Privacy Statement

Processing of personal data within The Assessment Company

When in contact with us, whether by using our website, by being a candidate in our application procedures for our customers, by being one of our customer’s contact people through recruitment services or training and development programs or by utilizing any of our other services, The Assessment Company processes personal data about you. Your privacy is very important to us, and this privacy policy describes all relevant information about what personal data is collected, why it is collected and what rights you have based on our processing of the personal data.

In certain occasions, we will ask for special consent from you, which will be clearly stated in our communication with you.

The Assessment Company AS is responsible for the processing of the personal data. Our contact information is:

Address: Parkgata 83, Postbox 16, 2301 Hamar

E-mail: post@theac.no

Telephone: 928 95 757

Org.nr. 919 294 299

For most recruitment processes, we will have a common processing responsibility (data controllers) together with our customers, i.e. the company we are recruiting on behalf of. This is especially relevant in recruitment processes where the groups of candidates consist of both internal, existing employees with our customers, as well as external candidates. When these cases occur, you can exercise your rights in personal data for both of the data controllers.

Collection of information

We collect and utilize your personal data for different purposes depending on your identity and how we came in contact with you. We collect the following personal data for the purposes stated below:

As a candidate in a recruitment process. To be able to process your candidacy in the best way, we are dependent on having some information regarding yourself. This can occur automatically, or by registering your information in our systems. The collection of information can occur in ways such as:

• Information from registration of CV-profile and update(s) of the profile through “my profile” in our candidate management system, as well as IP-address
• This information includes contact information, identity documentation, CV, application, potential testimonials, personality and ability tests, diplomas and statements from references
• If you apply for a position or register your profile through the “Search with LinkedIn”- function or the “Search with jobreg”- function, the system will collect available information from your profile in the service you use, and the information will be saved on your profile
• In certain cases, we will collect information from you without you personally applying for a position, by us registering your name, current position and company, contact information (phone number, e-mail and such)
• We collect data in an aggregated form for visitors of the page, for example traffic data, location data etc.
• In some cases, we will save the e-mail correspondence when you contact us¨

By voluntarily providing us with information in the recruitment process, you are also aware that we will forward your personal data to our customer whom we are recruiting for, and in accordance with GDPR Article 6(1)(b), we will be able to process the data that is provided in general forms with information. As an applicant, you can choose if you only wish to be considered for the position(s) you applied for, or if you also wish to be available for other recruitment processes.

Certain candidates (those who will participate in the final part of recruitment processes, amongst others), will be asked to complete different tests whereas the results are presented as reports or notes can be saved. Certain candidates will also be asked to complete case studies that will be filmed and stored. The candidates that make it this far, will give their consent for this specifically before this kind of processing and storage occurs.

In certain processes, it is demanded that we acquire police certificates and credit data. Collection and processing of this type of data is based on GDPR Article 6(1)(a) (consent).

In assignments where we recruit people for public bodies, there shall be created a public list of applicants based on public law, containing the name, age, position, job title as well as residence location or municipality in which they work for each individual applicant. We and our customer are in these cases required to share these personal data. If the candidate wishes to be excluded from a public list of applicants, a personal request is required.

The processing is based on GDPR Article 6(1)(b), when the candidate themselves are applying for a position and based on GDPR Article 6(1)(f) when the process occurs by our own measures. Where the candidate completes special case studies with the corresponding videotaping and other measures, the process occurs based on GDPR Article 6(1)(a) (consent).

The information collected, is used to where it is deemed necessary to:

• Deliver services to you and communicate around these services with you
• Create an assessment of your qualifications and facilitation in relation to current and future recruitment assignments or staffing assignments
• Inform about relevant opportunities and performances we offer
• Compliance of legal obligations
• When we collect IP-addresses, this is done due to safety reasons, so you as a candidate can acquire an overview of the IP-addresses that have logged in to your account

If we keep the application documentation after a recruitment process is finished, it occurs since the process is necessary for purposes related to entitled interest.

