Talentium’S Privacy Notice for potential candidates
Last changed: March 1, 2024
[Talentium AB], reg.no. 559451-7749 ("Talentium", "we", "our" or "us") respects and protects
your privacy. This privacy notice ("Privacy Notice") aims to describe how Talentium as a data
controller processes your personal data in accordance with the General Data Protection
Regulation (EU) 2016/679 (“GDPR”) and other applicable privacy legislation. It also describes
what rights you have under the GDPR and how you can enforce them.
1
To whom does this Privacy Notice apply?
1.1
Potential candidates
This Privacy Notice applies when Talentium, as a data controller, processes personal data
pertaining to you who is included in our talent database and who is a potential job candidate for
our business customers. Talentium is an independent data controller in relation to potential job
candidates as set out in Sections 4.1, 4.3- 4.5 and a so called joint controller together with our
business customers as set out in Section 4.2.
For other processing activities related to our business customers’ recruitment process, the
business customers are independent data controllers and for such processing activities we refer
to our business customers’ respective privacy notices. In these situations, Talentium is a data
processor for our business customers if the processing is carried out through our service. For the
avoidance of doubt, this Privacy Notice only covers processing activities where Talentium acts as
an independent or joint controller and not a data processor.
1.2 If you contact us by e-mail, telephone, social media, etc.
The Privacy Notice applies when Talentium, as an independent data controller, processes
personal data pertaining to you who contact us by email, telephone, our social media accounts
or in any other way. Please see Section 4.6 for additional information.
2 contact details to Data controller
Talentium is an independent data controller for the processing of your personal data as
described in this Privacy Notice, except for the processing activities stated in Section 4.2 where
Talentium is a joint controller together with our business customers. As the data controller, we
are responsible for ensuring that our processing of your personal data takes place in accordance
with applicable data protection legislation. Where we are joint controller with our customer,
Talentium is the designated contact point for the processing, as well as if you wish to exercise
any of your rights.
If you have any questions about this Privacy Notice, our processing of your personal data or if
you wish to exercise any of your rights, please contact us at Legal@talentium.io or through the
contact details below.
Talentium AB, reg.no: 559451-7749
Address: Stora skuggans väg 28, 115 42, Stockholm
E-mail: Legal@talentium.io
Telephone number: +46761835260
How do we collect your personal data?
Your personal data is collected by us from publicly available sources on the open web such as
your employer's website, publicly available information on professional network websites such
as LinkedIn and information from search engines such as Google or Bing. We may also receive
your personal data such as e-mail address from our data partners.
We may receive your personal data directly from you when you contact us through, for example,
e-mail, our corporate social media accounts.
3 Our processing of personal data
In the tables below, you will find a summary with information about why we process your
personal data, the categories of personal data processed for the stated purpose, how long we
process your personal data and the legal basis on which we base the processing. If we base the
processing on a legitimate interest as a legal basis, we have also stated what the legitimate
interest is.
3.1 Perform a candidate search for recruitment purposes
Purpose of processing:
Processing activities:
Categories of personal data:
We process your personal data
jointly together with our
● Performing a search against
the talent search database
● Name
● Employer/company
name
business customers to create
and/or update your professional
candidate profile to enable a
mutually beneficial match
between you as a potential
candidate and our business
customers as potential
employers.
and receiving data from the
talent search database.
● Extraction of information
from the open web based
on the customer’s search.
● Compiling results from the
talent search database with
information from the open
web and data partners
(creation of a candidate
profile).
● Matching information from
the web with information
from our data partners, for
example, your name and
e-mail address.
● Display the search result for
the customer.
and your job title
● Location
● Phone number and email
address
● Candidate’s Links on social
media
● Candidate’s education
Legal basis: Legitimate interest. The processing is necessary for our and our business customers’
legitimate interest to enable a mutually beneficial match between a candidate and our business
customers. We have assessed that our interest outweighs your right not to have your personal data
processed for this purpose.
Retention period: Your personal data is only processed for this purpose as long as the business
customer reviews the result from a search in a web session. However, your personal data may be
processed for a longer period of time for other purposes as stated in this Privacy Notice.
