Privacy Notice for Recruitment
1. Who we are
Curon Oy (“Curon”, “we”, “us”) is the controller of the personal data processed in connection with our recruitment activities.
Our recruitment service is provided through Teamtailor, which acts as a data processor on behalf of Curon Oy.
Controller:
Curon Oy
Kielotie 16 A
02260 Espoo
Finland
Contact for privacy-related matters:
2. Purpose of processing personal data
We process personal data for the purpose of managing our recruitment processes, assessing candidates, communicating with candidates and making recruitment decisions.
If a candidate separately gives consent to being considered for future job opportunities, we may also process their personal data in order to consider and contact them regarding suitable future positions at Curon.
3. Personal data we may process
We only process personal data that is directly necessary for the recruitment process and for assessing a candidate’s suitability for the position being applied for.
Depending on the recruitment process and the information provided by the candidate, we may process the following categories of personal data:
name
email address
phone number
CV
work experience
education and qualifications
language skills
answers to recruitment and application questions
information about availability and preferred working hours
information relating to the candidate’s right to work in Finland
interview notes and information relating to the assessment of the candidate
references and information provided by referees
communications between the candidate and Curon
a photograph that the candidate may choose to include in their CV; Curon does not require a photograph as part of the application
other information provided by the candidate that is directly necessary for assessing the candidate’s suitability for the position or otherwise managing the recruitment process.
Not all information listed above is required from every candidate or at every stage of the recruitment process.
Providing the personal data marked as required in the application is necessary for Curon to process and assess the application. If the required information is not provided, Curon may be unable to consider the candidate for the position.
Providing optional information and giving consent to being considered for future job opportunities are not conditions for applying for a position.
Special categories of personal data
Candidates should not provide health information or other special categories of personal data unless Curon has specifically requested such information and there is a lawful and necessary reason for processing it.
Where such information is necessary, for example in connection with reasonable adjustments during the recruitment process, it will be processed only to the extent permitted by applicable law.
4. How we collect personal data
We primarily collect personal data directly from candidates when they apply for a position, complete an application form, communicate with us or otherwise participate in our recruitment process.
We conduct reference checks only with the candidate’s consent. Where reference checks are carried out, we may receive relevant information from referees identified or approved by the candidate.
Where permitted by law, we may also obtain information from authorities or other sources without consent where this is specifically provided for by law.
If information obtained from another source is used in decision-making concerning the candidate, we will inform the candidate about the information before it is used, where required by applicable law.
5. Legal basis for processing
We process personal data where processing is necessary in order to manage the recruitment process and take steps at the candidate’s request prior to potentially entering into an employment contract.
Where applicable, we may also process personal data on the basis of Curon’s legitimate interests, for example in managing and developing our recruitment activities, documenting recruitment decisions, protecting our information systems and establishing, exercising or defending legal claims.
Where processing is based on consent, including where a candidate agrees that Curon may retain their information for future job opportunities or conduct a reference check where consent is required, the candidate may withdraw their consent at any time.
Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.
6. Future job opportunities
Candidates may voluntarily choose to allow Curon to retain their personal data and contact them about suitable future job opportunities.
Giving this consent is voluntary and is not required in order to apply for a specific position.
If a candidate gives consent to being considered for future job opportunities, Curon may retain their recruitment profile and relevant personal data for up to 24 months at a time.
Before the end of the 24-month period, the candidate may receive a reminder regarding the continued retention of their personal data and an opportunity to decide whether they want Curon to continue retaining their information for future job opportunities.
Candidates may withdraw their consent or request the deletion of their personal data at any time, without having to wait until the end of the 24-month period. This can be done through the options provided by Teamtailor or by contacting us at people@curon.fi.
7. Criminal record extracts
For positions where checking a criminal record extract is required or permitted by applicable law, Curon may ask the selected candidate to present the relevant criminal record extract.
The criminal record extract itself is not copied, uploaded to Teamtailor or otherwise retained by Curon.
