Recruitment Privacy Notice
Last updated: 19.05.2025
Data Controller
UpCloud Oy (later referred to as “UpCloud”, “we, “us”)
A limited liability company registered in Finland with the business ID: 2431560-5
Address: Aleksanterinkatu 15 B, 7th floor, 00100 Helsinki, Finland
Phone: +358-9-3158 4810
Contact persons: UpCloud People Operations Team, email: pops@upcloud.com
UpCloud’s Data Protection Officer, email: privacy@upcloud.com
Introduction
We at UpCloud manage our employer branding and recruitment process through our career site (the “Career Site”), and by using a related applicant tracking system.
This Recruitment Privacy Notice informs why and how we process personal data about job applicants who apply to one of our open positions (“Applicant” or “you”). In addition, this Privacy Notice explains how and why we process personal data regarding potential job candidates who we may contact when we want to introduce our open positions (“Candidate” or “you”).
Sources of Personal Data
We may collect your personal data from the following sources:
Personal data provided directly by you
For the most part, we collect personal data directly from you during the recruitment process. You provide us with data, for example, when you send us your application and CV, during job interviews and in connection with performing possible aptitude assessments.
Technical data
When you visit our Career Site (for example to check our open positions), we may collect personal data about you with the help of cookies. For more information about the processing of personal data on our website, please see https://upcloud.com/privacy-policy.
Publicly available services (e.g. LinkedIn)
We may collect your personal data from publicly available services, such as LinkedIn. We do this mainly with respect to Candidates who we contact when we want to introduce our open positions. However, if an Applicant provides us links to publicly available information sources (for example, in their application or CV), we may collect personal data this way also with respect to such Applicants.
References
Moreover, during the recruitment process, we may also collect personal data about you from references you provide to us, such as your former employers.
Background checks
As part of the recruitment process, and subject to your consent, we may also perform background checks on you. Such background checks may include criminal records, credit reports or working permits. If background checks are performed, we will ensure that data protection laws are complied with.
Service Providers
We may also use external service providers to collect personal data about you. This happens for example when we use a recruiting agency to search and contact suitable Candidates and/or Applicants on our behalf.
Personal Data We Collect, Purposes and Legal Grounds
(A) Candidates
We may process personal data about Candidates for the following purposes:
Finding, evaluating and contacting suitable Candidates
We process your personal data to find suitable Candidates for open positions at UpCloud. We search Candidates (e.g. in LinkedIn) and evaluate their suitability by applying certain criteria with respect to professional attributes, such as skills and work experience, your education, and location. We may contact suitable Candidates to inform them about open positions at UpCloud that we believe could be interesting to them.
Personal data processed: We may collect your identity data, contact details, and information about your employment history, education, skills, and other similar professional attributes.
Legal basis for processing:
The processing is based on our legitimate interests to promote UpCloud as an employer and to find the best possible employees for the company.
If you send us a job application, you will be deemed as “Applicant” and your personal data will be processed accordingly, as stated in this Privacy Notice.
(B) Applicants
We may process personal data about Applicants for the following purposes:
Recruitment process and evaluation of Applicants
We process your personal data for the purposes of storing, reviewing and managing job applications as part of our recruitment process. In addition, we process personal data to communicate with, and to carry out the evaluation, selection and appointment of the Applicant. We may also carry out background and reference checks, and for some positions, ensure that the Applicant has the appropriate working permits.
Personal data processed: We may collect your identity data, contact details, and information about your employment history, education, skills, references, background, and other similar professional attributes. We may also process any other personal data that you provide to us in connection with your application, such as your photo, or information about health status or your pastime activities. This may also include audio and/or video recordings of interviews and a meeting transcript if you participate in a recorded interview.
Legal basis for processing: The processing based on our legitimate interests to recruit new employees, to manage the recruitment processes and to evaluate the Applicants in an equal and effective manner. The processing of special categories of personal data (e.g. health status) provided by the Applicant is necessary to provide the Applicant an equal opportunity to participate in the recruitment process (e.g. to make job interview arrangements for Applicants with reduced mobility). Where required by data protection laws, we will ask your consent prior to collecting any personal data. This is for example the case if we propose to record an interview with you or in connection with background and reference checks.
If you are hired as a result of your application, some of the personal data collected during the recruitment process will be further processed, as described in our Staff Privacy Notice.
Communicating new open positions
If you are not selected for the position you applied for, we may further process your personal data to inform you about similar open positions at UpCloud.
Personal data processed: We may process your identity data and contact details.
Legal basis for processing: The processing is based on our legitimate interests to promote UpCloud as an employer and to find the best possible employees for the company.
Establishing or defending legal claims
To the extent necessary, we may need to process your personal data in order to establish and defend possible legal claims, for example in cases of recruitment selection related disputes.
Personal data processed: We may process your identity data, contact details and information relating to your recruitment process.
Legal basis for processing: The processing is based on our legitimate interests to establish, exercise or defend legal claims.
Automated Decision Making
UpCloud does not make recruitment decisions based solely on automated processing, including profiling.
