PRIVACY POLICY

How We Handle Personal Data

HANDLING OF PERSONAL DATA AT THE ASSESSMENT COMPANY

When you engage with us, whether by using our website, participating as a candidate in our recruitment processes for a client, acting as a contact person for one of our clients through recruitment services or training and development programs, or utilizing any of our other services, The Assessment Company may process personal information about you. Your privacy is important to us, and this privacy statement provides all relevant information about the personal data collected, why we do it, and what rights you have in relation to our processing of personal information.

In certain situations, we may request specific consent from you, and this will be clearly indicated through our direct communication with you.

The individual responsible for managing the personal data we process is The Assessment Company AS, represented by the CEO. Our contact information is as follows:

Adresse: Parkgata 83, Postboks 16, 2301 Hamar

E-post: post@theac.no

Phone: 928 95 757

Org.nr. 919 294 299

In our recruitment processes, we share a joint responsibility with our client, the company we are recruiting on behalf of. This is especially important in recruitment processes where the candidate pool includes both internal, existing employees of our client, as well as external candidates. In cases of shared responsibility, you have the right to exercise your rights regarding the processing of personal data with each of the two joint controllers.

Data Collection

We gather and utilize your personal information for various purposes depending on who you are and how we engage with you. The following personal data is collected for the purposes outlined here:

As a candidate in the recruitment process, we rely on gathering essential information about you to handle your application effectively. This information can be collected automatically or by you registering it in our systems. Information gathering can occur in the following ways:

• Information gathered from registering a CV profile and updating it through "my page" in our candidate management system, as well as capturing IP addresses.
  • This section includes details such as contact information, identity documentation, CV, cover letter, certifications, personality and skills assessments, academic transcripts, and references' statements.
• If you apply for a position or create a profile using the "Apply with LinkedIn" or "Apply with jobreg" functions, the system will retrieve available information from your authenticated profile, which will then be stored in your profile.
• In some cases, we may collect information about you even if you haven't actively applied for a position by recording details like your name, current position, company, contact information (phone number, email, etc.). We also aggregate data for site visitors, including traffic and location data.
• Additionally, email correspondence may be retained when you reach out to us.

By voluntarily providing us with information during the recruitment process, you acknowledge that we will share your personal data with our client on whose behalf we are conducting recruitment. Based on GDPR Article 6(1) letter b (processing is necessary for the performance of a contract), we may process the information provided in general information forms. As a candidate, you have the choice to be considered solely for the position(s) you are applying for, or to also be available for other recruitment assignments.

Some candidates (including those participating in the final stages of recruitment processes) may be asked to complete various tests where the results, in the form of reports and notes, can be stored. Additionally, some candidates may be required to undertake case tasks that will be filmed and saved. Those candidates reaching this stage will provide specific consents prior to such processing and storage.

In certain processes, there is a requirement for us to obtain police certificates and credit information. The collection and processing of this type of information are based on GDPR article 6(1) letter a (consent).

In cases where we recruit individuals for public entities, we are required to create a public applicant list in accordance with the Public Administration Act. This list includes the name, age, position or job title, as well as the residential or work municipality of each applicant. Both our team and our client are obligated to share this personal information. If a candidate wishes to be exempted from the public applicant list, they must request this exemption themselves.

Processing is carried out based on GDPR Article 6(1) letter b (processing is necessary for the performance of a contract, or to take steps at the data subject's request before entering into a contract) when the candidate applies for a position, and based on GDPR Article 6(1) letter f (processing is necessary for purposes related to legitimate interests) when the processing is initiated by us. When the candidate completes specific case tasks with accompanying filming and other activities, the processing is based on GDPR Article 6(1) letter a (consent).

The information gathered is utilized where deemed essential to:

• Delivering our services to you and engaging in communication regarding these services with you.
• Assessing your qualifications and facilitating in relation to current and future recruitment or staffing assignments.
• Informing about the relevant opportunities and benefits we provide.
• Compliance with legal obligations
• When we gather IP addresses, it is done for security reasons, allowing you as a candidate to monitor which IP addresses have accessed your account.

If we retain application documentation after a recruitment process is concluded, it is done because the processing is necessary for purposes related to legitimate interests.

As a candidate in a search (headhunting) process: In some assignments for our clients, we conduct searches for candidates who are not actively seeking a job, by gathering information from publicly available sources such as Google and LinkedIn. In these cases, we process names, email addresses, phone numbers, and positions, compile them in records, and then pass them on to our client. This processing is based on GDPR Article 6(1) letter f (processing is necessary for purposes related to legitimate interests). If you are registered in our records through this method, you will receive information via email where you can easily unsubscribe if you do not wish for us to process your personal information.

As a participant in a training and development program, we need to handle your personal information to ensure the program's effectiveness. We establish a specific agreement with an employer that outlines the scope of each assignment. The training program involves collecting details such as your name, phone number, email address, reports, and notes from personality tests. Additionally, we conduct case studies with video recordings, storing the footage for as long as necessary to derive value from the training. Prior to engaging in these tasks, each participant completes specialized registration forms, providing consent for processing. Therefore, the processing is based on GDPR Article 6(1) letter a (consent) for certain aspects of the training program, and on GDPR Article 6(1) letter b (processing is necessary to fulfill a contract) for other registrations.

As a contact person for a company that is a client in recruitment assignments, we may need to process personal information for one or more individuals from the organization to carry out recruitment tasks. This includes names, positions, phone numbers, and email addresses.

Regarding invoicing. In this context, contact information and payment details are processed. This processing is based on GDPR Article 6(1) letter b (processing is necessary to fulfill a contract that the data subject is a part of).

