Data Protection Statement – Employee Candidates
Date of publication: 20-01-2026
1. Introduction
VALA Group Oy (later referred as “VALA”) places the
highest value on protecting the privacy of its employee candidates and is
committed to processing personal data carefully and responsibly.
VALA is
part of the Siili Group (Siili Solutions Plc and its group companies). However,
VALA acts as an independent data controller for personal data processed in its
recruitment processes and is responsible for defining the purposes and means of
such processing.
This
Data Protection Statement (“Statement”) explains how VALA processes your
personal data in the context of recruitment processes. Personal data refers to
any information related to an identified or identifiable person, a data
subject. Data subjects under this Statement include VALA’s employee candidates.
VALA
processes your personal data in accordance with all applicable laws, as well as
VALA’s internal data protection and information security guidelines.
VALA
combines human expertise with the responsible use of modern, AI-assisted tools
to make recruitment transparent, fair, and efficient. Tools such as Talendary
and Co-pilot Meeting Insights may be used to support candidate evaluation and
improve the quality and consistency of the process. We use these tools under
human oversight, and all decisions are made by people.
This
Statement explains how AI-assisted tools are used, how human oversight is
ensured, and how candidates’ privacy and rights are protected in accordance
with the EU General Data Protection Regulation (GDPR) and the EU Artificial
Intelligence Act (AI Act).
2. Personal Data Collection
Methods and Sources
VALA
primarily collects personal data directly from you. Participating in the
recruitment process requires that you provide certain personal data to VALA.
When
personal data are to be collected from other sources (such as previous
employers), VALA will seek your consent as required by law.
If you
provide a third party’s personal data to VALA (such as referee contact
information), you must obtain consent from the third party.
3. Personal Data Collected
and Processed
VALA may
process following personal data:
- Basic
Data –
First and last names, personal contact information (phone number, email
address, mailing address), photos.
- Education,
Skills, and Experience Data – CV, education and degree information,
professional experience, skills and competencies, certificates, interests.
- Suitability Assessment Data – Interview notes, suitability
assessment, potential internal and external referees, and their assessment
of the candidate.
- AI
Scoring Data – When applicable, VALA uses an AI-assisted evaluation system
(Talendary, integrated with Teamtailor) to analyze the content of
applications. Talendary’s AI model evaluates candidate fit through the
candidate suitability score, which reflects how well a profile matches a
given role based on both structured and contextual information. The score
is generated by comparing skills, experience, and career patterns against
job requirements, while also considering broader contextual knowledge -
for example, typical role expectations, company size, and industry
benchmarks. Each score is accompanied by motivation and references
indicating which parts of the candidate’s information contributed to the
result and why. The model only uses job-related criteria and completely
excludes gender, age, name etc. from its scoring. Only data provided by
the candidate is utilized. AI Scoring Data is used by recruiters in the
recruitment process in question, not for any other purposes. Scoring helps
us ensure that applications are considered fairly against predefined job
criteria. VALA guarantees that every AI-assisted evaluation is subject to
human review, and all decisions are made by people. AI scoring is always
role-specific and is not reused in later recruitment processes.
- Meeting
Insights / Summarization Data – In the context of interviews, VALA may use
meeting insights / summarization features offered by Teamtailor or a
Co-pilot tool to assist recruiters in summarizing interview content. This
may involve transcription of spoken words (audio → text), generation of
meeting summaries or highlights (key themes, candidate
strengths/weaknesses), and use of these summaries to inform further
recruitment decisions. Such data is processed only if you have consented
to the use of the meeting insights feature, and summaries are used as
supporting information only – recruiters always perform their own
evaluation. Transcripts and summaries are stored in the candidate’s
profile in Teamtailor in accordance with the general two-year retention
period (see section 7 “Data Retention”) and may be visible in future
recruitment processes involving the same candidate. This means that if you
apply for another position at VALA, our recruiters may review previous
interview notes and summaries before any possible new interviews take
place. Each new recruitment process always includes a fresh evaluation
based on the requirements of the new position.
- Potential Employment Relationship
Preparations Data –
Employment contract proposal, job title and description, salary proposal,
office/workplace, business unit, employment start date, other employment
terms and agreed benefits.
- Online
Behavior Monitoring Data – Data collected via cookies such as the pages
visited, the operating system of your computer, and browser type.
You may
also choose to provide VALA with other types of personal data beyond those
described above. VALA will process all personal data in accordance with this
Statement.
4. Legal Bases and Purposes
of Data Processing
VALA
processes your personal data for predefined purposes based on contract, legal
obligation, consent, or VALA’s legitimate interests. VALA ensures that its
interests can be considered legitimate and conducts an evaluation of the
lawfulness of its interests.
VALA
processes your personal data to conduct its recruitment processes and prepare
the potential employment relationship and introduction process.
The
table below provides more information on the legal bases and purposes of
processing.
Personal Data Category
Legal Bases
Purposes
Basic Data
Consent,
contract
(if the candidate is chosen for the position),
VALA’s
legitimate interests: personal data are used for identifying candidates,
contacting them, arranging discussions, negotiating employment terms, making
decisions, and preparing for onboarding.