As a candidate in a search(headhunting)-process: In certain assignments for our clients, we search for candidates that are not actively applying for the job, by collecting information from publically available sources, such as Google and LinkedIn. In these cases, we process names, e-mails, phone numbers and positions, combine them into a register which we forward to our clients. The process occurs based on GDPR Article 6(1)(f) (this process is necessary for purposes related to entitled interest). If you are registered by one of these methods in our register, you will be sent information on an e-mail, where you can easily deregister yourself if you do not wish for us to process your personal data.

As a participant in a training and development program. To complete the training and development program in an efficient way, it is necessary for us to process your personal data. We make special deals with clients that define the framework for the specific assignment. The training program entails that we collect data such as names, phone number, e-mail address, reports and notes from various personality tests, and by completing case studies with videotapes and such, where the tape is stored as long as it is necessary to extract all benefits from the training. Every participant will fill out a special registration form before completing such tasks, where consent for the processing of data is given. The processing of the data occurs based on GDPR Article 6(1)(a) (consent) for parts of the training program and based on GDPR Article 6(1)(b) for further registration.

As a contact person for a company that is a customer in a recruitment mission. To complete recruitment missions to your business, it can be necessary to process personal data for one or multiple contact persons from the business. This applies to name, position, phone number and e-mail address.

By billing. In this connection, contact information and payment information is processed. The processing is based on GDPR Article 6(1)(b) (this process is necessary to grant a deal that the registered is a part of)

As a supplier. As a representative for our suppliers, certain cases can occur where it is necessary to process personal data as contact information. The process occurs based on GDPR Article 6(1)(f) (this process is necessary for purposes related to entitled interest).

Distribution of marketing, newsletters and other relevant information. In this case, the name and e-mail address are processed. The processing occurs based on consent from those who receive the marketing after the marketing law § 15.

Data that is collected through our websites. We only process personal data that is stated through our websites in connection with the follow-up of the users. The data is not utilized for any other purposes without special consent, or the establishment of a contractual relationship as well as the processing of the data is in accordance with GDPR Article 6(1)(b) (this process is necessary to grant a deal)

Extradition av personal data to others

We do not extradite or transfer your personal data to others unless there is a legal reason for it. There will exist a legal reason for us to transfer your personal data to third parties in a number of occasions, including recruitment processes where we must forward the information to our customer in accordance with GDPR Article 6(1)(b) (this process is necessary to grant a deal), in certain cases where special consent is given, or in cases where the processing responsible or data processor is committed to taking this action as a legal requirement.

These third parties have separate and independent privacy policy guidelines. The Assessment Company Norge AS does not have responsibility for the content and activities attached to those services, but we still encourage the third parties, including our customers, to process the information in a defendable manner and in accordance to what the privacy policy rules states at all times. We wish to uphold the integrity of the services we offer and limit what information we share to a minimum.

We can also transfer data between our Norwegian and Swedish companies, where there is a special and mutual data processing agreement for projects where staff from Norway and Sweden are involved at the same time.

The Assessment Company utilizes different data processors to process personal data on our behalf. In these cases, we have made data processing agreements to maintain the security of your information in all parts of the processing and to regulate what information the data processor has access to and how the information shall be processed. We utilize the

following data processors today:

• Recruitment Manager AS, candidate management system
• Master Management Norge AS
• Optimas AS
• Semac AS
• Xref
• Dustin AS
• Azets AS

All processing of personal data that The Assessment Company carries out, happens within the EU/EEA area. We expect also the use of data processors that process personal data within the EU/EEA area or fulfils the privacy policy law requirements to process data in areas outside the EU/EEA.

Storage time

We store your personal data as long as it necessary for the purpose of why your personal data was collected.

This entails for example personal data that we process based on your consent will be deleted if you withdraw your consent. Personal data that we process to uphold an agreement with you, is deleted when the agreement is completed and all duties as a result of the agreement have been completed, and there is, after a concrete interest evaluation, no reason for us to keep the personal data.

The personal data we collect and that is necessary for purposes related to an entitled interest, will be deleted when there no longer is an entitled interest.

Personal data that we process to uphold a judicial commitment from the government, will be deleted when decided by the law. This applies for example to bookkeeping and accounting rules.

