Joint controllers

Name: Oral Hammaslääkärit Ltd
Business ID: 2863321-3
Postal and street address: Linnoitustie 6 B, FI-02600 Espoo, Finland
Tel.: +358 (0)10 400 3010 (switchboard)

Name: Oral Hammaslaboratorio Oy
Business ID: 2217415-9
Street address: Laippatie 4 C, 00880 Helsinki

Contact person in matters concerning the register

Name: Taina Holla-Parhiala
Email: rekry@oral.fi

Contact information of the Data Protection Officer

Name: Henna Salo / Fondia Oyj
Email: tietosuojavastaava@oral.fi

Name of the register

Oral Group’s recruitment register (Teamtailor and Jobilla)

Purpose of and legal basis for the processing of personal data

The purpose of the processing of personal data is the recruitment of personnel (including self-employed practitioners) for the Oral Group. The processing of personal data is based on the consent given by data subjects (such as the processing of a job applicant’s application, the conduct of personality and suitability assessments as well as the storage and processing of the data for subsequent recruitment purposes) and on Oral’s legitimate interest (such as carrying out the recruitment process).

Categories of data subjects

Job applicants of the Oral Group (including self-employed practitioners)

Data content of the register

The recruitment register contains the following personal data on job applicants that is necessary for the recruitment process and for the position being applied for:

Basic information:

  • first name and last name
  • contact details (such as postal address, email address and telephone number)
  • place of residence
  • job title

Information relating to the application and collected during the recruitment process:

  • information related to the assessment of the job applicant’s qualifications, suitability and competence, such as previous work experience, educational background, language skills, and other competences
  • information related to the job application and CV submitted by the job applicant
  • information about the position being applied for
    information generated during the recruitment process, such as interview notes and other notes, information related to personality and suitability assessments, and information related to the progress of the recruitment process and the selection decision
  • email correspondence and other communication
  • information on whether the job applicant’s application may be used in other Oral Group’s recruitments
  • any other information provided by the job applicant themselves

Other information:

  • information on whether the applicant has enabled the Connect (networking) functionality
  • email address and search terms used if the job applicant has subscribed to automatic job alert notifications for Oral Group’s vacancies via the Connect (networking) functionality

Regular sources of the register’s data

The data is obtained primarily from the data subject themselves. Data may also be obtained from references named by the applicant and from public registers related to the oral healthcare sector (such as the central register of health care professionals), and, with the job applicant’s consent, from other public sources (such as LinkedIn). In addition, data also consists of information recorded during the recruitment process.

Regular disclosure of data

Personal data is not regularly disclosed to third parties. However, personal data may be disclosed to a company belonging to the same group as Oral, located in Switzerland, for the purpose of approving recruitments.

Data processors

Oral uses external service providers in the processing of personal data, who act on behalf of Oral under data processing agreements in accordance with the General Data Protection Regulation.

The technical platform of the recruitment register is an electronic recruitment system. The supplier of the system (Teamtailor AB) is responsible for the technical implementation of the system.

The technical implementation of recruitment campaigns conducted on social media is the responsibility of Jobilla Oy.

In addition, Oral may use external service providers (such as recruitment consultants) to procure various recruitment services (including the conducting of personality and suitability assessments). The data subject may request more detailed information about the data processors used by contacting the contact person for the register.

Transfer of data outside the EU or EEA

Data contained in the electronic recruitment system is regularly processed outside of the European Union or the European Economic Area as follows:

  • Data submitted by the job applicant on the application form or in its attachments is processed in the United States by a sub-processor of the recruitment system supplier (Fastly, Inc. and/or Section.io). The protective measures required by the EU General Data Protection Regulation have been implemented by the recruitment system supplier in the following manner: the recruitment system supplier (Teamtailor AB) and the sub-processor (Fastly, Inc. and Section.io) have concluded an agreement on the transfer of data in accordance with the standard contractual clauses (SCC) approved by the EU Commission.
  • For the purpose of approving recruitments, personal data may be transferred to a group company located in Switzerland. The transfer of personal data to Switzerland is lawful on the basis of an adequacy decision issued by the European Commission.

