PRIVACY NOTICE – APPLYING FOR A JOB AT VOLVO CARS

This document describes how Volvo Cars (as defined below) uses your personal data when searching for a career opportunity and for the hiring process when applying for a job at Volvo Cars (whether as an employee, worker or contractor) or when Volvo Cars searches for potential candidates via various open sources (“talent search”) hereinafter “recruitment journey”. These activities include receiving your job application and reviewing your CV, assessing specific skills through psychometric tests and other assessments, as well as preparing the employment agreement for signature when you have been offered a position.

You can find below:

  1. Who is responsible for the processing of your personal data
  2. What personal data we process and why
  3. How long we keep the data
  4. Who we share your personal data with
  5. What rights you have in relation to the data processing we perform
  6. Information Security
  7. How to contact us
  8. Changes to our Privacy Notice

0. Who we are

If you apply for a job at Volvo Car Corporation the entity responsible for the processing of personal data in relation to the recruitment journey is Volvo Car Corporation, having its registered office at Assar Gabrielssons Väg, SE-405 31, Gothenburg, Sweden, company registration number 556074-3089. If you apply for a job at a local Volvo Cars company the entities responsible for the processing of personal data in relation to the recruitment journey are the local Volvo Cars company you are applying to, together with Volvo Car Corporation, hereinafter referred to as “Volvo Cars”, “we”, or “us.

1. What personal data we collect and why

When you apply for a job at Volvo Cars or If you are contacted by our talent search team without your application, the recruitment journey involves managing activities in pursuing career opportunities at Volvo Cars (including our Global Graduate Program). Please find more information below.

When you submit an application to a Volvo Cars job posting, we will use your contact information such as name and email, your nationality, as well as employment information such as previous work and education history. We use this data because it is our legitimate interest (GDPR Art. 6.1.f) to be able to proceed with the selection process in the recruitment journey.

When we conduct talent search, we will use your contact information available on public search pages for us to be able to contact you regarding a potential job offer. We will use your contact information on the basis of our legitimate interest (GDPR Art. 6.1.f) for the purpose described above.

When we select you as a possible candidate for the job for which you have applied or been contacted for, we will conduct an initial interview with you and ask you to take a psychometric test provided by a third-party supplier. We will then assess this information in order to secure that your profile matches the requirements in the job application. Using this data is a necessary step prior to entering the employment contract (GDPR Art. 6.1.b) and we will be using the information from the interview and test results to make a comprehensive assessment in the recruitment process. We will keep this information for 12 months after which the psychometric test data is deleted.

We use CCTV within and in connection to our premises, where live feed videos are monitored and recorded. If the interview is conducted within Volvo Car Corporation premises, we use this information because it is our legitimate interest (GDPR Art. 6.1.f) to secure our workplace and ensure that all security incidents are identified and managed as early as possible. We keep this data for a period of 10 days after which it is deleted.

If the interview is conducted via video, it will be recorded, and we will keep this information in order to evaluate you as a relevant candidate for the applied position. The legal basis for this processing is consent (GDPR Art. 6.1.a) and if you choose not to be recorded, we will conduct a phone interview instead.

For certain roles with specific requirements, we will also ask you to conduct assessments including tests provided by third parties, assessing your specialized professional skills, in order to determine   specific soft and hard skills. For these activities, we will use your contact information to secure that you get access to the assessments, and we will access your test results. We do this because we deem it as a necessary step prior to signing the employment contract (GDPR Art. 6.1.b), to secure that the level of competence is assessed in a professional manner. We will keep this information for a period of two years after we have recruited the final candidate.  

We will also conduct a reference and background check on you. At this point in time, background checks are conducted only for blue collar positions. Please find more information below:

  • If you apply for a blue-collar position, we will view data to confirm your identity, name, and your registered address. In addition to that, we will also look into your potential ongoing and concluded cases involving your current or past criminal activities for the past 10 years. The legal basis for this processing is our legitimate interest (GDPR Art. 6.1.f) enabling us to secure a review of the potential future employees at Volvo Cars. Only a designated role will have access to view this information for a limited period of time until the position has been filled and no data will be stored nor saved.

When you are selected to become an employee at Volvo Cars, you will be asked to do a drug test prior the start of your employment. The reason for this is because it is in accordance with our policies and directives to secure a safe workplace. Our legal basis for conducting this step in the recruitment process our legitimate interest (GDPR Art. 6.1.f). We will only have access to the rest result which will be deleted once the test has been completed.