In the table below, there is an overview of how long we process the personal data for different purposes:

Purpose	Storage time
Recruitment mission for customer – information about candidates that him/herself has stored.	We store the information in our systems until the candidate him/herself deletes his/her profile or information.
Recruitment mission for the customer – information about candidates that the candidate him/herself has not stored (test results, videotapes, reports, etc)	Based on entitled interest: 12 to 18 months after finished recruitment process. With consent from the applier, we can store the information for up to 3 years for use in other relevant advertisements for positions. Videotapes from PEOPLE LAB is stored based on consent and deleted within 10 weeks after finished recruitment process.
Training missions for customer – information about participants	Up till 1 year after the participant had finished their work relationship with the customer, assuming that the customer or person him/herself enlightens us on the work relationship’s end
Customer information	Up till 10 years after the end of last case
Billing information	Up till 5 years after the end of the year the billing was undertaken
Information about potential candidates	Up till 6 months (if the information is not used in other contexts that allows further storage). In cases where the candidate has given consent, we store information in our systems until the candidate him/herself delete his/her profile or information
Security logs	Up till one year
Backup copies	Up till 3 years

We use cookies to improve user-friendliness and security

Cookies (information capsules) are small files that are stored in your browser or on the device you use when you open a website. Like most websites, we utilize cookies to provide you with a better, faster and safer user experience. We use cookies to, for example:

• To enable certain functions in our candidate management system.
• Improve security for your account and other accounts in our system.
• Provide insight into user behaviour for the improvement of the user experience.
• Provide insight into the traffic on our websites to customize content and marketing.

We use industry-standard analysis tools to analyse visitors, and these tools can implement cookies into your browser, to provide an insight into user behaviour by using the website. Data processors collect, through the analysis tool Google Analytics, de-identified data on the visitors. The purpose of this is to create statistics that are used to improve and develop information provision and the service that is delivered. Examples of what the statistics are used for is: information about how many visit different websites, how long the visit lasts, what websites the users come from and what browsers they use.

Through your use of the system, it can occur that some of the pages contain services that are provided by third parties such as maps in a position ad provided by Google Maps, Vimeo etc, and use of websites that contain these services can lead to using more cookies. Tech Group AS has no control over this, and we recommend you to familiarize yourself with the privacy policies from these services as well.

If you utilize the “apply with LinkedIn”-function or the “apply with jobreg”-function in our recruitment system, it will implement a cookie from the respective third parties.

Blocking and deleting cookies

If you do not wish for the implementation of cookies when you visit the website, you can change this under settings in your browser. More information regarding this matter can be found under the documentation from your browser. Notice that if you turn off the possibilities for the websites to implement cookies, it can affect your user experience as well as some non-functioning features on the webpage.

You can also delete existing cookies in your browser. Se your browser’s documentation for more information regarding this matter.

Insight, editing and deleting your personal data

You have, as a system registrated individual, the right to claim insight, correction and deleting of your personal data that we process. The claim shall be answered free of charge and within 30 days after it was put forward.  You can also demand limited processing of the data and under certain circumstances, object to the processing of the data.

As a candidate, you can at any time delete your profile from “My profile” in the system, or contact The Assessment Company Norge AS for assistance. From your profile you can also edit information you have previously posted on your profile.

If you want an insight into the information The Assessment Company Norge AS has on you, exercise your rights as previously mentioned, or have any questions or input into our processing of personal data, you can contact your contact person in our company or use our contact details as previously stated in this document. We will, in that case, ask you to confirm your identity or state more information about yourself, before we allow you to exercise your rights on us. This is as a precaution to make sure that we only provide you with access to your personal data – and not someone posing as you.

Complaints

If you believe our processing of personal data does not correspond with what we have written here or you believe that we are breaking the law of privacy policy in other ways, you can complain to The Norwegian Data Protection Agency. You will find information regarding contacting Datatilsynet on Datatilsynet’s websites: www.datatilsynet.no.

Changes

If a change was to occur in our services or in rules of processing personal data, it can bring upon change in the information you have been given here. If we possess your contact information, we will enlighten you of these changes. In addition, updated information will always be easily accessible on our website.