1. Data controller
Search & Selection – S&S Consulting Oy Ab
Business ID: 2373027-6
Address: Itälahdenkatu 18 A, 00210 Helsinki
Tel. +358 9 686 0570
2. Data protection officer
Sanna Leppäluoto
Address: Itälahdenkatu 18 A, 00210 Helsinki
Tel. +358 50 344 6864 or +358 9 686 0570
3. Register name
Candidate Register – Search & Selection – S&S Consulting Oy Ab
4. Purpose and legal basis for processing personal data
Search & Selection – S&S Consulting Oy Ab is a recruitment company. Company's business is based on finding suitable candidates and presenting them to clients. Assignments are based on the client’s need to fill a vacancy, and the goal is to establish an employment relationship with a candidate who meets the search criteria.
The legal basis for processing personal data is the controller’s legitimate interest in carrying out a client agreement, as well as the candidate’s consent when the candidate is presented to a client or when data is processed in connection with aptitude assessments.
The primary purpose of processing personal data is the execution of recruitment services. The register contains information about individuals who have registered as job applicants or wish to be considered as candidates through S&S Consulting.
5. Data content of the register
The Candidate Register contains personal data either provided by the candidate or gathered from public sources. This data includes:
- first and last name
- other names
- street address, postcode and city (not mandatory if collected from public sources)
- phone numbers (work, mobile)
- email addresses (work, private)
- personal website
- LinkedIn profile
- home country
- basic education and completed training
- education-related information (field and level of education, major subject and details, start and end years of studies, degree, educational institution)
- work history (employer, industry, role, area of responsibility, start and end date of employment, notice period)
- language skills (self-assessed)
- special skills
- results from aptitude assessments
- preferences for future roles (responsibility area, industry, target level, salary expectations and other goals)
- self-assessment and the consultant’s assessment of suitability for a specific vacancy
- references
6. Regular data sources
Data is collected from:
- the candidate directly (by phone, email, web form, or personal meeting)
- public sources (e.g. LinkedIn, company websites, articles)
- purchased databases or registers
- aptitude assessments, based on a separate consent
- Candidates are always informed in accordance with applicable law when data is collected from other sources (e.g. references).
7. Data disclosure and transfer
- To client companies that have issued a recruitment assignment – only with the candidate’s consent
- To authorities, in cases required by law
Data is not disclosed for direct marketing purposes, nor is it transferred outside the EU or EEA without the explicit consent of the data subject.
8. Data retention period
Personal data is stored for as long as:
- the recruitment process or client relationship remains active
- the candidate has not requested the deletion of their data
Old data is regularly reviewed and deleted. If a candidate has been inactive for 24 months, their data will be deleted or anonymized, unless otherwise agreed.
9. Register protection principles
All personal data is processed confidentially and protected using the following measures:
- data is stored in technically protected systems
- access is restricted via user credentials and multi-factor authentication
- physical access is restricted through security measures
- only designated personnel of the controller may process the data
10. Rights of the data subject
Right of access: The data subject has the right to know what personal data has been stored about them. The request must be made in writing or in person, and identity verification is required. Data will be provided without undue delay, no later than within 30 days.
Right to rectification: The data subject has the right to request correction of inaccurate or outdated data.
Right to erasure: The data subject may request their data to be deleted at any time. Data will be deleted without undue delay unless there is a legal or other justified reason to retain it.
Right to data portability: Upon request, the data subject’s information can be provided in a machine-readable format and transferred to another recruitment provider.
Right to object: The data subject may object to the processing of their data on the basis of legitimate interest.
Right to file a complaint: In Finland, the supervisory authority is the Office of the Data Protection Ombudsman (www.tietosuoja.fi).
11. Automated decision-making and profiling
No automated decision-making is used in the services.
12. Consent
By registering for recruitment services with Search & Selection – S&S Consulting Oy Ab, the candidate accepts the terms of the privacy policy. Consent is requested separately when the candidate is presented to a client or when data is processed in connection with aptitude assessments.
Updated: 16.4.2025