Recruitment Privacy Policy

1. INTRODUCTION AND CONTACT DETAILS
1.1 In this privacy notice, we explain how your personal data is processed by the Billerud group when you apply for our positions in our recruitment tool (Talentsoft) or otherwise apply for a job or internship at Billerud.

1.2 It is important to us that you feel confident that we treat your personal data with due care. We have therefore implemented the technical and organisational security measures necessary in order to protect your personal data against unauthorised access and use. We encourage you to take the time to read this privacy notice carefully.

1.3 The Billerud entity which you have applied for a job or internship at is the data controller and thereby responsible for the processing of your personal data carried out by us or on our behalf. If you have any questions regarding the processing, you are welcome to contact our HR department or the contact person that is indicated as responsible for the relevant recruitment, who may refer you to Billerud's Data Protection Manager (DPM).

2. WHAT PERSONAL DATA DO WE PROCESS ABOUT YOU?
2.1 Personal data is all information that may be associated with you as an individual. We process personal data that you provide in connection with applying to us, sending us your application or that we otherwise collect, such as:
• Your name, personal identification number and contact details.
• Your CV and application letter.
• Other documentation that you have provided to us, such as grades, employment certificates, current employment information, etc.
• Information obtained in connection with interviews, digital screening questions, tests or from references you have provided to us.
• Information from background checks (if appropriate/necessary for the job and always after you have been informed in advance). We will inform you that the background check will be carried out – and 2Secure will inform you thereafter.
• Results from alcohol and drug tests in connection with pre-employment medical examinations (through occupational health services), which may include sensitive information about your health.

2.2 As part of our recruitment processes, we use occupational psychological tests provided by our supplier Assessio. The personal data processed in connection with such tests includes your name, contact details, as well as test results and behavioral indicators generated when you complete the tests. This process is carried out for the purpose of obtaining an objective, structured and quality-assured basis for assessing your competencies and suitability for the specific position. The legal basis for this process is the balancing of interests.

2.3 We use the digital reference checking service Refapp in our recruitment processes. In connection with reference checks, we process the reference person's name, telephone number, e-mail address and the personal data contained in the assessment provided by the reference person. Our legitimate interest is to obtain structured and relevant assessments of candidates in a quality-assured manner in order to evaluate their competencies and suitability for the specific position. Reference checking is a necessary part of the recruitment process, as it provides supplementary information that cannot be obtained in an equally reliable manner through other, less privacy-sensitive methods.

2.4 In certain recruitment processes, background checks are also carried out through our supplier 2Secure. These checks are only performed for positions where this is justified in accordance with Billerud's internal guidelines. The personal data processed depends on the type of check being conducted but may include, for example, identity information, information regarding which district courts have been contacted, financial information and other data required to verify the information provided by you during the recruitment process. If a background check becomes relevant, you will always be informed in advance.

2.5 In all recruitment processes, a pre-employment medical examination is carried out on the final candidate prior to employment in Sweden through our occupational health partners (Feelgood, Avonova and Falck). A pre-employment medical examination includes an alcohol and drug test, where a passed test is a prerequisite for employment. In connection with ordering the pre-employment medical examination, we provide your name, personal identification number, email and telephone number to our occupational health partner where your examination will be conducted.

2.6 Providing your personal data is necessary for us to process your application. If you do not provide the requested information, we will not be able to consider your application for employment.

2.7 In addition to the information you provide directly to us, we may obtain personal data from third parties such as: references you have provided and background check providers (where appropriate and after you have been informed in advance). Billerud may also use other external sources that you have approved or provided (e.g. LinkedIn account). Information may also be obtained from recruitment consultants who interview you.

2.8 In connection with entering into certain types of employment, we may process and share personal data such as name, position, form of employment and employment period with local trade union organisations. This is done for the purpose of fulfilling our obligations under applicable collective bargaining agreements and the Swedish Co-Determination in the Workplace Act (MBL).

3. FOR WHAT PURPOSES DO WE PROCESS YOUR PERSONAL DATA?
We use the personal data listed above for the purpose of:
• Reviewing your application for the specific position you have applied for and other positions that we consider appropriate for you (if you have given your consent to our processing), based on the information you have provided to us.
• Contact you to inform you about future job opportunities that may be of interest to you (if you have given your consent to our processing for future employment opportunities).
• Making decisions in our recruitment processes.
• Fulfilling our legal obligations and defending our company in case of any legal claims.
• Notifying local trade union organisations in accordance with applicable collective bargaining agreements and the Swedish Co-Determination in the Workplace Act, for the purpose of providing them with the opportunity to request negotiations and to conduct negotiations.

In processes where the number of applicants, number of vacant positions or other similar reasons result in a significant administrative burden for Billerud, we may use Microsoft Forms as part of our selection process. The purpose is both to streamline the administration and to ensure that the selection is carried out in a fact-based and qualified manner based on the requirements for the relevant position. A pre-filled form containing your basic personal data (such as first name, last name, e-mail address and telephone number) is automatically retrieved from our recruitment system. You will be asked to answer questions relating to your match against the requirements profile for the position applied for, such as motivation, relevant experience, notice period, salary expectations and current place of residence. Any selection process involving Microsoft Forms is always monitored by a natural person. We do not make recruitment decisions based solely on automated processing, including profiling, which would produce legal effects concerning you or similarly significantly affect you.

4. WHEN IS YOUR PERSONAL DATA ERASED?
4.1 If your application results in you becoming an employee or intern, your personal data will be transferred from the recruitment system to the HR system, and data will thereafter be erased in accordance with Billerud's general retention routines for employees. If you are not offered the specific position/internship you applied for, we will retain your data for 2 years, in case we need it in the event of a legal claim (unless you have consented to other processing).

