WHEN APPLYING FOR A POSITION AT BOLIDEN

1. BACKGROUND

1.1 When you apply for a position at Boliden, Boliden will process your personal data, in the online recruitment tool Workday, as described below.

1.2 The information describes, among other things, the categories of personal data that are processed, the purposes of processing, the legal basis on which Boliden bases processing, the categories of enterprises or other organisations to which your personal data may be provided, and Boliden’s obligations and your rights in connection with the processing of personal data.

1.3 How personal data may be processed is set out in law. The General Data Protection Regulation (also called “GDPR”) applies as law in all EU member states from 25 May 2018.

1.4 The General Data Protection Regulation aims to protect the personal privacy of individuals in connection with the processing of personal data and therefore includes a number of principles and detailed rules that the party processing personal data must take into consideration. An important aspect of privacy protection is that the person whose personal data are processed is entitled to receive information about that processing.

2. IMPORTANT TERMS

2.1 Personal data are any information relating to an identified or identifiable natural person, e.g. name, title, address, telephone number, e-mail address, personal ID number, photographs, education and work experience, CVs, work certificates, video recordings, IP address, and information about health.

2.2 Processing of personal data is any operation performed on personal data, e.g. collection, recording, adaptation, organisation, structuring, consultation, use and storage.

2.3  A controller is the person who alone or jointly with another party determines the purposes and means of the processing of personal data and who is ultimately responsible for the processing complying with the applicable personal data legislation.

3. CONTROLLER

3.1 When you apply for a position, the advertisement for the position will state which company within the Boliden Group that is the recruiting company, as well as provide contact details for that company. It is this company together with Boliden Mineral AB that is the controller for the processing of your personal data.

3.2 When “Boliden” or “we/us” is used in this information, this means the controller company within the Boliden Group.

4. PROCESSING OF YOUR PERSONAL DATA

Personal data processed by Boliden

Boliden processes personal data supplied by you during the recruitment process. We also obtain information from the persons responsible for the recruitment process within Boliden, from any referees whose contact details you have provided, and from external recruitment service providers, e.g. recruitment consultants and providers of personality and skills tests.

We process the following personal data, among other information:

- Name
- Contact details
- Education
- Work experience
- CV
- References and certificates
- Filmed material supplied by you or recorded during the recruitment process
- Other material with which you supply Boliden during the recruitment process
- Summaries, assessments (including results from personality and skills tests) and
comments regarding the application and any interviews.

Purposes

Boliden processes your personal data in order to be able to evaluate you as a candidate in connection with the recruitment process for the position for which you have applied, as well as for recruitment-related statistics.

If you give us your consent, we keep your personal data once the recruitment process for a specific position has been completed in order to be able to consider your application in the event of future recruitment needs. We screen the personal data as detailed below. You have the right to withdraw your consent at any time.

When filling certain positions, we may process the personal data in order to comply with our legal obligations in the field of employment law.

We may process your personal data in order to handle discrimination claims.

Legal basis

We process your personal data based on our legitimate interest to recruit the candidates best suited for vacant positions;

When we process personal data in order to comply with legal obligations within the field of employment law in connection with filling certain positions, the legal basis is that processing is necessary for compliance with a legal obligation. We may process personal data in order to handle discrimination claims, based on our legitimate interest.

How long do we retain the personal data?

We retain your personal data for as long as is necessary to complete the recruitment
process and for a subsequent period in order to be able to consider your application in the event of future recruitment needs. Boliden will store your personal data for two years after the recruitment process, unless if there is a legal claim related to recruitment or a legal obligation that requires us to save the personal data longer. Your personal data will then be removed from Workday by being rendered anonymous. They cannot then be recovered.

5. PARTIES WITH WHOM WE MAY SHARE YOUR PERSONAL DATA

Your personal data may be disclosed to:

- other companies within the Boliden Group;
- referees whose contact details you have provided;
- trade unions;
- enterprises providing recruitment-related services; and
- so-called processors, i.e. other companies that process personal data on behalf of
the Boliden Group, e.g.Cloudator OY, which supplies Workday, and other suppliers
of IT systems, system administration and support or IT infrastructure.

6. TRANSFER OF PERSONAL DATA TO A THIRD COUNTRY

Boliden data will be stored within EU in Workdays data center located in Dublin, Ireland and in Workdays disaster recovery site in Amsterdam, Netherlands. Boliden may transfer your personal data to a third country, i.e. a country outside the EU/EEA. If Boliden transfers personal data to a third country, Boliden will apply appropriate safeguards to protect your personal data in accordance with applicable legal requirements. For more information, please contact Boliden’s data protection officer at [email protected].

7. YOUR RIGHTS

You are entitled to request information from Boliden about the use of your personal data. You are also entitled to have inaccurate personal data rectified. You are also entitled, in some cases, to have your personal data erased, to request restriction of processing, and to object to certain processing of your personal data. You are also entitled, in some cases, to receive your personal data in a machine-readable format.

We urge you to use Boliden’s online recruitment system Workday to check and correct your details.

Please note that if you do not provide all information required for us to evaluate your
application, we might have no choice but to discontinue any ongoing recruitment process.

8. CONTACT

If you wish to exercise your rights as per point 7 or if you have any questions about how we process your personal data, please contact the controller’s contact person, whose contact details are provided in the advertisement for the position in question. If you are not currently applying for a specific position, you can contact Boliden on [email protected] with your query.

9. DATA PROTECTION OFFICER
The Boliden Group has appointed a data protection officer, who can be contacted by e-mailing [email protected]. If you wish to exercise your rights as per point 7 or if you have more specific questions concerning your personal data, we recommend that in the first instance you contact the person stated in point 8 above.

10. WHAT CAN YOU DO IF YOU HAVE QUESTIONS OR WANT TO SUBMIT A
COMPLAINT?

If you think that Boliden’s processing of your personal data contravenes data protection legislation, we ask that you first contact us, so that we have an opportunity to rectify any inaccuracies. However, you always have the option of submitting a complaint to the responsible supervisory authority in the country where you work if you think that your personal data is being processed by Boliden in contravention of data protection legislation. You can find out more about the local data protection authorities under the following link