Tibber’s privacy notice for recruitment
The Tibber group is a digital electricity provider. We operate in different local markets (countries); our recruitment process is however centralised to the group parent company, Tibber AS. We strive to manage all applications in a systematic and transparent way using a digital platform where we store and manage applications. It is important that the persons applying for a job feel safe with, and are informed about, how we handle that person’s personal data in the recruitment process.
Definitions:
“Tibber AS” (hereafter also “Tibber”, “Controller”, “we”, “us”, etc.) is the legal body acting as controller in the recruitment process in the Tibber group (also see point 1 below)
“Applicant” (hereafter also “you”, “your”, etc.) is the person applying for a job, either applying to a vacant position or sending an unsolicited job application or using the Service.
“Service” is the digital platform that we use for handling recruitments and simplifying the hiring process.
“Teamtailor” is the provider of the Service that we use and also the name of the Service. The provider acts as a Processor.
“Processor” is a contractor that processes personal data on our behalf.
“Privacy notice” is this privacy notice for recruitments in Tibber group.
1. Controller
Tibber AS (company number 916 276 338), Hafstadvegen 23, 6800 Førde, Norway is the controller for the processing of your personal data. Your personal data is processed with the purpose of managing and facilitating recruitment of employees to our business.
2. Collection of personal data
We are responsible for the processing of the personal data that the Applicant contributes in the recruitment process (including to the Service), or for the personal data that we in other ways collects with regards to the recruitment process and the Service.
When and how we collect personal data
We collect personal data about Applicants from Applicants when Applicants
- make an application through the Service or otherwise, adding personal data about themselves either personally or by using a relevant third-party source such as LinkedIn,
- use the Service to connect with our staff, adding personal data about themselves either personally or by using a third-party source such as LinkedIn and
- provides personal data in the chat (provided through the website that uses the Service) and such data is of relevance to the application procedure.
We also collect data from third parties, such as Linkedin and through other public sources. This is referred to as “Sourcing” and can be manually performed by our employees or automatically in the Service.
In some cases, existing employees at Tibber can make recommendations about potential applicants. Such employees will add personal data about such potential applicants. In the cases where this is made, the potential applicant is considered an Applicant in the context of this Privacy notice and will be informed about the processing, including from whom we received the recommendation. For further “reference” data from an existing employee, we will collect the Applicant’s consent.
The types of personal data collected and processed
The categories of personal data that can be collected when we manage job applications, through the Service or otherwise, can be used to identify natural persons from names, e-mails, pictures and videos, information from LinkedIn-accounts, answers to questions asked through the recruiting process, titles, education and other information that the Applicant or others have provided as part of the recruitment process. Depending on the recruitment process, we may also process personal data from interviews and relevant test results.
Purpose and lawfulness of processing
The purpose of the collecting and processing of personal data is to (a) manage recruiting to a specific position, (b) receive and manage unsolicited job applications, (c) handle and meet legal disputes and (d) manage our talent pool. The lawfulness of the processing of personal data for purposes (a) and (b) is to take steps at the request of you prior to entering into a contract (Art 6.1b GDPR); for (c) our legitimate interest (Art. 6.1f GDPR) where we have assessed our interest to be able to handle any legal disputes that can be raised against us as stronger than your interests in relation to the processing of your personal data; and for (d) your consent (Art. 6.1a).
If the Applicant withdraws an application, we may continue to process relevant data for the purposes (c) above. For processings where we rely on consent, the Applicant can at any time withdraw such consent in the Service and then we will cease to process your data for that purpose.
Storage and transfers
The personal data collected through the Service is stored and processed inside the EU/EEA. If we for any reason need to process any personal data outside the EU/EEA, we will make certain that such third country have an adequate level of protection according to the European Commission, or processed by suppliers we have entered into binding agreements that complies with the lawfulness of third country transfers (as Standard Contractual Clauses) or to other suppliers where there are adequate safeguards are in order to protect the rights of the data subjects whose data is transferred.
How long the personal data will be processed
If an Applicant does not object, in writing, to the processing of their personal data, the personal data will be stored and processed by us as long as we deem it necessary with regards to the purposes stated above. For the purpose (a) this will normally be during the recruitment period, for the purpose (b) this will be for a period necessary to manage your application and collect further consent if needed, for (c) for the period required by the laws in the country where the dispute may be raised, starting from the time of final decision of the recruitment, and for the purpose (d) this will be for a period specified in the consent unless the consent is withdrawn or a new consent is collected.
3. Your rights
When we are processing your personal data, you have some rights. You have, for example, the right to have access to your personal data or the right to have your personal data corrected. Here you can read more about your rights and how you do when you want to exercise any of your rights. Normally we will complete your request within a month, however in special cases and situations we can extend this another two months. Also note that these rights are not absolute and we try all requests on an individual basis.
