LUMENE GROUP RECRUITMENT PRIVACY POLICY
Last updated: 3rd of June 2026
This Recruitment Privacy Policy ("Privacy Policy") is prepared by Lumene Group (collectively “we”, “us” or “our”).
This Privacy Policy describes why and how we process personal data of job candidates in connection with recruitment and what rights the job candidates have.
1. CONTROLLERS AND CONTACT INFORMATION
Lumene Oy administers the recruitment process and systems on behalf of all group companies. Where a recruitment concerns a position within Cutrin Oy or Lumene Group Sweden AB, Lumene Oy and the relevant group company may act as joint controllers. The hiring decision is made by the group company within whose organisation the position is located.
Lumene Oy
Business ID 2377940-8
PL 27
02781 Espoo, Finland
Lumene Group Sweden AB
Business ID 559228-0191
Gamla Brogatan 9
111 20 Stockholm, Sweden
Cutrin Oy
Business ID 2443709-8
PL 27
02781 Espoo, Finland
Lumene Oy acts as the primary point of contact. Requests may be submitted to the contact details below regardless of which group company the recruitment concerns.
You can contact us:
Lumene Oy
PL 27
02781 Espoo, Finland
HR@lumene.com
2. PURPOSES AND LEGAL BASIS FOR PROCESSING PERSONAL DATA
2.1 Recruitment and resourcing purposes
We process your personal data for recruitment purposes to the extent the processing is necessary in order to take steps at your request prior to entering into an employment contract between you and us, including:
- evaluation and assessment of the qualifications and skills of the job candidates;
- managing the recruitment process, such as setting up and conducting interviews;
- providing information to, giving feedback to, and communicating with the job candidates;
- conducting aptitude tests as required for the role in question and as permitted by applicable laws;
- verification of provided information, such as references; and
- fulfilling legal and regulatory obligations.
Processing is based on actions necessary prior to entering into an employment contract and, where applicable, on compliance with legal obligations.
We may use external recruitment agencies to carry out personality or aptitude assessments in the recruitment process. The applicable laws may require us to obtain the job candidate's consent for the performance of such assessments.
For certain positions requiring precision, reliability, independent judgement or quick reaction, where the performance of related tasks could lead to damage or safety risks, we may request a drug test certificate from the selected candidate, where permitted by applicable law.
2.2 Future recruitment purposes
If you wish us to do so, we may save your personal data for purposes of future recruitment processes. In such case the processing is based on your consent, and we will retain the personal data after the end of the recruitment process for future recruitments and open positions within the group company to which you originally applied, or across Lumene Group as a whole, according to your preference.
You have the right to withdraw your consent at any time. The withdrawal of consent will not affect the lawfulness of the processing carried out before the withdrawal.
2.3 Development of recruitment practices and other legitimate business interests
We may also process your personal data for a limited number of legitimate business interests, such as development of our recruitment practices, analyzing and compiling statistics for business purposes, preventing and investigating suspected malpractices, or defending against a legal claim related to a recruitment process. In these cases, the processing is based on our legitimate interest.
3. COLLECTION OF PERSONAL DATA
We collect and process the following categories of personal data in connection with recruitment:
- identification and contact details, such as your name, email address and phone number;
- application documents and information on your qualifications, education and work experience, such as your CV, cover letter and other attachments;
- information accumulated during the recruitment process, such as notes made by interviewers and communications between you and us;
- results of personality or aptitude assessments carried out as part of the recruitment process;
- contact details of references you have provided, such as name, title, employer and contact details, in order to verify information relevant to the recruitment;
- to the extent permitted by applicable law, a drug test certificate or data included in it in order to establish your performance and working capacity or your personal credit information in order to establish your reliability; and
- any other information you choose to voluntarily provide to us during the recruitment process.
4. SOURCES OF PERSONAL DATA
We mainly collect personal data directly from the job candidates, such as through the application and interview process. However, we may only collect personal data from sources other than you with your consent. With your consent, we may collect personal data from the following sources:
- references from former employers, when named in the application or CV; and
- personal information related to aptitude tests or professional competence and qualification as part of recruitment process carried out by external recruitment agency; and
- publicly available professional profiles, such as LinkedIn, where you have voluntarily provided us with a link or reference to such profile.
5. SHARING OF PERSONAL DATA
We have restricted access to the job candidates' personal data to those of our employees who participate in the recruitment process and to third parties as described below. Personal data may also be shared between Lumene Group companies where necessary for the purposes described in this Privacy Policy.