Depending on the nature of the job applied, there might be further assessments connected to legal requirements on extended background checks to be performed. In these cases, we will need to use more of your personal data. We do this because it is a legal obligation (GDPR Art. 6.1.c) under the Security Protection Act (2018:585). The data is kept in a hard copy with restricted access control until end of employment.

If you are not selected as the final candidate or if you reject a talent search opportunity, you will also be notified and have the choice to keep your resume in our database in order to apply for more positions in the future. Our legal basis for using your data is consent (GDPR Art. 6.1.a) and you may at any point withdraw your consent. If you choose to withdraw your consent, the data will be deleted immediately. You can also delete your profile and all data yourself at any point in time.

If you are selected as the final candidate and offered the job, then your application information as described in this notice will be stored in your employment profile during your employment as described in the employment privacy notice. We will store this data because it is necessary in order to perform the obligations under the employment contract (GDPR Art. 6.1.b).

If you are not selected as the final candidate or if you reject a talent search opportunity, you will also be notified and have the choice to keep your resume in our database in order to apply for more positions in the future. Our legal basis for using your data is consent (GDPR Art. 6.1.a) and you may at any point withdraw your consent. If you choose to withdraw your consent, the data will be deleted immediately. You can also delete your profile and all data yourself at any point in time.

If you give your consent under Make My Profile Visible to’ prior to submitting this form collecting age range and nationality, which you give by ticking the consent box ‘Make My Profile Visible to’ prior to submitting this form. We use your personal data to conduct statistics. These statistics include various types of use cases, such as, for example, calculating and forecasting headcount figures. We keep this data for a very short period of time until we have aggregated and therefore anonymized the data. Our legal basis for using your data is consent (GDPR Art. 6.1.a) and you may at any point withdraw your consent, before the data are anonymized. If you choose to withdraw your consent, the data will be deleted immediately. You can also delete your profile and all data yourself at any point in time.

If you are not selected as the final candidate or if you reject a talent search opportunity, you will also be notified and have the choice to keep your resume in our database in order to apply for more positions in the future. Our legal basis for using your data is consent (GDPR Art. 6.1.a) and you may at any point withdraw your consent. If you choose to withdraw your consent, the data will be deleted immediately. You can also delete your profile and all data yourself at any point in time.

We use your data for general administration in the recruitment process when we communicate with you through various channels like mails, Teams chats, Notions. We do this because it is our legitimate interest (GDPR Art. 6.1.f) to be able to communicate with you. We keep this data for a period of five years.  

2. How long we keep the data

Generally we will retain your personal data for a period of two years after we have communicated to you our decision about whether to appoint you to the role for which you applied. We retain your personal data for that period so that we can show, in the event of a legal claim, that we have not discriminated against candidates on prohibited grounds and that we have conducted the recruitment activities in a fair and transparent way. After this period, we will delete your personal information in accordance with our data retention policy.

In some specific cases we will retain your personal data for a different period of time, please find more details under each specific section above.

If you want us to retain your personal information on file, on the basis that a further opportunity may arise in the future, you may provide your explicit consent to retain your personal information for a defined period of time.

3. Who we share your personal data with

We will only share your personal data with the following categories of third parties, for the purpose of processing your application:

  • Our processors supporting our activity in general, such as providers of IT solutions;
  • Our processors which are limited by contract in their ability to use your personal data for any purpose other than to provide services for us in compliance with each data processing agreement in place, for the purpose of:
  1. delivering the psychometric tests
  2. assessing specific soft and hard skills
  3. testing specific competencies such as programming skills and business cases
  4. managing recorded video interviews
  5. enabling background checks
  6. managing parts of the drug test procedure

All of our third-party service providers and other entities in the group are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow any third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.

International transfers of personal data

As an international company we share your personal data with group companies, subcontractors, and business partners worldwide, specifically we transfer personal data to  India  for IT-support, the United States for hosting services, IT-support and customer service.

Whenever we conduct international transfers of personal data, we use tools and safeguards to make sure that such transfers comply with applicable law and that your personal data is granted the same level of protection as in the EU/EEA. Typically, we use tools and safeguards such as:

  • ensuring that the relevant country is subject to an adequacy decision by the European Commission, or
  • ensuring the implementation of so-called standard contractual clauses issued by the European Commission (available at the European Commission’s website) and,
  • ensuring the implementation of technical safeguards like encryption and pseudonymization.

If you’d like more information about our international transfers, you can get in touch with us using the contact information provided below.