3.2 To develop our talent database service and correct errors
Purpose of processing:
Processing activities:
Categories of personal data:
● First and last name
2
We process your personal data
independently to develop our
talent database service by,
● We save your personal data
from a search to our talent
● Employer/company name
and your job title
● Phone number and email
among other things, collecting
database.
● Collecting
aggregated
address
statistics, increasing accuracy,
processing data relating to
statistics
searches.
on
popular
popular searches in order to
● Identifying
and
correcting
improve the service and to
identify and correct errors in our
talent database.
incorrect information, links,
and other errors in the
database.
Legal basis: Legitimate interest. The processing is necessary for our legitimate interest to further
develop and correct errors in our talent database services. We have assessed that our interest
outweighs your right not to have your personal data processed for this purpose.
Retention period: Your personal data is processed for up to one (1) month.
3.3 Provide information from our talent search database for recruitment purposes
Purpose of processing:
Processing activities:
Categories of personal data:
We will share your personal data
from our talent search database
● Sharing personal data from
our talent search database
● Name
● Employer/company
name
with our business customers to
enable a mutually beneficial
match between you as a
with business customers –
see Section 4.1.
and your job title
● Location
● Phone number and email
potential candidate and our
business customers as potential
employers.
address
● Candidate’s
social media
username
on
Legal basis: Legitimate interest. The processing is necessary for our and our business customers’
legitimate interest to enable a mutually beneficial match between a candidate and our business
customers. We have assessed that our interest outweighs your right not to have your personal data
processed for this purpose.
Retention period: Your personal data is stored in the talent search database for up to one (3) month.
3.4 To enable the restructuring, sale or liquidation of Talentium or our assets
Purpose of processing:
If Talentium is to be restructured (e.g., split into several
different businesses) or if a third party wishes to acquire
Talentium or our candidate database, Talentium will
disclose your personal data to the acquiring Company.
This may also occur in the event of a merger or if
Talentium is liquidated or goes bankrupt. In such cases,
the acquiring company may continue to process your
personal data for the same purposes as stated in this
Categories of personal data:
● First and last name
● Employer/company name and job
title
● Business phone number and email
address
3
Legal basis: Legitimate interest. We process your personal data based on our legitimate interest to
enable the restructuring, sale or liquidation of Talentium or our assets, which we consider outweighs
your right not to have your personal data processed for this purpose. However, this presupposes that
the acquiring company carries on similar activities as Talentium.
Retention period: If Talentium ceases to exist, e.g., through a merger, division, liquidation or
bankruptcy, or if Talentium candidate database is transferred to an acquiring company, we will
delete your personal data as long as the retention of such personal data is not required by law.
3.5 To defend our interests in the event of a dispute
Purpose of processing:
Categories of personal data:
We may need to process your personal data in order to
defend our interests in the event of a dispute, such as to
establish, exercise or defend legal claims, e.g., in the event
of a payment dispute.
● First and last name
● Employer/company name and your
job title
● Business phone number and email
address
Legal basis: Legitimate interest. We process your personal data on our legitimate interest in being
able to establish, exercise or defend legal claims, which we consider outweighs your right not to have
your personal data processed for this purpose.
Retention period: Your personal data is retained for as long as it is needed to establish, exercise, and
defend our interests in the event of a dispute. For example, during the time that the dispute is
ongoing, before it is finally settled.
3.6 To be able to communicate with you
Purpose of processing:
Categories of personal data:
We process your personal data in order to answer your
questions or otherwise communicate with you by e-mail,
phone, text message or on our corporate social media
accounts.
● First and last name
● Employer/company name and your
job title
● Phone number and email address
● Your correspondence with us.
Legal basis: Legitimate interest. The processing is necessary for our legitimate interest to answer any
questions or otherwise communicate with you who contact us. We have assessed that our interest
outweighs your right not to have your personal data processed for this purpose.