Conducting
a recruitment process, including identifying candidates, contacting them,
arranging discussions, negotiating employment terms, making decisions, and
preparing for onboarding.
Education, Skills, and Experience Data
Consent,
contract
(if the employee candidate is chosen for the position),
VALA’s
legitimate interests:
personal
data are used for assessing suitability and ensuring the success of the
recruitment process.
Conducting
a recruitment process, assessing the candidate’s suitability for the
position, and preparing for the potential employment relationship.
Suitability Assessment Data
Consent,
VALA’s
legitimate interests:
personal
data are used for assessing suitability and ensuring the success of the
recruitment process.
Conducting
a recruitment process and assessing the candidate’s suitability for the
position.
AI Scoring Data
VALA’s
legitimate interests: personal data are used for ensuring consistent and
efficient recruitment decisions under human oversight.
AI
scoring data are used to support the selection process by providing candidate
scoring and assessment support, with final human decision-making.
Meeting Insights / Summarization Data
Consent
Meeting
insights AI feature is used to assist recruiters in summarizing interview
content.
Potential Employment Relationship Preparations Data
Contract,
VALA’s
legitimate interests:
personal
data are used for entering an employment contract as well as preparing for
onboarding and employment.
Negotiating
employment terms, making decisions, and preparing for onboarding.
Online Behavior Monitoring Data
Consent,
VALA’s
legitimate interests: using essential cookies is necessary for the proper
functioning of VALA’s website and services.
Cookies
are employed to personalize website content and advertisements according to
your preferences, facilitate social media functionalities, analyze website
visits and usage patterns, and overall improve the website's performance. For
further details on how VALA uses cookies, please refer to VALA’s Cookie
Statement available on VALA’s website.
VALA may
use meeting insights / summarization AI feature offered by Teamtailor or a
Co-pilot tool to assist recruiters in summarizing interview content only when
you consent to using this feature. You may decline this feature. Refusal will
not disqualify you from candidacy nor have any other negative consequences on
you. All transcripts and summaries generated will be retained for the duration
defined in Section 7 “Data Retention” and will be used as supporting material
only – recruiters will still perform their own independent evaluation. Consent
may be withdrawn at any time by contacting the recruiter or gdpr@valagroup.com,
and upon withdrawal all extracted summaries / transcripts will be deleted.
Your
personal data may also be processed on VALA's legitimate interest to prevent
and investigate misuse and issues, as well as to comply with legal
requirements. VALA may process your personal data also for defending its legal
rights, carrying out a trial or authority process and the execution of an
authority order.
In
addition, your personal data may be processed for reporting and analytics based
on VALA’s legitimate interest. In these cases, VALA ensures that personal data
is processed in such a form that you are not identifiable from the report or
other result.
If VALA
collects feedback from you about the recruitment process, such feedback is
provided anonymously unless otherwise informed.
VALA may
consider you for other positions that are open at the time of application or
for future openings, with the purpose of collecting and maintaining a pool of
candidates for potential vacancies. For this purpose, separate consent will be
requested from you.
5. Disclosures of Personal
Data
VALA may
disclose your personal data to the following recipients:
- Siili
Group Companies: As VALA is part of the Siili Group, personal data may be shared
with companies within the Siili Group, based on VALA’s legitimate
interest. These companies process personal data in accordance with this
Statement or their own statement, substantially similar to this one.
- Service
Providers and Subcontractors: Personal data may be disclosed to VALA’s service
providers (including AI solution providers) and subcontractors who process
personal data on behalf of VALA. Through appropriate contractual
arrangements, VALA ensures that personal data is processed in accordance
with this Statement and applicable laws.
- Business
Partners: Personal data may be disclosed to trusted third parties, such as
external advisors and auditors, based on VALA’s legitimate interest.
- Authorities,
Legal Processes, and Legislation: VALA discloses personal data to competent
authorities as required by mandatory legislation. Personal data may also
be disclosed in connection with legal processes or as a response to the
requests by authorities based on law, court order, court proceedings, or
authority process, in compliance with applicable laws.
- Mergers
and Acquisitions: In the event that VALA decides to sell, merge, or rearrange its
business, such actions may include disclosing personal data to potential
or actual purchasers and their advisors. If the disclosure of personal
data is necessary in such a situation, VALA will share only the necessary
personal data and only as permitted by applicable legislation.
6. Data Transfers Outside of
the European Economic Area
VALA may
transfer your personal data to Siili Group companies located outside of the
European Economic Area (EEA) for arranging Siili Group operations. VALA may
transfer personal data also to its cooperation partners, service providers and
subcontractors located outside of the EEA for the purposes described in this
Statement.
When
personal data is transferred outside of the EEA, VALA uses an appropriate
transfer basis (such as standard contractual clauses approved by the European
Commission and possible supplementary measures) to ensure an adequate level of
data protection.
7. Data Retention
VALA
retains your personal data for as long as it’s necessary for the initial or
compatible purposes for which the personal data have been collected. Retention
periods are determined based on mandatory legislation and common industry
practices.