To manage the large volume of applications we receive and to improve efficiency, our applicant tracking system incorporates artificial intelligence. This technology helps our recruitment team by screening applications against predefined criteria and by providing a preliminary ranking. However, all decisions regarding application progression or rejection are made by our recruitment team.
How we share Personal Data
In order to fulfil the purposes described in this Privacy Notice, we may share your personal data with the parties set out below. These parties may include:
1. UpCloud affiliated companies, if the open position is with another UpCloud company.
2. Third-party service providers, e.g. recruitment service providers and the supplier of our Career Site and related applicant tracking system.
3. Courts, legal advisors, counterparties etc., as may be required to establish, exercise or defend legal claims.
4. Regulators, public authorities, and reporting databases, if required by applicable laws.
5. Prospective sellers or buyers if we are involved in a merger, acquisition, or sale of all or a portion of our assets.
All of our affiliates and third-party service providers are required to take appropriate security measures to protect your data and they may only process personal data for the purposes mentioned in this Privacy Notice and in accordance with our instructions.
International Transfers
We store the personal data primarily within the European Union (EU). However, we may transfer the personal data outside the EU or European Economic Area (EEA) in limited cases. This happens for example when we share the personal data with our affiliated companies or business partners established in non-EEA countries, or when we use external service providers or vendors that are based outside the EEA.
If we transfer personal data outside the EEA, we take steps required by law to ensure that your privacy is protected. This includes us requiring our service providers and vendors to enter into binding contractual commitments with us designed to protect your data and the evaluation of the information security measures undertaken by such service providers and vendors. When we share personal data outside the EEA, we rely on either the Standard Contractual Clauses approved by the EU Commission or EU Commission’s Adequacy Decision, depending on the transfer location. All UpCloud group companies regardless of their location follow the same information security management system that is designed to ensure a high level of security and confidentiality of UpCloud’s information assets.
Retention
We will only retain personal data for as long as it is necessary to fulfil the purposes defined in this Privacy Notice. In general, we follow the criteria below with respect to retaining your personal data:
(A) Candidates
Personal data collected about Candidates is retained as long as the information is available on Candidate’s LinkedIn profile. If you decide to continue with the recruitment process, you will be deemed as “Applicant” and your personal data will be processed accordingly, as stated in this Privacy Notice.
(B) Applicants
Personal data is retained for the duration of the recruitment process. After we have made the hire, the personal data of non-selected Applicants will be retained for a period of two (2) years in order to be able to communicate new open positions as well as for safeguarding our legitimate interests in establishing, executing or defending possible legal claims.
If you are hired as a result of your application, some of the personal data collected as part of the recruitment process will be transferred to your personnel file and processed as described in our Staff Privacy Notice.
Your Rights
You have always the right to:
1. Obtain confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, access to the personal data.
2. Request an electronic copy of the personal data for portability.
3. Have incorrect, imprecise, incomplete, outdated, or unnecessary personal data we have collected about you corrected or completed.
4. Request restriction of processing of your personal data in the circumstances referred to in Article 18 of the GDPR.
You have also the right to:
5. Request erasure or deletion of your personal data. UpCloud will always respond to your request and inform you whether your personal data will be deleted, or retained despite your request, including reasoning behind the retention.
6. Withdraw your consent at any time, where the processing of your personal data is based on your consent.
Where the processing of your personal data is based on UpCloud’s legitimate interest, you have the right to:
7. Object to the processing of your personal data in the circumstances referred to in Article 21 of the GDPR.
Please note that if you request deletion of or restrictions to the personal data we process about you, this may affect our ability to offer employment opportunities to you.
How to use the rights
If you want to exercise any of the rights listed here, we suggest that you:
- Visit the Data & Privacy page on our Career Site, where we offer features to let you exercise your rights;
- Log in to your account with us, where you can use the settings in the account to exercise your rights; or
- Contact us directly at pops@upcloud.com.
When you exercise your rights, we may need to request additional information from you to verify your identity. This is a security measure to ensure that we do not disclose personal data to any person who does not have the right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
Security
We have physical, technical, and organisational measures and procedures in place to safeguard and secure the personal data we collect and process. The measures include, for example, where appropriate, encryption, firewalls, secure facilities and managing access rights to systems. Our security controls are designed to maintain an appropriate level of data confidentiality, integrity, and availability. We regularly test our websites, data centres, systems, and other assets for security vulnerabilities.
Updates
We may update this Recruitment Privacy Notice from time to time by publishing a new version on our website. If we plan to introduce material changes, we will inform you about it in advance.
Questions or Concerns?
If you have any questions about this Privacy Notice or the way UpCloud processes your personal data, please contact UpCloud’s Data Protection Officer at privacy@upcloud.com.
You have the right to make a complaint at any time to the supervisory authority in your country of residence. List of the EEA supervisory authorities can be found here. The relevant supervisory authority overseeing UpCloud Oy is The Finnish Data Protection Ombudsman. We would, however, appreciate the chance to deal with your concerns before you approach any supervisory authority.