If you wish to exercise any of your rights, you can contact Tibber via email at recruitment@tibber.com. These rights are free to use unless your requests are unfounded or excessive we might charge a fee or refuse to act on your request.
Specification of your rights
Request access to your personal data. Upon your request, Tibber will confirm whether we are processing your personal data and provide you with information on how we process the personal data. If requested, we provide you with a copy of that personal data.
Request correction of the personal data that we hold about you. By having access to personal data, you may be able to ensure the accuracy of your personal data. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us. Some data may be needed to process for historic reasons, i.e. may not always be possible to correct fully. You can yourself correct some personal data throughout the HR-system(s) we use.
Request deletion of your personal data. This enables you to ask us to delete or remove personal data, which we have no purpose for continuing to process. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), when you have withdrawn your consent to the processing and we have no other legal ground for the processing, where we may have processed your information unlawfully or where we are required to erase your personal data to comply with national law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons or if our interests in the processing overweigh your rights which will be notified to you, if applicable, at the time of your request.
Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms. If the objection is related to direct marketing purposes we shall no longer process the personal data for those purposes.
Request restriction of processing of your personal data unless we demonstrate compelling legitimate grounds for the processing. This enables you to ask us to suspend the processing of your personal data
- if you want us to establish the data’s accuracy
- where our use of the data is unlawful, but you do not want us to erase it
- where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims
- if you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
Request to object to have automated decision‐making and profiling as you have the right to not be subject to decisions based solely on automated processing of your personal data, including profiling, that affect you, unless such processing is necessary for entering into, or the performance of, a contract between you and us or you provide your explicit consent to such processing.
Request the transfer (data portability) of your personal data to you or a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format, provided that the information requested to be transferred is provided by you, is processed on the basis of fulfilling an agreement or based on consent, and provided that the processing of personal data is carried out by automated means.
Withdraw consent at any time where we are relying on consent to process your personal data if we rely on your consent to process your personal data. You have the right to withdraw that consent at any time. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.
The right to complain to a supervisory authority in your country of residence. If you believe that our processing of your personal data infringes data protection laws, you have a legal right to lodge a complaint with a supervisory authority responsible for data protection. If you are a resident of an EU or EEA member state, you may do so in the state of your residence. However, the responsible lead supervisory authority for Tibber AS is the Norwegian Data Inspectorate (Datatilsynet) for its cross-border processing activities, in accordance with GDPR Article 56.
4. Transfer of personal data to third party
We will not sell Applicants’ personal data to third parties. Nor will we transfer Applicants' personal data to third parties except to:
- other Tibber group companies (affiliates) where the actual position is located or where you would be located (for a position where location is not decided in advance) and/or that manage the actual recruitment process for the position you apply for; the affiliates are Tibber Norge AS, Tibber AB, Tibber OY, Tibber Deutschland GmbH, Tibber Netherlands BV and Tibber Danmark A/S.
- our contractors and subcontractors, acting as our Processors and Sub-Processors in accordance with our instructions; our main Processor is Teamtailor AB that provides us with the Service, for specific recruitments we can also use external recruitment consultants as Processors or controllers depending on the situation.
- authorities or legal advisors in case criminal or improper behaviour is suspected; and
- authorities, legal advisors or other actors; so we can verify the Applicants employability, we can share information if required by us according to law or authority’s injunction.
We will only transfer Applicants’ personal data to third parties that we have confidence in. We carefully choose partners to ensure that your personal data is processed in accordance with current privacy legislation. We cooperate with the following categories of processors of personal data; Teamtailor (who supplies the Service), server and hosting companies, e-mail reference companies, video processing companies, information-sourcing companies, analytical service companies and other companies with regards to supplying the Service.
5. Cookies
The website jobs.tibber.com uses so-called "cookies". Cookies are small text files that are stored either temporarily for the duration of a session (session cookies) or permanently (persistent cookies) on your terminal device. Session cookies are automatically deleted at the end of your visit. Permanent cookies remain stored on your terminal device until you delete them yourself or an automatic solution is provided by your web browser.
Cookies have various functions. Many cookies are technically necessary, as certain website functions would not work without them (e.g. the shopping cart function or language settings). Other cookies are used to evaluate user behaviour or display advertising.
We have a detailed policy that explains which cookies are set on the website and which other tools and analytics services are used. You can find this policy here.
6. Changes
We have the right to, at any time, make changes or additions to the Privacy notice. The latest version of the Privacy notice will always be available on our “jobs website” and through the Service. A new version is considered communicated to the Applicant when the Applicant has either received an email informing the Applicant of the new version (using the email stated by the Applicant in connection to the use of the Service) or when the Applicant is otherwise informed of the new Privacy notice.
6. Contact
For questions, further information about our handling of personal data or for contact with us in other matters, please contact us on recruitment@tibber.com.
Version: May 2022