In
general, VALA retains your personal data for no longer than 2 years from the
earlier of the following: the first recruitment process decision in which your
data were processed (whether positive or negative), or the date the data were
collected in case no recruitment decision is made.
After
this period, personal data is deleted unless you have provided separate and
explicit consent for continued retention for future recruitment opportunities.
AI
Scoring Data and related outputs (such as score explanations or feature
weightings) are retained only as long as necessary for validation, audit, or
complaint handling — typically aligned with the general candidate data
retention period. After this time, the data are anonymized or permanently
deleted.
Meeting
Insights Data and summaries / transcripts are stored only for as long as
necessary for recruitment review or audit – by default no longer than the same
retention period (2 years). After the retention period or upon consent
withdrawal, these items are deleted.
VALA may
also delete personal data that are no longer needed during the recruitment
process. Information that becomes unnecessary, outdated, or for which there is
no longer a valid reason for processing, will be anonymized or securely
destroyed.
If you
accept an offer of employment by VALA, any relevant personal data collected
during the recruitment process may become part of your personnel records.
Detailed
information on the retention of personal data collected with cookies is
included in VALA’s Cookie Statement available on VALA’s website.
8. Data Security
VALA
applies appropriate technical and organizational measures to guard against
accidental and/or unlawful access, alteration, and destruction, or other
processing, including unauthorized disclosure and transfer of personal data.
These measures encompass (without limitation) proper firewall arrangements,
malware detection, appropriate encryption of telecommunication and messages, as
well as the use of secure and monitored equipment and server rooms.
Data
security requirements are diligently observed in IT system access management
and monitoring of access to IT systems. VALA personnel, processing personal
data as part of their tasks, are trained and properly instructed in matters of
data protection and data security.
When
processing candidate data, VALA may employ third-party service providers (e.g.
recruitment platforms, AI-assisted tools). VALA only partners with providers
whose information security practices are demonstrably strong and aligned with
recognized standards. AI-assisted tools are subject to regular audits and
internal reviews to ensure fairness, reliability, and non-discrimination. Bias
and fairness are managed through continuous testing and strict controls.
9. Automated Decision-Making
and Profiling
VALA
does not make hiring or rejection decisions based solely on automated
processing. While VALA uses AI-assisted tools to support candidate evaluation,
every decision is made by human recruiters or hiring managers.
AI-assisted
tools used during recruitment involve profiling — meaning that personal data is
analyzed automatically to evaluate certain personal aspects such as experience
or skills. These tools are used only to assist human decision-making, never to
replace it.
You have
the right to understand how AI-assisted tools supported your evaluation and to
request clarification if you believe the assessment does not fully reflect the
information you provided. All AI-assisted evaluations at VALA are subject to
human oversight.
10. Data Subject Rights
You have
the following rights according to applicable legislation:
- Right
to obtain information on the processing: You have the right to be informed of
the collection and processing of their personal data.
- Right
of access to data: You have the right to receive confirmation from VALA on whether
or not VALA is processing personal data that concerns you. If your data is
processed, VALA must provide you with a copy of the personal data
processed.
- Right
to rectification of data: You have the right to demand the rectification
of inaccurate personal data concerning you and to have incomplete personal
data completed.
- Right
to the erasure of data: In certain cases, you have the right to have VALA erase
data concerning you without undue delay.
- Right
to restriction of processing: You can request VALA to restrict the
processing of personal data concerning you.
- Right
to object to the processing: You have the right to object to the processing
of your personal data on grounds relating to your particular situation
when a processing is based on legitimate interests pursued by VALA.
- Right
to data portability: You have the right to receive the personal data that you have
provided to VALA in a structured, commonly used, and machine-readable
format and, if desired, transmit that data to another controller.
- Right
not to be subject to a decision based solely on automated processing,
including profiling: You have the right not to be subject to a decision based solely
on automated processing, including profiling. VALA does not make
recruitment decisions based solely on automated processing. All
evaluations are reviewed by human recruiters or hiring managers, and all
decisions are made by people.
- Right
to understand and to obtain clarification on AI-assisted scoring: You have the right
to understand how AI-assisted scoring was used to support your evaluation
and to access the related score and its rationale. If you believe the
score and related assessment does not fully reflect the information you
provided, you can ask for additional clarification.
- Right
to file a complaint to the data protection authority: You have the right
to file a complaint with the national data protection authority (in
Finland, the Data Protection Ombudsman) or other data protection authority
within the EEA if you have experienced that your data have not been
processed lawfully.
If VALA
processes certain personal data based on your consent, you have a right to
withdraw your consent at any time.
You can
exercise your rights by contacting gdpr@valagroup.com.
11. Changes
VALA may
change or amend this Statement as necessary. Substantial changes – including
those related to the introduction or modification of AI-assisted processes –
are announced on VALA’s website and/or data subjects are informed personally.
12. Contact Information
For
questions regarding the processing of your personal data, please contact VALA’s
data protection team at gdpr@valagroup.com.