We may use third-party service providers to assist us in carrying out the recruitment process. Where we engage third-party service providers to process personal data on our behalf, we ensure that appropriate contractual agreements are in place and each service provider processes personal data only to the extent necessary for the provision of the service.
We use Teamtailor, a third-party recruitment platform, to manage job applications, recruitment processes and candidate communications. Teamtailor processes personal data on our behalf as a data processor.
In addition, we may transfer or disclose personal data to third parties in the following situations:
- when requested by you (for example, if you wish us to save your personal data for future recruitment purposes for other Lumene Group companies also, we will share your personal data to other Lumene Group companies);
- when permitted or required by applicable law;
- to our trusted service providers, such as recruitment agencies for the purposes listed above and IT service providers for the purposes of IT system maintenance and technical support; and
- in the event the controller is involved in a merger, acquisition, or sale of all or a portion of its assets.
6. INTERNATIONAL DATA TRANSFERS
Personal data is mainly processed within the EU or the European Economic Area (EEA), however, the Lumene group has operations also outside the EU or the EEA area. In addition, some of our service providers to whom we transfer personal data are located or may store personal data outside the EU or the EEA, and therefore, the extent necessary, personal data may be transferred to countries outside the EU or the EEA. In all cases of international transfers of personal data, we will ensure the adequate level of data protection. Information on transfers of personal data outside the EU or EEA area and on the appropriate safeguards applied thereto from time to time is available from the contact person mentioned in the beginning of this Privacy Policy.
7. USE OF AI IN RECRUITMENT
We use AI-assisted tools in our recruitment process to support our recruiters and hiring managers. These tools may be used to summarize applications, CVs and interview notes, and to match candidate competencies against job requirements. These tools are intended to enhance the efficiency of our recruitment process. No recruitment decisions are made solely by automated means, and all decisions with significant effects on candidates involve meaningful human oversight and are ultimately made by our personnel.
8. RETENTION OF PERSONAL INFORMATION
We will retain personal data only for as long as it is necessary in order to carry out the purposes defined in this Privacy Policy.
Personal data related to non-selected candidates will be retained for a maximum of 12 months after the conclusion of the recruitment process, unless we are required to retain it for a longer period by applicable law or for the establishment, exercise or defence of legal claims. Personal data related to selected candidates will be retained in accordance with the retention periods defined in our internal privacy notice for employees.
If you wish us to keep you in mind for future career opportunities, we will retain your personal data for future recruitment purposes even after the retention period stated above. In such case, we will retain and process your personal data for the said purpose during the period of validity of your consent, but no more than one (1) year at a time.
9. YOUR RIGHTS
Job candidates have the following rights:
- Right of access: You have the right to obtain from us confirmation as to whether personal data related to you is processed, and, where that is the case, to access such personal data as well as certain information about our processing of it and your rights in relation to it.
- Right to rectification: You have the right to obtain from us rectification of any inaccurate personal data we hold about you.
- Right to erasure: In certain circumstances, you have the right to obtain erasure of the personal data we hold about you. Please note, however, that certain data is strictly necessary in order for us to fulfil the purposes defined in this Privacy Policy. A request to delete personal data during an ongoing recruitment process may therefore result in the suspension of the recruitment process for your part.
- Right to object: You have the right to object to processing that is based on our legitimate interests. If you object, we will stop processing your personal data unless certain exceptions apply.
- Right to restriction of processing: In certain circumstances, you have the right to obtain restriction of our processing of your personal data.
- Right to data portability: Where the legal basis for processing your personal data is your consent or a contract between you and us, and we process your data by automated means, you may have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format and to transmit it to another controller.
- Withdrawal of consent: Where the processing of personal data is based on your consent, you have the right to withdraw your consent at any time. The withdrawal will not affect the lawfulness of the processing carried out before the withdrawal.
To exercise any of the above rights, please contact us using the contact details provided in section 1 of this Privacy Policy.
If you consider that our processing of your personal data infringes applicable data protection laws, you have the right to lodge a complaint with the supervisory authority in the country of your habitual residence, your place of work or the place of the alleged infringement. The relevant supervisory authorities include:
- Finland: Office of the Data Protection Ombudsman
- Sweden: Swedish Authority for Privacy Protection, IMY
- United Kingdom: Information Commissioner's Office, ICO
- Other EU member states: the competent national supervisory authority in your country of residence or place of work.