Retention period: Your personal data is processed for up to three (3) months, unless circumstances
clearly require otherwise and we need to keep your personal data for a longer period of time to
follow up on correspondence. For example, we may process your personal data for a longer period of
time if there is an ongoing case that has not been closed or if we need to save your personal data for
any other purpose stated in this Privacy Notice.
Privacy Notice, unless you receive other information in
connection with the transfer.
4
4 LEGITIMATE INTEREST
When Talentium has stated "legitimate interest" as the legal basis in the section above, it means
that we have assessed that we or a third party have a legitimate interest in the processing being
carried out (you will also find information about what the identified legitimate interest is in the
section above). In addition to identifying the legitimate interest, we have also weighed this
interest against your interests or fundamental rights and freedoms that require the protection of
personal data. We can only base the processing of your personal data on a legitimate interest as
a legal basis if we have carried out a balancing of interest and concluded that our or a third
party's interests outweigh your interests or fundamental rights and freedoms.
5 Automated decision-making
We do not use automated processes to make decisions that significantly affect you.
6 How long we retain your personal data
We will only retain your personal data for as long as it is needed for the purposes for which we
collected the personal data and as described in this Privacy Notice. When we no longer need
your personal data, we will remove it from our systems, databases, and backups unless we have
a legal obligation to save your personal data for a longer period. More specific retention periods
are provided in the tables above under section 4.
7 With whom do we share your personal data?
Talentium may disclose your personal data to the categories of recipients listed below. For a
detailed list of the recipients to which we have disclosed your personal data, please contact us
through the contact details provided in section 2.
7.1 Data processors
Talentium may engage other companies to process your personal data on our behalf as data
processors. Such companies may only process your personal data in accordance with our
instructions. We enter into data processing agreements with these companies and ensure a high
level of protection to safeguard your personal data. We use the following types of data
processors:
● IT and system suppliers – Talentium may share your personal data with IT and system
suppliers to manage necessary operation, technical support and maintenance of our IT
services.
● Marketing and communications agencies – Talentium may share your personal data
with marketing and communications agencies engaged to assist Talentium with
marketing communications to customers and potential customers.
7.2 Independent data controller
Talentium may share personal data with parties who are independent data controllers, which
means that the party independently determines the purposes for which the personal data will
be processed and how the processing will be carried out (i.e., the means for the data
processing). When sharing personal data with these parties, they have an obligation to inform
you about their processing of your personal data. Hence, their respective privacy notice applies
to their processing.
● Authorities and the judiciary – in some cases, we may need to disclose your personal
data to courts and law enforcement authorities (e.g., the police authority) in accordance
with law or in the context of court proceedings. Additionally, we may also need to
disclose personal data to other parties in court proceedings or similar. Such disclosure is
based on a legitimate interest as a legal basis or to fulfill a legal obligation under law.
5
7.3
● External advisors – we may share your personal data with external advisors, such as
audit firms or law firms, in accordance with law or to obtain advice. These advisors
usually act as independent data controllers, and a disclosure is usually based on a
legitimate interest as a legal basis.
● Acquiring company – if Talentium is to be restructured (e.g., split into several different
businesses), or if a third party wishes to acquire Talentium or our candidate database,
Talentium will disclose your personal data to the acquiring company. This may also occur
in the event of a merger or if Talentium is liquidated or goes bankrupt. In such cases, the
acquiring company will continue to use your personal data for the same purposes as
stated in this Privacy Notice, unless you receive other information in connection with
the transfer. However, this presupposes that the acquiring company carries out similar
activities as Talentium. In order to enable a restructuring, sale or liquidation, personal
data may also be shared with other companies as part of the process. In such cases, the
companies have undertaken to observe confidentiality. This is described in more detail
in sections 4.4.
● Social media – if you contact Talentium through our corporate social media accounts,
the social media platforms will process your personal data in accordance with their
respective privacy notice as an independent data controller.
Joint controllership
Talentium as an independent data controller may share personal data with our business
customers as a joint controller with us, if your personal data is stored in our talent search
database and a business customer performs a search. This type of disclosure is based on a
legitimate interest – please see Section 4.3 above.
