privacy notice, we are referring to each of the Candidate descriptions below unless it’s stated otherwise.
In this Privacy Notice we explain how we process your personal data when you are:
-
A Visitor when you visit our Career Site
-
A Connecting Candidate when you connect with us via our Career Site, to create a profile with us and receive information about current or future vacancies with us
-
An Applying Candidate when you apply for a position with us, via our Career Site or a third-party service
-
A Sourced Candidate when we collect information about you from other parties, sites and services where we believe your profile is of interest for our current or future vacancies
-
A Referred Candidate when we receive information about you from our employees or partners since they believe your profile is of interest for our current or future vacancies
-
A Reference when we receive information about you from a Candidate, who lists you as their reference
Table of Contents
1. ABOUT PROCESSING OF PERSONAL DATA
2. THE PERSONAL DATA WE PROCESS
3. WHERE WE COLLECT YOUR PERSONAL DATA
4. PURPOSES FOR WHICH WE PROCESS YOUR PERSONAL DATA
5. WITH WHOM WE SHARE YOUR PERSONAL DATA
6. LAWFUL BASES ON WHICH WE PROCESS YOUR PERSONAL DATA
7. TRANSFERRING YOUR PERSONAL DATA
8. HOW LONG WE KEEP YOUR PERSONAL DATA
9. YOUR RIGHTS AND HOW YOU CAN EXERCISE THEM
10. UPDATES TO THIS PRIVACY NOTICE
About processing of personal data
Personal data means any information relating to an identified or identifiable natural living person. Examples of personal data include: name, e-mail address, telephone number and IP address.
Some categories of personal data are designated “special category” data under the GDPR. These include data such as health and ethnicity for instance.
Processing means any operation or set of operations which is performed on personal data, whether or not by automated means.
There are laws and regulations on how companies may process personal data and special category data. The data protection law that is relevant for our use of your personal data as described in this privacy policy is the EU and UK General Data Protection Regulation (GDPR).
The personal data we process
Cambri will only process the minimal personal data we require that is relevant for your visit to our Career Site, or for Candidates for your application to an advertised role. This data is:
All Career Site Visitors
-
Device information. We will collect information about your device, such as IP address, browser type and version, session behaviour, traffic source, screen resolution, preferred language, geographic location, operating system and device settings/usage.
-
Technical and statistical data. We will collect technical and statistical data about your use of the site, such as information about which URLs you visit, and your activity on the site.
-
Communications data. We will collect and store your communication with us, including the information you provided in the communication. This may include the content of emails, video recordings, messages on social media, the information you add to your account with us, surveys, etc.
-
Contact details. Such as your name, email address, telephone number and physical address if you provide these to us.
Candidates
-
Data from the recruitment process. Such as notes from interviews with you, assessments and tests made, salary requirements. This will be limited only to the information we need to assess your suitability for the role for which you are applying.
-
Information in your application. Such as your CV, cover letter, work samples, references, letters of recommendation and education. We aim to ensure that we only process the personal data in your application and CV that is relevant to the role for which you are applying, and request that additional unrequired personal or special category information is not provided.
-
Information openly available in your public profile. Such as LinkedIn and the website of a previous employer. We do not use or research any other social media sites to gain unrelated personal information.
-
Information provided by references. Meaning the information we receive from our employees or partners who refer you to us, or by the persons you have listed as your references.
References
-
Contact details - If a Candidate lists you as their reference, they provide us your contact details to enable us to contact you.
Where we collect your personal data
All individuals
-
From our Career Site. If you visit our Career Site, we collect technical and statistical information about how you use the Career Site, and information from your device.
Candidates
-
Directly from you. Most of the information we process about you, we receive directly from you, for example when you apply for a position with us or connect with us. You always have the option not to provide us with certain personal information. However, some personal data is necessary in order for us to process your application or provide you the information you request from us.
-
From your public profile. Such as LinkedIn and the website of a previous employer. We do not use or research any other social media sites to gain unrelated personal information.
-
From our references. We may receive information about you from our employees or partners (such as recruitment service providers), when they believe your profile is of interest for our current or future vacancies.
-
From your references. If you provide us with references, we may collect information about you from them. We will only ask references to provide us with the minimal personal information that is relevant to the role for which you are applying.
-
Data we create ourselves or in cooperation with you. Information about your application and profile is usually created by us, or by us in cooperation with you, during the recruitment process which is relevant only to your suitability for that particular role. This may for example include notes from interviews with you, assessments and tests made.
References
-
From the person for whom you are a reference. We only receive your personal contact information if a candidate has provided us with this information.
Purposes for which we process your personal data
Candidates
- Review profiles and applications sent to us
- Collect and evaluate your professional profile on our own initiative. This also includes communicating with you regarding your profile
- Contact you directly about specific, future vacancies with us
- Record the interview(s) with you
- Provide you with updates about vacancies with us
- Contact you to ask for your participation in surveys
References
- Contact you to ask you to provide information about a Candidate, and evaluate the information you provide
Visitors
- Collect information about your use of the Career Site, using cookies and other tracking technologies, as described in our Cookie Policy
- Maintain, develop, test, and otherwise ensure the security of the Career Site
- Analyse how the Career Site and its content is being used and is performing, to get statistics and to improve operational performance
All individuals
- Protect and enforce our rights, interests and the interests of others, for example in connection with legal claims
With whom we share your personal data
We do not share your personal data with any other parties or individuals at any time where there is no obligation to do so. We will never sell or provide your personal to any other party at any stage without your clear consent in advance. The following are our known partners and providers with whom we knowingly share your data, and examples of where we may have a legal obligation to share your personal data:
Our service providers
We share your personal data with our suppliers who provide services and functionality in our recruitment process. These are:
-
Teamtailor AB - provider of our Career Site and related applicant tracking system
-
HiBob Limited – provider of our Human Resources management platform
Our group companies
We share your personal data with our group companies, when they provide us services and functionality to our recruitment process, such as access to particular systems and software.
