Privacy notice for job applicants

1. Introduction

This privacy notice describes how Aceve AB and all of its subsidiaries (“Aceve”, “we”, “our”, “us”) processes personal data when you take part in our recruitment process or otherwise connect with us within such process or via our career site. 

As a data controller, Aceve is responsible for ensuring we use your personal data in compliance with applicable privacy and data protection laws (primarily the General Data Protection Regulation (EU) 2016/679, the “GDPR”) and protecting your personal data accordingly. 

It is important that you are informed about how we process personal data. In this privacy notice, we tell you what you can expect us to do with your personal data. We may update this privacy notice from time to time. At the top of the page, you can see the last date when this was made.

2. Collection of personal data

We primarily collect personal data directly from you, typically when you:

• submit your application, providing us your personal data either as uploaded directly by you or by using a third-party source such as LinkedIn; 

• connect with our staff, adding your personal data either as uploaded directly by you or by using a third-party source such as LinkedIn; or

• communicate with us and provide information of relevance to our recruitment process.

In some cases, a candidate may be someone initially discovered by our talent acquisition team or recommended to us by our other existing employees. Personal data about such discovered or recommended, potential candidates is also collected via our talent acquisition team.

We process your personal data if you are selected as a work reference by a candidate, in which case the candidate has submitted your contact information during the recruitment process.

3. The types of personal data collected and processed

The categories of personal data we collect is limited to what is relevant for our recruitment process, such as name, contact details, curriculum vitae (CV) and our correspondence with each candidate. If you are accepted and agree to further steps in our recruitment process, interview notes, comments and dialogue between people involved in the process will be added as well. We also collect and process information by use of social media, public searches and own or third-party cookies.

Parts of our recruitment process may use AI-assisted tools, for example for CV screening or interview transcription. The output is advisory only; hiring decisions are always made or reviewed by a person.

In some cases, we will ask you to perform an ability test. We will then process your name, email address and test input and results. Test results are reviewed by a recruiter before they factor into the hiring decision.

4. Why we process your personal data and the legal bases we rely on

The overall reason we collect and process personal data is to manage the steps of our recruitment process, such as to: 

• screen applications and the professional profiles of potential candidates;

• interview and evaluate potential candidates for the role or job they have applied or been suggested to apply to; and to

• contact and check references. 

The activities carried out are based on our legitimate interests to reach out to and ensure we match with the right candidates as well as to simplify and facilitate recruitment. 

We retain your personal data in our candidate database for the purposes of future recruitments. You consent to such processing when you submit your application. Read more about this type of storage in Section 5 below. 

5. For how long do we store your personal data?

We will keep personal data relating to a candidate in our candidate database for up to 12 months after the end of a recruitment process so that we can contact you again in case another job opening may fit your profile. 

If you take part in an ability test, your test data is retained by our test provider, Alva Labs, for 24 months as standard, applied consistently across all countries in which we use this test provider. You may request that this period be extended to a maximum of 2 years, for example to avoid retaking the test for a future application.

You may at any time object to the processing of your personal data for such purpose and choose to delete all information related to your application by contacting us via [email protected]. As soon as we have received your notice, the data will be removed for the given purpose.

6. With whom do we share your personal data? 

For you to apply to our job openings and in order for us to carry out parts of our recruitment process, the personal data of candidates might need to be shared with third parties such as:   

• our contractors and subcontractors, acting as our processors and sub-processors in accordance with our instructions;

• public authorities, e.g. if required by us according to mandatory law. 

Any transfers of your personal data to third parties will be done in accordance with applicable data protection laws. We carefully choose partners that we work with, e.g. Ashby and HR Office, that provides our recruitment platform, Alva Labs, that provides our ability test, server and hosting companies, or businesses providing other services - to ensure that the candidate’s personal data is processed and protected accordingly. 

For the ability test specifically, Aceve and Alva Labs are joint controllers under Article 26 GDPR: Alva Labs determines the test design and scoring methodology, while Aceve determines how the outcome is used in the hiring decision. The arrangement between Aceve and Alva Labs governing this joint responsibility is set out in Alva Labs’ terms and conditions, available at their website.

7. International transfers

The activities described in this privacy notice involve transfers of personal data outside the EU/EEA, for example when we share information between our group companies. When such transfers occur we are responsible for applying mechanisms to keep the data protected according to the GDPR. This most commonly means relying on an adequacy decision adopted by the European Commission (information about such decisions are available here) or applying standard contractual clauses adopted by the European Commission (available here). 

8. Your rights and how to exercise them

There are a number of rights that you may be entitled to exercise in relation to us when we process your personal data. Below, you find a summary of what these rights involve and when they may apply.  If you want to make a request to exercise your rights, please contact us by sending an e-mail to [email protected].

We kindly ask you to note that there may be limitations to your rights and that we may have to take steps to be able to fulfil them correctly, e.g. to confirm your identity and to ensure we continue to respect the rights of others

Your rights and when they may apply:

• Right of access. You have the right to know whether we process personal data relating to you and to obtain a copy of the personal data we process about you. You also have the right to supplementary information similar to the information in this privacy notice to understand how we are using your data, e.g. why we are processing it, what categories of personal data it concerns and for how long we store it.

• Right to rectification. You have the right to have inaccurate personal data about you corrected and, in some cases, you may even supplement it.

• Right to erasure. You have the right to request erasure of personal data relating to you when we no longer have a relevant or valid reason to process or store it. 

• Right to data portability. You may ask to obtain the personal data you have submitted to us, in a machine-readable format, so that you can reuse it or have it forwarded to a third party.

• Right to object. You have the right to object to our continued processing of your personal data which may result in an obligation for us to cease the processing.

• Right to restriction. You may have the right to request that we restrict the processing of your personal data. This may for example be the case if we have incorrect information about you and you do not want the processing to continue until we have rectified it.

• Right to lodge a complaint with a supervisory authority. You have the right to lodge a complaint to a supervisory authority. For Aceve this is the Swedish Authority for Privacy Protection (Sw. Integritetsskyddsmyndigheten), but you can also lodge a complaint with your national data protection authority, which you can find listed here if you are based in the EU. If you are based in the UK, you can lodge a complaint with the Information Commissioner’s Office, here. Before you lodge a complaint with the supervisory authority, you are of course always welcome to contact us with any concerns or complaints. The easiest way to do so is to reach out via email at [email protected].

9. How to contact us

If you want to exercise any of your data subject rights, please send us an e-mail on [email protected] to submit your request.

If you have any questions or concerns regarding our processing of your personal data, you are more than welcome to contact our Privacy Office via [email protected] or via regular mail at the address below. 

Aceve AB (Attn: Privacy Office) Torsgatan 11, 111 23 Stockholm, Sweden