4.2 If we wish to retain your personal data for the purpose of contacting you regarding future employment opportunities, we will request your consent to do so. In the absence of such consent, your personal data will be erased, with the exception of data that we need to retain in order to protect our legitimate interest in defending ourselves in the event of a legal dispute. If you have consented to us to contact you regarding future employment opportunities, we will retain your data for two years. Thereafter, your data will be erased.

4.3 Personal data from reference checks is stored for six months after the reference check is completed, after which the data is erased.

4.4 Sensitive data (including information from alcohol and drug tests) and information from background checks are always erased once we have assessed the outcome. Test results (e.g. from personality tests or other tests) are erased after two years provided that you have not participated in a new recruitment during that two-year period. If your application results in you becoming an employee or intern, your test results may be used during your first two years as support for us as an employer to be able to offer opportunities for career development, follow up on goals and any shortcomings, or to take disciplinary measures where necessary; in relation to employees, we carry out competence development and performance reviews.

5. WITH WHAT LEGAL BASIS DO WE PROCESS YOUR PERSONAL DATA?
5.1 Our process for recruitment is primarily based on the balancing of interests. This means that we have a legitimate interest in processing your data in connection with our recruitment (both for the position you have applied for and for other positions) and we do that in a way that does not interfere with your privacy. To a certain extent, the use of personal data is also necessary for the preparation of an employment contract.

5.2 When sensitive data is being processed (i.e. information from alcohol and drug tests), processing is necessary for the purpose of carrying out obligations and exercising specific rights in the field of employment law.

5.3 If we perform any processing of data that requires your consent, such as requesting you to provide a certain register extract, we will obtain such consent from you in connection with the specific processing activity.

5.4 When personal data is shared with local trade union organisations in accordance with applicable collective bargaining agreements and the Swedish Co-Determination in the Workplace Act, the processing is based on our legal obligation to fulfil obligations arising from collective bargaining agreements and employment legislation (Article 6(1)(c) GDPR).

6. TO WHOM DO WE DISCLOSE YOUR PERSONAL DATA?
6.1 Your personal data may be shared within Billerud for recruitment purposes and to external parties outside of Billerud (e.g. companies providing services to Billerud, such as recruitment services, etc.). As mentioned above, we use Talentsoft as our recruitment system, which serves as a candidate portal where your personal data will be processed. Accordingly, companies within the Talentsoft group and their subcontractors providing IT services may have access to candidates' personal data as part of the operation of the service. Talentsoft is a cloud service, and all subcontractors are covered by data processing agreements to ensure privacy in accordance with GDPR standards. We also share personal data with Assessio (occupational psychological tests), Refapp (digital reference checking), 2Secure (background checks) and our occupational health partners (Feelgood, Avonova and Falck) in accordance with what is described in section 2 above. We will also disclose data to authorities if we are obliged to do so by law or administrative decisions.

6.2 The companies that process the data on our behalf (e.g. parties providing services to us) are only allowed to process your data in accordance with our instructions and by way of agreement we ensure a high level of security for your personal data. Should we transfer your data to external companies outside of the EU/EEA, we ensure that appropriate security measures have been taken, such as including the EU Commission’s standard contractual clauses for data transfers (which are available at the EU Commission’s website) in our agreements with the parties processing the personal data.

6.3 In connection with new employments, we may share certain personal data, such as name, position, form of employment and employment period, with local trade union organisations. This is done to fulfil our obligations under applicable collective bargaining agreements (including General Terms of Employment and the Pappers central collective bargaining agreement) and the Swedish Co-Determination in the Workplace Act (MBL), for the purpose of providing the respective trade union organisation with the opportunity to request negotiations and to conduct negotiations.

7. DATA SECURITY
7.1 We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure or destruction within our recruitment system. We impose strict security requirements on our service providers through contractual obligations. Access to the recruitment system is controlled through individual user credentials, consisting of a personal user ID and password. Access to personal data is granted only to personnel who require such access in order to perform their duties and obligations in connection with their role within Billerud.

7.2 The security of personal data is also ensured when transferring or disclosing the data to other processors. The measures employed vary based on the sensitivity of the data and include e.g. identification of authorized recipients and encryption.

7.3 Candidate data is processed primarily electronically in the recruitment systems. If printouts are made or manual data is otherwise processed, the personnel handling the recruitment process have been instructed to handle the material carefully and ensure that the material is only disclosed to those employees within Billerud who are responsible for the recruitment and related decisions, and to destroy the material when it is no longer needed in connection with the current recruitment process or if the candidate so requests.

8. YOUR RIGHTS IN CONNECTION WITH OUR PROCESSING
8.1 Pursuant to applicable data protection legislation, you have the following rights in connection with our processing of your personal data:
• Right of access, i.e. a right to obtain information about what personal data we process about you and a copy of the personal data undergoing processing
• Right to rectification, i.e. a right to have incorrect data corrected
• Right to erasure, i.e. a right to have your personal data deleted
• Right to restriction of processing, i.e. a right to request that our processing is restricted, for example if you contest the accuracy of the personal data we are processing
• Right to data portability, i.e. a right to request that your personal data is being transferred from us to another company
• Right to object to our processing of your personal data
• Right to withdraw your consent, a withdrawal will however not affect the lawfulness of processing based on your consent before its withdrawal
• Right to lodge a complaint with a supervisory authority if you consider that our processing does not comply with the applicable data protection legislation

8.2 Some of the rights above are only applicable in certain situations. In case you would like to exercise any of your rights, please contact the DPM, preferably by sending an email to privacy@billerud.com.

9. UPDATES
9.1 We may update this privacy notice from time to time. The current version is always available on our website in the application form under Career.