This is version 7, last updated 10 April 2025
1. Introduction
1.1 The privacy policy for job applicants in connection with the recruiting process (the ”Policy”) describes how the Organisation ("us", "we", or "our") collects and processes personal data relating to job applicants as part of the recruiting processes. We are committed to being transparent about how we collect and use your personal data and meeting our data protection obligations. As a controller, we collect and process personal data about you when we handle your job application and during the recruiting process.
1.2 This Policy is prepared and made available to you to comply with the (EU) General Data Protection Regulation (2016/679 of 27 April 2016) (”GDPR”).
2. Types of personal data we process about you
2.1 We process personal data about you when this is necessary and in accordance with the applicable legislation. Depending on the specific circumstances, the processed personal data include the following types of personal data: name, address, phone number, email address, CV, profile picture, educational documents, references from former employers, date of birth, IQ and/or personality tests, information from social media that is publicly available and relevant, IP address, National identification number/information, civil status, nationality.
2.2 We do not process sensitive personal data, ie the special categories of personal data as defined in GDPR, Article 9(1).
2.3 If we need to collect more personal data than what is specified above, we will inform you about this. Such information may be provided by updating this Policy.
3. Purposes for processing the personal data
3.1 The personal data we collect about you is processed for the following purposes:
a) To process job applications and recruit relevant candidates
b) To be able to create and maintain a directory of relevant candidates for positions in our organisation.
4. Legal basis for processing personal data
4.1 We only process your personal data when we have a legal basis to do so in accordance with the GDPR. Depending on the specific circumstances, the processing of personal data is done on the following legal bases:
a) The processing is necessary to take steps at your request prior to entering into a contract, in accordance with GDPR, Article 6(1)(b)
b) The processing is necessary for the performance of a contract to which you are a party, in accordance with GDPR, Article 6(1)(b)
c) If we have asked for your consent to process some specific personal data, the legal basis for the processing of such personal data is your consent, in accordance with GDPR, Article 6(1)(a). You can always withdraw your consent by contacting us via the contact details provided at the end of this Policy. If the consent is withdrawn, the personal data processed on the basis of your consent will be deleted, unless it can or must be processed, for example, to comply with legal obligations
d) The processing is necessary and carried out in the Organisation’s legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms, in accordance with GDPR, Article 6(1)(f).
5. Disclosure and transfer of personal data
5.1 We only transfer personal data to other entities when allowed or required to do so by applicable legislation.
6. Erasure and retention of personal data
6.1 We ensure that your personal data is deleted when it is no longer relevant for the processing purposes as described above. We always retain personal data to the extent that we have a legal obligation, such as for example in the case of accounting and bookkeeping materials and records.
If you are offered a position and become an employee in the Organisation, your personal data from the job application and data from the recruiting process is transferred/moved to our regular HR management system.
If you are not offered a position in the Organisation, your personal data is erased after six months in accordance with applicable law. Notwithstanding the above, specific reasons related to employment law may necessitate the continuous processing of personal data. This may have different implications. For example, we may process the applications for a longer period to prove that there was no unlawful discrimination in the selection process when we consider this necessary. Similarly, it may be relevant to process the personal data for a limited period if a similar relevant position may
become available during this period, or if another candidate opts out of the recruiting process.
If you have any questions about our retention of your personal data, please contact us by using the email mentioned in the last section of this Policy.
6.2 If you consent to a longer retention period, we follow such period, for example, if we process the job application in such a limited period to be able to contact you again in case of a suitable vacancy.
7. Your rights as a data subject
7.1 As a data subject under GDPR, you have a number of rights:
7.1.1 You have the right to request access to the personal data we process about you, the purposes we process the personal data, and whether we disclose or transfer your personal data to others.
7.1.2 You have the right to have incorrect information rectified.
7.1.3 You have the right to have certain personal data deleted.
7.1.4 You may have the right to restrict our processing of your personal data.
7.1.5 You may have the right to object to our processing of your personal data based on reasons and circumstances that pertain to your particular situation.
7.1.6 You have the right not to be subject to a decision based solely on automated means, without human interference unless the decision is necessary for your employment, the decision has a legal basis, or is based on your explicit consent.
7.1.7 If the processing of your personal data is based on your consent, you are entitled to withdraw such consent at any time. Withdrawal of your consent will not affect the lawfulness of the processing carried out prior to your withdrawal of consent.
7.1.8 You are entitled to receive personal data which you have provided to us in a structured, commonly used, and machine-readable format (data portability).
7.1.9 You can always lodge a complaint with a supervisory authority.
7.2 Your rights may be subject to conditions or restrictions. Accordingly, there is no certainty that you will be entitled to for example data portability in the specific situation; it will depend on the circumstances of the processing.
7.3 In connection with inquiries concerning your rights, we ask that you provide us with adequate information to process your inquiry, including your full name and your email address, so that we may identify you and respond.
8. Changes to this Policy
8.1 We reserve the right to update and amend this Policy. If we do, we correct the date and the version at the top of this Policy. In case of significant changes, we will provide notification in the form of a visible notice, for example on our website or by direct message.
9. Contact
9.1 You may contact us at the email address below if you:
- Disagree with our processing or consider our processing of your personal data infringes on the law
- Have questions or comments to this Policy, or
- Want to invoke one or more of your rights as a data subject described in this Policy.
If you have questions or comments to this Policy, if you would like to invoke one or more data subject rights, or for any further questions related to the policy please contact our HR Manager at zja@bimco.org.
9.2 We strive to do everything we can to meet your wishes regarding our processing of your personal data and your rights as a data subject. Should you, despite our endeavours, wish to file a complaint, you can do so by contacting the national data protection agency.