Data Protection Statement – Employee Candidates

Date of publication: 20-01-2026

1. Introduction

VALA Group Oy (later referred as “VALA”) places the highest value on protecting the privacy of its employee candidates and is committed to processing personal data carefully and responsibly.

VALA is part of the Siili Group (Siili Solutions Plc and its group companies). However, VALA acts as an independent data controller for personal data processed in its recruitment processes and is responsible for defining the purposes and means of such processing.

This Data Protection Statement (“Statement”) explains how VALA processes your personal data in the context of recruitment processes. Personal data refers to any information related to an identified or identifiable person, a data subject. Data subjects under this Statement include VALA’s employee candidates.

VALA processes your personal data in accordance with all applicable laws, as well as VALA’s internal data protection and information security guidelines.

VALA combines human expertise with the responsible use of modern, AI-assisted tools to make recruitment transparent, fair, and efficient. Tools such as Talendary and Co-pilot Meeting Insights may be used to support candidate evaluation and improve the quality and consistency of the process. We use these tools under human oversight, and all decisions are made by people.

This Statement explains how AI-assisted tools are used, how human oversight is ensured, and how candidates’ privacy and rights are protected in accordance with the EU General Data Protection Regulation (GDPR) and the EU Artificial Intelligence Act (AI Act).

2. Personal Data Collection Methods and Sources

VALA primarily collects personal data directly from you. Participating in the recruitment process requires that you provide certain personal data to VALA.

When personal data are to be collected from other sources (such as previous employers), VALA will seek your consent as required by law.

If you provide a third party’s personal data to VALA (such as referee contact information), you must obtain consent from the third party.

3. Personal Data Collected and Processed

VALA may process following personal data:

• Basic Data – First and last names, personal contact information (phone number, email address, mailing address), photos.
• Education, Skills, and Experience Data – CV, education and degree information, professional experience, skills and competencies, certificates, interests.
• Suitability Assessment Data – Interview notes, suitability assessment, potential internal and external referees, and their assessment of the candidate.
• AI Scoring Data – When applicable, VALA uses an AI-assisted evaluation system (Talendary, integrated with Teamtailor) to analyze the content of applications. Talendary’s AI model evaluates candidate fit through the candidate suitability score, which reflects how well a profile matches a given role based on both structured and contextual information. The score is generated by comparing skills, experience, and career patterns against job requirements, while also considering broader contextual knowledge - for example, typical role expectations, company size, and industry benchmarks. Each score is accompanied by motivation and references indicating which parts of the candidate’s information contributed to the result and why. The model only uses job-related criteria and completely excludes gender, age, name etc. from its scoring. Only data provided by the candidate is utilized. AI Scoring Data is used by recruiters in the recruitment process in question, not for any other purposes. Scoring helps us ensure that applications are considered fairly against predefined job criteria. VALA guarantees that every AI-assisted evaluation is subject to human review, and all decisions are made by people. AI scoring is always role-specific and is not reused in later recruitment processes.
• Meeting Insights / Summarization Data – In the context of interviews, VALA may use meeting insights / summarization features offered by Teamtailor or a Co-pilot tool to assist recruiters in summarizing interview content. This may involve transcription of spoken words (audio → text), generation of meeting summaries or highlights (key themes, candidate strengths/weaknesses), and use of these summaries to inform further recruitment decisions. Such data is processed only if you have consented to the use of the meeting insights feature, and summaries are used as supporting information only – recruiters always perform their own evaluation. Transcripts and summaries are stored in the candidate’s profile in Teamtailor in accordance with the general two-year retention period (see section 7 “Data Retention”) and may be visible in future recruitment processes involving the same candidate. This means that if you apply for another position at VALA, our recruiters may review previous interview notes and summaries before any possible new interviews take place. Each new recruitment process always includes a fresh evaluation based on the requirements of the new position.
• Potential Employment Relationship Preparations Data – Employment contract proposal, job title and description, salary proposal, office/workplace, business unit, employment start date, other employment terms and agreed benefits.
• Online Behavior Monitoring Data – Data collected via cookies such as the pages visited, the operating system of your computer, and browser type.

You may also choose to provide VALA with other types of personal data beyond those described above. VALA will process all personal data in accordance with this Statement.

4. Legal Bases and Purposes of Data Processing

VALA processes your personal data for predefined purposes based on contract, legal obligation, consent, or VALA’s legitimate interests. VALA ensures that its interests can be considered legitimate and conducts an evaluation of the lawfulness of its interests.

VALA processes your personal data to conduct its recruitment processes and prepare the potential employment relationship and introduction process.

The table below provides more information on the legal bases and purposes of processing.

Personal Data Category

Legal Bases

Purposes

Basic Data

Consent,

contract (if the candidate is chosen for the position),

VALA’s legitimate interests: personal data are used for identifying candidates, contacting them, arranging discussions, negotiating employment terms, making decisions, and preparing for onboarding.