4. Your rights in relation to the data processing we perform

 As a data subject you have specific legal rights granted by the General Data Protection Regulation relating to the personal data we process about you. These are briefly explained below, and you can exercise them by filling out the dedicated form indicated below.

Right to withdraw consent: Where you have given consent for the processing of your personal data, you may withdraw your consent at any moment with effect for the future.

Right to access your personal data: You may ask from us information regarding personal data that we hold about you. We will provide you with a copy of your personal data upon request. If you request further copies of your personal data, then we can charge you with a reasonable fee that we base on the administrative costs. You have the right to the information about our safeguards for the transfer of your personal data to a country that is outside the EU and the EEA if you request that we confirm whether or not we process your personal data, and we transfer your personal data to a country that is outside the EU and the EEA.

Right to rectification: You may obtain from us rectification of incorrect or incomplete personal data concerning you. We make reasonable efforts to keep personal data in our possession or control which are used on an ongoing basis, accurate, complete, current and relevant, based on the most recent information available to us.

Right to restriction: You may obtain from us restriction of processing of your personal data, if:

you contest the accuracy of your personal data, for the period we need to verify the accuracy,

the processing is unlawful and you request the restriction of processing rather than erasure of your personal data,

we do no longer need your personal data for the processing purpose but you require them for the establishment, exercise or defense of legal claims, or

you object to the processing while we verify whether our legitimate grounds override yours.

Right to portability: You have the right to receive your personal data that you have provided to us, and, where technically feasible, request that we transmit your personal data (that you have provided to us) to another organization, if:

we process your personal data by automated means;

we base the processing of your personal data on your consent, or our processing of your personal data are necessary for the execution or performance of a contract to which you are a party;

your personal data are provided to us by you; and

your right to portability does not adversely affect the rights and the freedoms of other persons.

You have the right to receive your personal data in a structured, commonly used and machine-readable format. Your right to receive your personal data must not adversely affect the rights and the freedoms of other persons. Your right to have your personal data transmitted from us to another organization is a right you have if such transmission is technically feasible.

Right to erasure: You have the right to request that we delete the personal data we process about you. We must comply with this request if we process your personal data, unless processing is necessary:

for exercising the right of freedom of expression and information;

for compliance with a legal obligation which requires processing by Union or Member State law to which we are subject;

for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes; or

for the establishment, exercise or defense of legal claims.

Right to object: You may object – at any time – to the processing of your personal data due to your particular situation, provided that the processing is not based on your consent but on our legitimate interests or those of a third party. In this event we shall no longer process your personal data, unless we can demonstrate compelling legitimate grounds and an overriding interest for the processing or for the establishment, exercise or defense of legal claims. If you object to the processing, please specify whether you also wish the erasure of your personal data, otherwise we will only restrict it. You also have the right to object at any time, regardless of any reason, to the processing of your personal data for direct marketing (which includes profiling to the extent that it is related to such direct marketing), if such processing was based on our legitimate interest. If the marketing was based on your consent, you can withdraw consent (see above).

Right to lodge a complaint: You can lodge a complaint to your local data protection supervisory authority or with any other data protection authority in the EU. However, we will appreciate if you first contact us to try and solve your problem – you can find our contact details below.

You can exercise your rights in relation to us by filling out this web form, which will help us to deal with your request properly. The online form contains the information that we need to verify your identity and review your request. For requests submitted by telephone or email, you will need to provide us with sufficient information that allows us to reasonably verify that you are the person whose personal data we collected and describe your request in sufficient detail to allow us to properly evaluate and respond to it. If we are not able to verify your identity for access and deletion requests with the information provided, we may ask you for additional pieces of information.

5. Information Security

To protect your personal information from loss, theft, and unauthorized access, use, or disclosure, we have implemented technical, administrative, and physical security measures including encryption, access controls, and secure development processes. We also pass on these standards to our external service providers.

6. Contact information

In order to exercise your rights, please use the web form mentioned above under section 5. If you have any other questions regarding the subject matter of personal data protection, you can contact us at the following contact details:

Volvo Car Corporation
Post address: Volvo Car Corporation, Assar Gabrielssons Väg, SE-405 31 Gothenburg, Sweden
E-mail address: dataprotection@volvocars.com
Data Protection Officer: globdpo@volvocars.com

7. Changes to our Privacy Notice

We reserve the right, at our discretion, to modify our privacy practices and update and make changes to this privacy notice at any time. Whenever we make substantial changes to this notice, and in particular when this notice underlies your consent, we will inform you of the changes.