Where permitted by applicable law, Curon may record only that the extract has been presented and the date of the extract. The extract is returned to the candidate without delay.
Information relating to criminal records is handled confidentially and only by persons who need the information for the relevant recruitment decision.
8. Automated processing and artificial intelligence
Curon does not make recruitment decisions based solely on automated processing or profiling. Recruitment decisions involve human assessment.
Curon may use digital or AI-assisted recruitment tools to support recruitment activities. Such tools do not independently make final hiring decisions.
If Curon introduces automated processing that produces legal effects or similarly significantly affects candidates, candidates will be provided with the information required by applicable data protection legislation.
9. Who can access personal data
Within Curon, access to candidate personal data is limited to employees and other authorised persons who are involved in recruitment and hiring decisions and who need access to the information for their role.
Teamtailor processes personal data on behalf of Curon as the provider of our recruitment platform.
We may also use other external service providers in connection with recruitment. Depending on the service and processing involved, such providers may act as data processors on behalf of Curon or as independent data controllers.
Where a service provider acts as Curon’s processor, it may process personal data only in accordance with Curon’s instructions and applicable data protection legislation.
We may disclose personal data to authorities or other parties where required or permitted by law.
We do not sell candidates’ personal data or disclose it to third parties for their own marketing purposes.
10. Candidates who become employees
If a candidate is hired by Curon, personal data necessary for establishing and managing the employment relationship may be transferred from the recruitment process to Curon’s other systems and service providers.
These may include, for example, payroll, HR, working time and work scheduling systems.
From that point onwards, the relevant personal data will also be processed for purposes related to the employment relationship and in accordance with Curon’s employee privacy practices and applicable legal obligations.
11. How long we retain personal data
Personal data relating to a specific recruitment process may be retained for up to 24 months after the recruitment process has ended where this is necessary, for example, to document the recruitment process or to establish, exercise or defend legal claims.
Where a candidate has separately given consent to being considered for future job opportunities, relevant candidate data may be retained for up to 24 months at a time for that purpose, unless the candidate withdraws their consent earlier.
Certain information may be retained for a longer or shorter period where required or permitted by applicable law or where another justified retention period applies.
After the applicable retention period, personal data will be deleted or anonymised unless continued retention is required or permitted by law.
12. International transfers
Our recruitment platform and other service providers may process, store or transfer personal data outside the European Union (EU) and European Economic Area (EEA).
Where personal data is transferred outside the EU/EEA, appropriate safeguards required by applicable data protection legislation are used.
Transfers may be based, for example, on an adequacy decision by the European Commission or on Standard Contractual Clauses approved by the European Commission.
13. Data security
We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, disclosure or other unlawful processing.
Access to candidate information is restricted according to the responsibilities and needs of the persons involved in the recruitment process.
14. Candidates’ rights
Under applicable data protection legislation, candidates may have the right to:
request access to their personal data
request correction of inaccurate or incomplete personal data
request deletion of their personal data where the legal requirements are met
request restriction of processing
object to processing based on legitimate interests
withdraw consent at any time where processing is based on consent
receive personal data in a portable format where the legal requirements for data portability are met.
Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.
These rights may be subject to limitations provided by applicable law.
Requests concerning personal data can be sent to people@curon.fi. Curon may request additional information where necessary to verify the identity of the person making the request.
Candidates also have the right to lodge a complaint with the competent data protection supervisory authority if they believe that their personal data has been processed in breach of applicable data protection legislation.
In Finland, the supervisory authority is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto).
15. Cookies and similar technologies
Our recruitment website may use cookies and similar technologies that are necessary for the operation of the website or used for other purposes described in the separate cookie information provided through the recruitment service.
Where required by law, non-essential cookies and similar technologies are used only in accordance with the choices made by the user.
16. Changes to this Privacy Notice
We may update this Privacy Notice when our recruitment practices, systems, service providers or applicable legal requirements change.
The current version of this Privacy Notice will be available through our recruitment service.
Last updated: 4 September 2026