8 Where do we process your personal data?
Talentium strive to process your personal data within the EU/EEA. In certain circumstances, we
may need to transfer your personal data to a country outside the EU/EEA ("Third Country"), as
set out below.
If your personal data is transferred to a Third Country outside the EU/EEA that is not covered by
an adequacy decision by the EU Commission, we will ensure that there are appropriate
safeguards in place. Appropriate safeguards may be that the party transferring the personal data
to a Third Country (the data exporter) and the party importing personal data into a Third
Country (the data importer) have entered into the EU Commission's standard contractual clauses
for international transfers or that other safeguards have been taken. In the event that these
safeguards are not considered sufficient, we can ensure that we have also taken contractual,
technical or organizational supplementary measures to ensure an essentially equivalent level of
protection as within the EU for the personal data transferred to the Third Country.
The table below specifies which countries’ personal data will be transferred and what
appropriate safeguards have been taken for the transfer to take place.
Country outside of the EU/EEA:
Appropriate safeguards:
USA
Data Privacy Framework (DPF).
6
Please contact us through the contact details provided under section 2 for more information on
a specific transfer or to obtain a copy of the relevant documentation regarding the safeguards
taken. You can also read more at the Swedish Authority for Privacy Protection website, available
here, regarding what applies under the GDPR for transfers to Third Countries and appropriate
safeguards.
9
Your rights
9.1
Our responsibility for your rights
Talentium is responsible, in its capacity as data controller, for ensuring that your personal data is
processed in accordance with applicable data protection legislation and that you can effectively
exercise your rights under the GDPR. You can find more information about your rights in the
sections below and at the Swedish Authority for Privacy Protection (IMY's) website, available
here. In order to exercise your rights, you may contact us at any time through the contact details
provided under section 2 in this Privacy Notice. Please do not forget to specify the right to which
the request relates.
Time limits
Talentium is obliged to respond to your request to exercise your rights within one month of
receiving your request and to inform you of the action taken. In the event that a request is
complex or if we have received a large number of requests, we are entitled to extend the time
limit by two additional months (i.e., in total no later than three months from receipt of the
request). We will notify you of such an extension including the reason for the extension within
one month. If we do not take any action in response to your request, we are obliged to notify
you within one month of receipt of your request: (i) that the action has not been taken; (ii) the
reason for this; and (iii) inform you of your right to lodge a complaint with the supervisory
authority and seek judicial redress.
As a general rule, it is free of charge
All information, communication and actions we carry out are free of charge for you. If requests
related to your rights are manifestly unfounded or unreasonable, we have the right to either
charge a reasonable administrative fee for providing the information or carrying out the
requested action. We may also refuse to comply with your request.
We may need to identify you
If we have reasonable grounds to doubt the identity of the applicant, we may request additional
information necessary to confirm your identity. We will not collect more personal data than
necessary.
9.2 Your rights of access, rectification, erasure and restriction
According to the GDPR, you have certain rights in relation to the data we process about you,
which are described below. Some of these rights apply under certain conditions, which you can
read more about below. You have the right to request the following rights.
a) Access to your personal data. In order for you to check whether processing of your
personal data is taking place and whether the processing is lawful, you have the right to
request access to your personal data. This means that you have the right to receive
confirmation of whether we process your personal data and, if so, receive a copy of the
personal data we are processing about you, free of charge. If you are only interested in a
7
certain category of personal data or data processed for a specific purpose (for example,
direct marketing), please indicate this in your request. In connection with the access
request, you will also receive information about the processing, such as the reason why
we process your personal data (i.e., the purpose of the processing), the envisaged
period for which the personal data will be stored (if possible), to whom the personal
data have been or will be disclosed, etc. For any additional copies you request, we are
entitled to charge a reasonable administration fee to cover our administrative costs. If
you make a request in electronic format, such as by e-mail, we will provide you with the
information in a commonly used electronic format, unless you request otherwise.
b) Rectification or completion of your personal data. If we process personal data that is
inaccurate, you have the right to request rectification. We will also, on our own
initiative, rectify or erase information that we discover to be inaccurate. You also have
the right to complete any incomplete personal data by providing a supplementary
statement.