Public authorities
We will share your personal data with public authorities only when we have a legal obligation to do so.
To parties involved in legal proceedings
If needed to protect or defend our rights, we share your personal data with public authorities or with other parties involved in a potential or existing legal proceeding. This can for example be in case of discrimination claims.
Lawful bases on which we process your personal data
To be able to process your personal data we must have a lawful basis under UK and EU GDPR.
Visitors to our Career Site
The lawful basis we rely on for processing your personal data is for the purpose of our legitimate interests (GDPR article 6(1)(f).
Candidates
The lawful basis we rely on for processing your personal data are article 6(1)(b) of the UK GDPR, which relates to processing necessary to perform a contract or to take steps at your request, before entering a contract. Article 6(1)(c) to comply with our legal obligations and article 6(1)(f) for the purpose of our legitimate interests.
The lawful basis we rely on to process any information you provide as part of your application which is special category data, (such as health or ethnicity information) are article 9(2)(b) of the UK GDPR, which relates to our obligations in employment and the safeguarding of your fundamental rights.
References
The lawful basis we rely on for processing your personal data is for the purpose of our legitimate interests (GDPR article 6(1)(f).
Transferring your personal data
Wherever possible we will process your personal data within the EU and UK.
However, some of our service providers may process your personal data outside of the EU and UK. We also use suppliers whose parent company, or whose subcontractor’s parent company may be based outside the EU and UK. In these cases, we have taken into account the risk that the personal data may be disclosed to countries outside the EU and UK, for example because of an authority request.
When we, or one of our suppliers, transfer your personal data outside the EU and UK, we will ensure that a safeguard recognised by the GDPR is used to enable the transfer. We use the following safeguards:
When your personal data is transferred outside the EU and UK, we also implement appropriate technical and organisational safeguards, to protect the personal data in case of a disclosure. Exactly which protective measures we implement depends on what is technically feasible, and sufficiently effective, for the particular transfer.
How long we keep your personal data
All individuals
If we process your personal data for the purpose of being able to protect and enforce our rights, we will keep your personal data until the relevant legal issue has been fully and finally resolved.
Visitors
The retention periods for cookies are set out in our Cookie Policy.
Candidates
If you are a Connecting Candidate (only), we keep your personal data for as long as you remain connected with us.
For all other Candidates we only keep your personal data long enough to assess if you are a suitable candidate for the relevant vacancy with us.
If you don’t succeed in the initial recruitment process, we may ask for your consent to keep your personal data for as long as needed to consider, and potentially contact you for relevant future job openings.
If you are hired, we will keep your personal data as detailed in your employment contract with us, as specified in our employment policies, and to enable us to meet our legal obligations.
References
We keep your personal data for as long as we keep the personal data of the Candidate for whom you acted as a reference.
Your rights and how you can exercise them
In this section, you will find information about the rights you have when we process your personal data. As described below, some of the rights only come into play when we process your personal data under a particular legal basis.
If you want to exercise any of the rights listed here, we suggest that you visit the Data & Privacy page on our Career Site, where we offer features to let you exercise your rights. Alternatively you can Log in to your account with us, where you can use the settings in the account to exercise your rights.
- Right to be informed
- You have the right to be informed about how we process your personal data. This usually through the information we provide in this Privacy Notice
- Right to access your personal data.
- You have the right to receive a copy of the data we process about you. You may raise a Subject Access Request using the contact details provided. In most cases we must respond to any such request within one month.
- Right to request a transfer of your personal data to another recipient
- You can request a copy of the personal data relating to you that we process for the performance of a contract with you, or based on your consent, in a structured, commonly used, machine-readable format. This will allow you to use this data somewhere else, for example to transfer it to another recipient. If technically feasible, you also have the right to request that we transfer your data directly to another recipient.
- Right to have your personal data deleted (“right to be forgotten”).
- In some cases, you have the right to have us delete personal data about you.
- Right to object against our processing of your personal data.
- You have the right to object to processing of your personal data which is based on our legitimate interest, by referencing your personal circumstances.
- Right to rectification.
You have the right to request that we rectify inaccurate information, and that we complete information about you that you consider incomplete.
We will always try to resolve any issues or questions you may have regarding our processing of your personal data directly with you. If you want to get in touch with us to exercise your rights, or if you have any questions, comments or concerns about how we handle your personal data, you can reach us by sending an email to gaelle.malet@cambri.io.
However, if you have complaints about our processing of your personal data, you can raise a complaint with your national data protection authority, which you can find listed here if you are based in the EU. If you are based in the UK, you can lodge a complaint with the Information Commissioner’s Office, here.
Updates to this Privacy Notice
We update this privacy notice when necessary - for example, because we start processing your personal data in a new way, because we want to make the information even clearer to you, or if it’s necessary to do so in order to comply with applicable data protection laws. We encourage you to regularly check this page for any changes.
This Notice last reviewed – 01.03.2025