As a supplier. As a representative for our suppliers, there may be instances where it is necessary for us to process personal information such as contact details. This processing is based on GDPR Article 6(1) letter f (processing is necessary for purposes related to legitimate interests).

Sending out marketing, newsletters, and other relevant information. In this context, names and email addresses are processed. This processing is based on consent from the recipient as per the marketing law § 15.

Information collected through our websites is handled with the utmost care. We process personal data provided by users solely for the purpose of following up with them. This information is not used for any other purpose without explicit consent, unless a contractual relationship is established and the data is processed in accordance with GDPR Article 6(1) letter b (processing is necessary to fulfill a contract).

Disclosure of personal information to third parties

We do not disclose or transfer your personal information to others unless there is a lawful basis for it. There are legitimate grounds for transferring your personal data to third parties in various cases, such as in recruitment processes where we need to pass on information to our clients, as per GDPR Article 6(1) letter b (processing is necessary to fulfill a contract), in cases where specific consent has been given, or when the Data Controller or Processor is obligated to do so due to legal requirements.

These third parties maintain separate and independent privacy policies. While The Assessment Company Norge AS is not responsible for the content and activities of these affiliated services, we encourage our partners, including our clients, to handle information responsibly and in accordance with privacy regulations at all times. Safeguarding the integrity of our services, we limit the information shared to the essential minimum.

We may also transfer information between our Norwegian and Swedish companies, with a special mutual data processing agreement in place for projects involving personnel from both Norway and Sweden simultaneously.

The Assessment Company utilizes various data processors to handle personal information on our behalf. In such cases, we have established data processing agreements to ensure information security throughout the process and to regulate the access and handling of information by the data processors. Currently, we work with the following data processors:

• Recruitment Manager AS, kandidathåndteringssystem
• Master Management Norge AS
• Optimas AS
• Semac AS
• Xref
• Digiflow AS
• Azets AS
• Motimate AS
• Cut-e
• Hubspot

All processing of personal data by The Assessment Company is conducted within the EU/EEA. We also strive to utilize data processors that handle personal data within the EU/EEA, or that meet the requirements of data processing in areas outside the EU/EEA as stipulated by privacy regulations.

Storage Duration

We store your personal information with us for as long as it is necessary for the purpose for which the personal data was collected.

For example, this means that personal information processed based on your consent will be deleted if you withdraw your consent. Personal data processed to fulfill an agreement with you will be deleted once the agreement is fulfilled, all obligations are met, and there is no longer a specific reason to retain the information after a careful assessment of interests.

Personal information that we collect and is necessary for purposes related to a legitimate interest will be deleted once there is no longer a legitimate interest present (interest balancing). Personal information that we process to fulfill a legal obligation from authorities will be deleted as determined by the legal basis. This includes, for example, accounting and financial regulations.

The table below provides an overview of the duration for which we process personal information for various purposes:

We utilize cookies to enhance user experience and security.

Cookies, also known as informasjonskapsler, are small files stored in your browser or on the device you use when accessing a website. Like most websites, we use cookies to enhance your user experience, making it better, faster, and more secure. For instance, we use cookies for:

• To enable specific functions in our candidate management system.
• Enhance the security of your user account and other accounts with us.
• Provide insights into user behavior to enhance the user experience.
• Provide insights into website traffic to tailor content and marketing.

We utilize industry-standard analytics tools to analyze visitor behavior, which may place cookies in your browser to provide insights into user interactions on the website. Through the analytics tool Piwik Pro, data processors collect anonymized information about visitors. The purpose of this is to generate statistics used to enhance and further develop the information offerings and services provided. Examples of what the statistics are used for include information on the number of visitors to various pages, the duration of visits, where users are coming from, and which browsers are being used.

As you navigate through the system, some pages may include services from third parties, such as maps in a job listing from Google Maps, Vimeo, and more. Using these pages with embedded services may result in additional cookies being set by these services. Tech Group AS does not have control over this, so we also recommend familiarizing yourself with the privacy policies of these services.

If you use the "search with LinkedIn" or "search with jobreg" function in our recruitment system, it will set a cookie from the respective third parties.

Block and delete cookies

If you prefer not to allow cookies to be set when visiting the website, you can decline this in our cookie banner or adjust this in your browser settings. You can find more information on this in your browser's documentation. Please note that disabling the website's ability to set cookies may affect the user experience and some functions on the site may not work properly.

You can also delete existing cookies in your browser. Refer to your browser's documentation for more information on how to do this.

Access, modification, and deletion of your personal information

As a registered user in the system, you have the right to request access, correction, and deletion of the personal information we hold about you. Your request will be answered free of charge and no later than 30 days after it is made. You also have the right to request limited processing and, under certain conditions, to object to the processing.

As a candidate, you have the flexibility to delete your own profile anytime from within the "Your Profile" section in the system, or you can reach out to The Assessment Company Norge AS for assistance. You also have the option to modify the information you have entered in your profile within the system.

If you wish to access the information The Assessment Company Norge AS holds about you, exercise your rights as described above, or have any questions or feedback regarding our handling of personal data, you can contact your designated point of contact with us or use the contact details provided in this document. In such cases, we may request you to confirm your identity or provide additional information before allowing you to exercise your rights with us. This measure ensures that we only grant access to your personal information to you – and not to anyone posing as you.

Complaints

If you believe our handling of personal data does not align with what is described here or if you feel we are in violation of privacy laws in any way, you have the option to lodge a complaint with Datatilsynet. For information on how to contact Datatilsynet, please visit Datatilsynet's website: www.datatilsynet.no.

Changes

If there are any changes to our services or updates to the regulations regarding the handling of personal information, it may result in adjustments to the information provided here. If we have your contact details, we will notify you of these changes. Additionally, updated information will always be easily accessible on our website.