Trevian Asset Management Oy – Recruitment system privacy notice
Privacy notice in accordance with the General Data Protection Regulation of the European Union (GDPR). This privacy notice explains how Trevian Asset Management Oy processes the personal data of job applicants in connection with the recruitment process.
1. Controller
Trevian Asset Management Oy
Business ID 2507543-9
Erottajankatu 2, 3rd floor
00120 Helsinki
Email: tietosuoja@trevian.fi
Telephone: +358 10 581 3830
Contact person for matters concerning the register:
Tiina Kaakkolahti, Chief Human Resources Officer
2. Name of the register
Recruitment system
3. Purposes and legal bases for processing personal data
The personal data of job applicants is processed for the purpose of carrying out Trevian’s recruitment processes. The purposes of processing include:
– receiving and managing applications
– assessing applicants’ suitability and qualifications
– conducting interviews, personal assessments and other stages of the recruitment process
– communicating with job applicants
– making and documenting recruitment decisions
– handling rights and obligations related to the recruitment process and establishing, exercising or defending legal claims.
Depending on the situation, the processing of personal data is based on:
– steps taken at the request of the job applicant prior to entering into a contract
– Trevian’s legitimate interest in carrying out recruitment and safeguarding its rights in possible legal claims
– compliance with Trevian’s legal obligations
– the job applicant’s consent, where consent is the appropriate legal basis for the processing, such as in suitability assessments or retaining an application for future recruitment processes.
Trevian processes only such personal data that is necessary for the position applied for and the recruitment process. The requirement of necessity cannot be waived by the job applicant’s consent.
4. Data content of the register
The register may contain the following data:
– name and contact details
– information provided in the application, curriculum vitae and other documents submitted by the job applicant
– information concerning education, work experience, skills, language proficiency and other professional capabilities
– information concerning the position applied for, salary expectations, availability and the progress of the recruitment process
– information provided in interviews and necessary notes and assessments made by persons participating in the recruitment process
– names and contact details of referees provided by the job applicant and information received from references
– information and summaries related to personal and suitability assessments, where such assessments are carried out
– any photographs, videos or work samples submitted by the job applicant
– information concerning consents, objections and data protection requests
– technical log and usage data of the recruitment system for ensuring information security and system functionality.
Data belonging to special categories of personal data or data concerning criminal convictions and offences is processed only if it is necessary for the position in question and there is an explicit statutory basis for the processing.
5. Regular sources of data
Personal data is primarily collected from the job applicant, for example from the application, curriculum vitae, interviews, assessments and other communications related to recruitment.
Data may be collected from referees provided by the job applicant or from other sources with the job applicant’s consent. If data is collected from sources other than the job applicant, the job applicant will be informed of the data obtained before it is used in decision-making concerning them, unless an exception is provided by law.
6. Recipients and disclosures of personal data
At Trevian, personal data is processed only by persons whose duties include the recruitment in question, such as HR representatives, the recruiting manager and any other persons needed to participate in the recruitment decision.
Data may be made available for processing by service providers acting on behalf of Trevian. These may include providers of the recruitment system, IT and cloud services, and personal and suitability assessment services. Service providers process the data in accordance with Trevian’s instructions and written agreements.
Data may be disclosed to authorities or other parties if required by law or by an order of a competent authority. In other situations, data is disclosed to external parties only on a lawful basis.
7. Transfers of personal data outside the EU or EEA
Personal data is primarily processed within the European Union or the European Economic Area. However, some of the service providers used by Trevian may process personal data outside the EU or EEA.
Where personal data is transferred outside the EU or EEA, Trevian ensures the lawfulness of the transfer by using an applicable transfer basis under the GDPR and the necessary safeguards. These may include an adequacy decision by the European Commission, standard contractual clauses approved by the European Commission and, where necessary, supplementary safeguards or another transfer mechanism permitted by law.
8. Protection of personal data and information security
Access to job applicants’ personal data is restricted to persons who need the data in order to handle the recruitment process. Access rights are defined based on duties and are removed when the need for processing ends.
Data is protected by appropriate technical and organizational measures, such as personal user credentials, access rights management, authentication and encryption solutions, logging, information security updates and staff instructions. Persons processing personal data are bound by a confidentiality obligation.
9. Retention period of personal data
Personal data related to the recruitment process is retained for no longer than six (6) months after the recruitment process has ended, after which the data is deleted or anonymised, unless there is a statutory basis for longer retention or a need to retain the data for establishing, exercising or defending a legal claim.
If the job applicant gives separate consent for retaining their data for future recruitment processes, the data may be retained for the period specified in the consent. Consent may be withdrawn at any time. In such case, the data will be deleted unless there is another lawful basis for retaining it.
The results of personal and suitability assessments are retained only for as long as they are necessary for the recruitment in question or there is another lawful basis for retaining them.
10. Automated decision-making and profiling
Trevian does not make recruitment decisions concerning job applicants solely on the basis of automated processing in a manner that would produce legal effect concerning the applicant or similarly significantly affect them. Any assessment tools are used to support the recruitment decision, and a human being always participates in the final assessment.
11. Rights of the data subject
In accordance with applicable data protection legislation, the job applicant has the right to:
– receive information about the processing of their personal data and access their personal data
– request the rectification of inaccurate or incomplete data
– request the erasure of personal data where the conditions for erasure are met
– request the restriction of processing of personal data
– object, on grounds relating to their particular situation, to processing based on legitimate interest
– receive the data they have provided in a structured, commonly used and machine-readable format and transmit it to another controller where the conditions for the right are met
– withdraw consent at any time without affecting the lawfulness of processing carried out before the withdrawal
– not be subject to a decision based solely on automated processing that produces significant effects
– lodge a complaint with the competent supervisory authority.
The rights are not absolute in all situations; their applicability depends, among other things, on the legal basis for the processing.
Requests concerning the rights may be sent by email to tietosuoja@trevian.fi. Trevian may request additional information to verify the job applicant’s identity. Requests will be responded to within the time limit required by data protection legislation.
12. Right to lodge a complaint
If the job applicant considers that their personal data has been processed in breach of data protection legislation, they have the right to lodge a complaint with the competent supervisory authority.
Recruitment system privacy notice
PO Box 800
00531 Helsinki
Telephone exchange: +358 29 566 6700
Website: tietosuoja.fi
13. Applicable legislation and updates to this notice
The processing of personal data is subject in particular to:
– the General Data Protection Regulation of the European Union (EU) 2016/679
– the Finnish Data Protection Act (1050/2018)
– the Finnish Act on the Protection of Privacy in Working Life (759/2004)
– other legislation applicable to recruitment and the processing of personal data from time to time.
Trevian may update this privacy notice, for example due to changes in legislation, authority guidance, recruitment practices or the systems used. The up-to-date version will be published on Trevian’s website or in the recruitment system.
Recruitment system privacy notice | 13.8.2026