In addition, data transfer may occur outside of the European Union or the European Economic Area, for example in cases where the job applicant or a person participating in the recruitment process is located outside of the European Union or the European Economic Area when using the electronic recruitment system. In such cases, the security of the data being processed is ensured by using encrypted data connections.

The principles of register protection:

The service provider of the electronic recruitment system (Teamtailor AB) and the service provider for recruitment campaigns conducted on social media (Jobilla Oy) are responsible for the technical protection of the data stored in the register, which includes, for example, the service’s internal data security, access control, software security updates, and backups. The security of the systems is tested not only through internal testing but also through security audits carried out by third parties. Data communications between the systems and the user’s browser are always protected by strong encryption.

Access to the data in the register is restricted to persons responsible for recruitment. Each person using the register has a personal username and password for the system. All persons who access data in the register are bound by a duty of confidentiality.

Data retention period

Personal data of job applicants is retained for twenty-four (24) months from the date of submission of the application. If the applicant gives their consent to extending the retention period (for example, for future recruit-ment purposes), the data may be retained for longer than the aforementioned retention period.

The data of the selected job applicant is transferred to the Oral Group’s human resources management register. Further information on the processing of personal data is available in the privacy notice of Oral Group’s human resources management.

With the job applicant’s consent, data may be transferred to Oral Group’s stakeholder register of health care professionals. Further information on the processing of personal data is available in the privacy notice of Oral Group’s stakeholder register of health care professionals.

Rights of the data subject

Right of access
Applicants have the right to inspect what personal data on them has been stored in Oral’s recruitment register. The inspection request can be made through the data protection section of Oral’s career website or by logging in to the service via the Connect function. Alternatively, the inspection request may be submitted to the contact person of the register in writing.

Right to request the rectification of data
Applicants have the right to request the rectification of inaccurate personal data concerning them. The rectification request must be submitted to the contact person of the register in writing.

Right to request the erasure of data
Applicants have the right to request the erasure of personal data concerning them in the register unless there is a legal basis for the retention of the data (e.g. a legally decreed period of complaint on the decision of the recruitment process). The request to erase personal data is made through the data protection section of Oral’s career website or by logging in to the service via the Connect function. Alternatively, the erasure request may be submitted to the contact person of the register in writing.

Right to request the restriction of the processing of personal data and the right to object to the processing of personal data
Applicants have the right to object to the processing of their personal data on the grounds of personal circumstances, insofar as the processing of data is based on the legitimate interest of Oral. In addition, applicants have the right to request the restriction of the processing of their personal data under certain circumstances. The restriction and/or objection request concerning the processing of personal data must be submitted to the contact person of the register in writing.

Right to withdraw a consent regarding the processing of personal data
Applicants have the right to withdraw their consent regarding the processing of personal data at any time. The consent can be withdrawn by submitting a request to the contact person of the register in writing.

Right to data portability
To the extent the data has been provided directly by the applicant, applicants have the right to request for it to be transferred in electronic format. The transfer request must be submitted to the contact person of the register in writing.

Right to lodge a complaint to the supervisory authority
Applicants have the right to lodge a complaint concerning failures in the processing of personal data to the supervisory authority (Data Protection Ombudsman).

 

Change history

15 November 2022: Clarifications have been made to the section “Retention Period for Data” regarding how long the data of data subjects is retained. The retention period has not been extended.

12 December 2022: A link to the English-language privacy notice has been added to the privacy notice published on the website.

4 May 2026: The section “Joint Controllers” has been updated with the address of Oral Hammaslääkärit Ltd and the details of Oral Hammaslaboratorio Oy have been added. The section “Regular Disclosures of Data” has been supplemented with a note that data may be disclosed to a company belonging to the same group as Oral, located in Switzerland, for the purpose of approving recruitments. A new section “Data Processors” has been added, describing the parties that process personal data on behalf of Oral.

4 June 2026: The information regarding the subprocessors has been updated in the section “Transfer of data outside the EU or EEA”.