Privacy Notice for the Admicom Group Recruitment Register
1. Scope of Application
This privacy notice explains how Admicom Oyj, Admicom Finland Oy, and Bauhub OÜ, all belonging to the same Admicom Group, collect and process the personal data of job applicants in their role as data controllers.
This privacy notice applies jointly to the processing of personal data related to applicants and recruitment by Admicom Oyj, Admicom Finland Oy, and Bauhub OÜ. The data controller is the group company responsible for the relevant recruitment process and which will act as your employer if an employment relationship is established (hereinafter referred to as the “Data Controller,” “we,” or “Admicom”).
Personal data refers to information through which an individual can be identified, such as an address, email address, or telephone number. We must process personal data in order to assess an applicant’s suitability, carry out recruitment activities, and communicate with applicants.
2. Data Controllers
Admicom Oyj (Business ID: 2800085-4)
Admicom Finland Oy (Business ID: 1878875-6)
Bauhub OÜ (Registry code: 12979880)
Väinönkatu 26 A, 40100 Jyväskylä, Finland
Support phone: +358 44 433 3888
Email: tietosuoja@admicom.fi
3. Person Responsible for Register Matters
Helena Marjokorpi
c/o Admicom Oyj
Väinönkatu 26 A 29, 40100 Jyväskylä, Finland
4. Registers
Admicom Group Recruitment Registers
5. Purpose and Legal Basis for Processing Personal Data
The purpose of processing personal data is to assess the suitability of Admicom job applicants, conduct recruitment activities, complete the recruitment process, and maintain communication.
The legal basis for processing is the performance of pre-contractual measures at the request of the data subject in order to enter into an employment contract, as well as the performance of the resulting contract. In addition, applicants’ personal data may be retained and processed based on the applicant’s separate consent, for example for future recruitment opportunities.
The Data Controller does not use automated decision-making or profiling.
6. Contents of the Registers
The recruitment register may contain the following information about all registered applicants:
- First and last name
- Contact details (postal address, telephone number, email address)
- Responses provided in the job application form
- Other information submitted by the applicant, such as CV, job application, salary expectations, etc.
- Information and results collected during aptitude or other personal assessments
- Information collected by the recruitment system/platform used by the Data Controller or otherwise provided through the website
The data subject may always choose not to provide their information, as providing data is not a statutory or contractual obligation. However, without personal data, the application cannot be processed, and failure to provide the information may prevent the recruitment process and/or the establishment of an employment relationship.
7. Regular Sources of Information
Personal data concerning the data subject is primarily collected directly from the data subject during the recruitment process, for example through direct contact, the recruitment system in use, or during a job interview. Information may also be collected from references provided by the applicant.
8. Regular Disclosures and Transfers of Data
Data may be disclosed as required by competent authorities or other parties based on applicable legislation.
Data may be disclosed to buyers in connection with corporate transactions if Admicom sells or otherwise reorganizes its business operations. Data may also be disclosed within the Admicom Group for administrative purposes. In such cases, the legal basis for disclosure is legitimate interest (improving business efficiency and reducing overlapping processing activities).
Data may also be transferred to cooperation and contractual partners selected by the Data Controller who process the data on behalf of the Data Controller under cooperation agreements, such as service providers conducting aptitude assessments. In such cases, the processor is not entitled to process the transferred data for its own purposes or in its own registers; processing takes place solely on behalf of the Data Controller in accordance with the Data Controller’s data protection instructions and the data processing agreement between the parties.
9. Transfer of Data Outside the EU or EEA
As a rule, data is not transferred outside the European Union or the European Economic Area unless necessary for the purposes described above or for the technical implementation of data processing. In such cases, transfers are carried out in accordance with the requirements of the General Data Protection Regulation (GDPR).
10. Protection of the Registers
A. Manual Material
Personal data is protected against unauthorized access and unlawful processing (such as destruction, alteration, or disclosure). Each processor may only process personal data necessary for their work duties.
Documents are stored in locked facilities protected from unauthorized access. Documents are printed only when necessary, and paper copies are destroyed after use.
B. Automatically Processed Data
Electronically processed data contained in the register is protected by firewalls, passwords, and other generally accepted technical security measures.
Only specifically authorized employees of the Data Controller and companies acting on behalf of and commissioned by the Data Controller have access to the data in the register through granted access rights.
11. Exercising the Rights of the Data Subject
The data subject has the right to inspect what information concerning them has been stored in the register. You may request access to the personal data collected about you and information on whether your personal data is being processed.
At the request of the data subject, we will correct and supplement personal data as necessary or delete data that is incorrect, unnecessary, incomplete, or outdated for the purposes of processing.
You may request restriction of the processing of your personal data in certain situations, such as when you contest the accuracy of your data and the Data Controller is verifying its accuracy. Restriction of processing means that your data may only be processed on limited grounds, such as for the establishment, exercise, or defense of legal claims.
You may object to the processing of your personal data if the processing is based on the Data Controller’s legitimate interest. In such cases, the Data Controller may no longer process the data unless it can demonstrate compelling legitimate grounds for the processing that override your rights and freedoms.
The data subject also has the right to request the transfer of their data from one system to another. Under certain conditions, you may request that the Data Controller provide the personal data you have supplied in a structured, commonly used, and machine-readable format and transfer that data to another data controller.
The data subject also has the right to withdraw consent where processing is based on consent.
The data subject has the right to lodge a complaint with a supervisory authority. You may file a complaint with the national supervisory authority, the Office of the Data Protection Ombudsman, if you believe that the Data Controller is not processing your personal data appropriately or is not adequately implementing your rights. Complaints can be submitted at: https://tietosuoja.fi/en/notification-to-the-data-protection-ombudsman
Requests concerning the processing of personal data may be submitted by contacting Admicom. Contact details are provided below. Responses to requests will be provided without undue delay and no later than one (1) month from receipt of the request. If necessary, Admicom may request additional information to verify the identity of the data subject.
12. Retention of Data
Admicom retains personal data only for as long as necessary for the stated purposes and as long as a legal basis for processing exists or retention is required by law. When the personal data we have collected is no longer needed and there is no longer a basis for retaining it, we securely destroy or delete it.
As a rule, your personal data will be retained for 18 months from the time you provided your information to Admicom for job application purposes. The retention period is based on the limitation periods under the Finnish Non-Discrimination Act (1325/2014) and the Act on Equality between Women and Men (609/1986), with an additional six-month precautionary period for possible claims initiated near the end of the limitation period.
In addition, the retention and processing of applicants’ personal data may continue based on the applicant’s separate consent, for example for future recruitment opportunities. Consent will be requested separately when the previous retention period is ending. If the data subject does not provide consent or withdraws it, the data will be deleted or removed in accordance with the request.
13. Amendments to the Privacy Notice
Admicom continuously develops its operations and therefore reserves the right to amend this privacy notice by informing about the changes. Changes may also result from amendments to legislation.
If we make changes to this privacy notice, we will publish the amended notice along with the date of modification. We encourage you to review the notice regularly.
If we make significant changes that materially affect our privacy practices, we may also notify you in other ways before the changes take effect.
This privacy notice was last updated on 24 April 2026.
14. Contact Information
If you have comments or questions regarding this privacy notice, concerns about privacy protection or the use of your data, or if you suspect that your privacy has been violated, please contact us at tietosuoja@admicom.fi. You may also send a letter to Väinönkatu 26 A, 40100 Jyväskylä, Finland.
We will process your inquiry confidentially, and our representative will contact you if necessary using the contact details you have provided.