Conducting a recruitment process, including identifying candidates, contacting them, arranging discussions, negotiating employment terms, making decisions, and preparing for onboarding.

Education, Skills, and Experience Data

Consent,

contract (if the employee candidate is chosen for the position),

VALA’s legitimate interests:

personal data are used for assessing suitability and ensuring the success of the recruitment process.

Conducting a recruitment process, assessing the candidate’s suitability for the position, and preparing for the potential employment relationship.

Suitability Assessment Data

Consent,

VALA’s legitimate interests:

personal data are used for assessing suitability and ensuring the success of the recruitment process.

Conducting a recruitment process and assessing the candidate’s suitability for the position.

AI Scoring Data

VALA’s legitimate interests: personal data are used for ensuring consistent and efficient recruitment decisions under human oversight.

AI scoring data are used to support the selection process by providing candidate scoring and assessment support, with final human decision-making.

Meeting Insights / Summarization Data

Consent

Meeting insights AI feature is used to assist recruiters in summarizing interview content.

Potential Employment Relationship Preparations Data

Contract,

VALA’s legitimate interests:

personal data are used for entering an employment contract as well as preparing for onboarding and employment.

Negotiating employment terms, making decisions, and preparing for onboarding.

Online Behavior Monitoring Data

Consent,

VALA’s legitimate interests: using essential cookies is necessary for the proper functioning of VALA’s website and services.

Cookies are employed to personalize website content and advertisements according to your preferences, facilitate social media functionalities, analyze website visits and usage patterns, and overall improve the website's performance. For further details on how VALA uses cookies, please refer to VALA’s Cookie Statement available on VALA’s website.

VALA may use meeting insights / summarization AI feature offered by Teamtailor or a Co-pilot tool to assist recruiters in summarizing interview content only when you consent to using this feature. You may decline this feature. Refusal will not disqualify you from candidacy nor have any other negative consequences on you. All transcripts and summaries generated will be retained for the duration defined in Section 7 “Data Retention” and will be used as supporting material only – recruiters will still perform their own independent evaluation. Consent may be withdrawn at any time by contacting the recruiter or gdpr@valagroup.com, and upon withdrawal all extracted summaries / transcripts will be deleted.

Your personal data may also be processed on VALA's legitimate interest to prevent and investigate misuse and issues, as well as to comply with legal requirements. VALA may process your personal data also for defending its legal rights, carrying out a trial or authority process and the execution of an authority order.

In addition, your personal data may be processed for reporting and analytics based on VALA’s legitimate interest. In these cases, VALA ensures that personal data is processed in such a form that you are not identifiable from the report or other result.

If VALA collects feedback from you about the recruitment process, such feedback is provided anonymously unless otherwise informed.

VALA may consider you for other positions that are open at the time of application or for future openings, with the purpose of collecting and maintaining a pool of candidates for potential vacancies. For this purpose, separate consent will be requested from you.

5. Disclosures of Personal Data

VALA may disclose your personal data to the following recipients:

• Siili Group Companies: As VALA is part of the Siili Group, personal data may be shared with companies within the Siili Group, based on VALA’s legitimate interest. These companies process personal data in accordance with this Statement or their own statement, substantially similar to this one.
• Service Providers and Subcontractors: Personal data may be disclosed to VALA’s service providers (including AI solution providers) and subcontractors who process personal data on behalf of VALA. Through appropriate contractual arrangements, VALA ensures that personal data is processed in accordance with this Statement and applicable laws.
• Business Partners: Personal data may be disclosed to trusted third parties, such as external advisors and auditors, based on VALA’s legitimate interest.
• Authorities, Legal Processes, and Legislation: VALA discloses personal data to competent authorities as required by mandatory legislation. Personal data may also be disclosed in connection with legal processes or as a response to the requests by authorities based on law, court order, court proceedings, or authority process, in compliance with applicable laws.
• Mergers and Acquisitions: In the event that VALA decides to sell, merge, or rearrange its business, such actions may include disclosing personal data to potential or actual purchasers and their advisors. If the disclosure of personal data is necessary in such a situation, VALA will share only the necessary personal data and only as permitted by applicable legislation.

6. Data Transfers Outside of the European Economic Area

VALA may transfer your personal data to Siili Group companies located outside of the European Economic Area (EEA) for arranging Siili Group operations. VALA may transfer personal data also to its cooperation partners, service providers and subcontractors located outside of the EEA for the purposes described in this Statement.

When personal data is transferred outside of the EEA, VALA uses an appropriate transfer basis (such as standard contractual clauses approved by the European Commission and possible supplementary measures) to ensure an adequate level of data protection.

7. Data Retention

VALA retains your personal data for as long as it’s necessary for the initial or compatible purposes for which the personal data have been collected. Retention periods are determined based on mandatory legislation and common industry practices.