c) Erasure of your personal data. In some cases, you have the right to have your personal
data deleted. This applies in the event that:
There are exceptions to the right to erasure. For example, there may be requirements
in law or other compelling reasons that prevent us from deleting your personal data. A
strong reason may be, for example, to establish, exercise or defend Talentium against
legal claims. We may also be prevented from deleting your personal data due to
archiving purposes in the public interest, scientific or historical research purposes or
for statistical purposes.
d) Restriction of processing. This means that we temporarily restrict the processing of your
personal data so that they are only processed for certain limited purposes. We will
inform you before the restriction of processing ends. You have the right to request
restriction when:
8
iv. you have objected to the processing as set out in section 10.3, while pending
verification of whether our legitimate grounds override yours.
We will take all reasonable measures possible to notify all recipients of your personal data as set
out in section 8 above if we have rectified, erased or restricted access to your personal data
after you have requested us to do so, provided that it is not impossible or if it would involve a
disproportionate effort. At your request, we will inform you about who we have disclosed
personal data to.
9.3 Your right to object to our processing of your personal data
You have the right to object to our processing of your personal data if we base the processing on
a legitimate interest or public interest as a legal basis (see section 4 above). When you object,
you must provide reasons for your objection that are related to your specific situation. If you
object to a processing, we will only continue the processing if we have compelling legitimate
grounds to continue the processing which override your specific reasons, interests, rights and
freedoms or if the processing is necessary to establish, exercise or defend legal claims.
9.4 Your right to object to direct marketing including profiling (if applicable)
If you do not want us to process your personal data for direct marketing purposes, which include
profiling, you always have the right to object to such processing (including profiling) by
contacting us. Once we have received your objection, we will cease to process your personal
data for this purpose.
9.5 Your right to withdraw your consent
If we process your personal data based on your consent as a legal basis (see section 4 above),
you have the right to withdraw your consent at any time by contacting us. We are then not
entitled to continue the processing of your personal data if there is no other legal basis for the
processing. You will find our contact details in section 2 of this Privacy Notice.
9.6 Your right to data portability
You have the right to data portability when we process your personal data by, for example,
automated means and when the legal basis for the processing is your consent or performance of
a contract. Your right to data portability means that you have the right to receive the personal
data that you have provided to us in a structured, commonly used, and machine-readable
format and to transfer this personal data to another data controller. You may also request that
we transfer the personal data directly to another data controller, provided that such direct
transfer is technically possible.
9.7 Your right to lodge a complaint with the relevant supervisory authority
You always have the right to lodge a complaint with the relevant supervisory authority if you
believe that our processing of your personal data violates the GDPR. This is particularly the case
in the member state where you have your habitual residence, place of work or where the
infringement was committed. The supervisory authority in Sweden is the Swedish Authority for
Privacy Protection (IMY). You can contact IMY through the e-mail address imy@imy.se or
through the contact details provided on IMY's website, available here.
10 We protect your personal data
Our mission is that you feel comfortable when we process your personal data. We have
therefore implemented both technical and organizational security measures, including access
restrictions and regular internal controls, to protect your personal data against, for example,
unauthorized access, alteration, or loss. In the event of a personal data breach that could
significantly affect you or your personal data, such as the risk of fraud or identity theft, we will
9
contact you to explain what has happened and advise you on how to reduce the risk of
potentially harmful effects.
11 Changes to this Privacy Notice
Talentium may change this Privacy Notice. In the event of a change, you will receive clear
information about the change and what it means for you within a reasonable time before the
amended version becomes effective. This applies provided that the change is not merely
linguistic or editorial but involves a fundamental change in the processing itself, or if the change
is not a fundamental change but we consider it to be relevant and to affect you. If a change in
the processing of your personal data requires that your consent is obtained, you will be notified
of this and given the opportunity to provide your consent.
You can always find the latest version of the Privacy Notice on our website and we will always
indicate the date of the last update at the top of the Privacy Notice.
10