In general, VALA retains your personal data for no longer than 2 years from the earlier of the following: the first recruitment process decision in which your data were processed (whether positive or negative), or the date the data were collected in case no recruitment decision is made.

After this period, personal data is deleted unless you have provided separate and explicit consent for continued retention for future recruitment opportunities.

AI Scoring Data and related outputs (such as score explanations or feature weightings) are retained only as long as necessary for validation, audit, or complaint handling — typically aligned with the general candidate data retention period. After this time, the data are anonymized or permanently deleted.

Meeting Insights Data and summaries / transcripts are stored only for as long as necessary for recruitment review or audit – by default no longer than the same retention period (2 years). After the retention period or upon consent withdrawal, these items are deleted.

VALA may also delete personal data that are no longer needed during the recruitment process. Information that becomes unnecessary, outdated, or for which there is no longer a valid reason for processing, will be anonymized or securely destroyed.

If you accept an offer of employment by VALA, any relevant personal data collected during the recruitment process may become part of your personnel records.

Detailed information on the retention of personal data collected with cookies is included in VALA’s Cookie Statement available on VALA’s website.

8. Data Security

VALA applies appropriate technical and organizational measures to guard against accidental and/or unlawful access, alteration, and destruction, or other processing, including unauthorized disclosure and transfer of personal data. These measures encompass (without limitation) proper firewall arrangements, malware detection, appropriate encryption of telecommunication and messages, as well as the use of secure and monitored equipment and server rooms.

Data security requirements are diligently observed in IT system access management and monitoring of access to IT systems. VALA personnel, processing personal data as part of their tasks, are trained and properly instructed in matters of data protection and data security.

When processing candidate data, VALA may employ third-party service providers (e.g. recruitment platforms, AI-assisted tools). VALA only partners with providers whose information security practices are demonstrably strong and aligned with recognized standards. AI-assisted tools are subject to regular audits and internal reviews to ensure fairness, reliability, and non-discrimination. Bias and fairness are managed through continuous testing and strict controls.

9. Automated Decision-Making and Profiling

VALA does not make hiring or rejection decisions based solely on automated processing. While VALA uses AI-assisted tools to support candidate evaluation, every decision is made by human recruiters or hiring managers.

AI-assisted tools used during recruitment involve profiling — meaning that personal data is analyzed automatically to evaluate certain personal aspects such as experience or skills. These tools are used only to assist human decision-making, never to replace it.

You have the right to understand how AI-assisted tools supported your evaluation and to request clarification if you believe the assessment does not fully reflect the information you provided. All AI-assisted evaluations at VALA are subject to human oversight.

10. Data Subject Rights

You have the following rights according to applicable legislation:

• Right to obtain information on the processing: You have the right to be informed of the collection and processing of their personal data.
• Right of access to data: You have the right to receive confirmation from VALA on whether or not VALA is processing personal data that concerns you. If your data is processed, VALA must provide you with a copy of the personal data processed.
• Right to rectification of data: You have the right to demand the rectification of inaccurate personal data concerning you and to have incomplete personal data completed.
• Right to the erasure of data: In certain cases, you have the right to have VALA erase data concerning you without undue delay.
• Right to restriction of processing: You can request VALA to restrict the processing of personal data concerning you.
• Right to object to the processing: You have the right to object to the processing of your personal data on grounds relating to your particular situation when a processing is based on legitimate interests pursued by VALA.
• Right to data portability: You have the right to receive the personal data that you have provided to VALA in a structured, commonly used, and machine-readable format and, if desired, transmit that data to another controller.
• Right not to be subject to a decision based solely on automated processing, including profiling: You have the right not to be subject to a decision based solely on automated processing, including profiling. VALA does not make recruitment decisions based solely on automated processing. All evaluations are reviewed by human recruiters or hiring managers, and all decisions are made by people.
• Right to understand and to obtain clarification on AI-assisted scoring: You have the right to understand how AI-assisted scoring was used to support your evaluation and to access the related score and its rationale. If you believe the score and related assessment does not fully reflect the information you provided, you can ask for additional clarification.
• Right to file a complaint to the data protection authority: You have the right to file a complaint with the national data protection authority (in Finland, the Data Protection Ombudsman) or other data protection authority within the EEA if you have experienced that your data have not been processed lawfully.

If VALA processes certain personal data based on your consent, you have a right to withdraw your consent at any time.

You can exercise your rights by contacting gdpr@valagroup.com.

11. Changes

VALA may change or amend this Statement as necessary. Substantial changes – including those related to the introduction or modification of AI-assisted processes – are announced on VALA’s website and/or data subjects are informed personally.

12. Contact Information

For questions regarding the processing of your personal data, please contact VALA’s data protection team at gdpr@valagroup.com.