Privacy Policy

1. General

This privacy policy explains how Poption AS collects and processes personal data on users to the Poption recruitment platform (“Poption”). Poption AS is data controller for your use of Poption and may be contacted at legal@poption.com.

Note that other companies may act as controller of the personal data relating to you, as such personal data may be disclosed when you interact with participating companies on Poption. Disclosure of personal data to such participating companies is further described in section 7 below.

Nothing within this privacy policy is intended to limit your statutory data privacy rights as a data subject.

2. Legal basis for our processing of personal data

By registering for the Poption recruitment platform you explicitly agree to the Terms of Use (www.poption.com/legal/terms). Poption AS will process personal data relating to you as a data subject as described in this privacy policy, solely as necessary to perform its rights and obligations under the Terms of Use to provide you with full functionality of Poption. The legal basis for processing is GDPR art. 6 (1) b).

Poption AS does not intend to process special categories of personal data, such as data on racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation.

Poption AS will only process such special categories of personal data as specified above at your request, i.e., when you submit such data to us through your use of Poption. By submitting such special categories of personal data you are deemed to have provided us with your informed, expressly and freely given consent to process such data per GDPR art. 9 (2) a).

3. How and which personal data is collected through your use of Poption

Poption AS may collect your personal data:

1. during your registration of a profile in Poption,
2. when you use Poption to submit information by filling out forms, subscribe to notifications, modify your user profile, and interact with companies.
3. by monitoring your use of the service, through, e.g., web analytics tools.

We may also collect your personal data through your use of supported third-party services. Use of these third-party services is governed by the third-party’s terms and data processing provisions. By logging in to these third-party services from Poption and explicitly requesting that the applicable personal data be submitted to Poption, you are deemed to have accepted that such processing of personal data is necessary for Poption AS to provide you with the full functionality of Poption.

Poption currently supports the following third-party services:

• Vitnemålsportalen, provided by Feide pursuant to the following data privacy provisions: https://www.feide.no/personvern-og-samtykke
• Ladok, provided by Ladokkonsortiet: https://ladok.se/
• Linkedin, pursuant to the following data privacy provisions: https://www.linkedin.com/legal/privacy-policy
• Facebook, pursuant to the following data privacy provisions: https://www.facebook.com/policy
• Google, incl. Google Analytics, pursuant to the following data privacy provisions: https://policies.google.com/privacy
• Office 365, provided by Microsoft pursuant to the following data privacy provisions: https://privacy.microsoft.com/en-us/privacystatement
• Intercom, pursuant to the following data privacy provisions: https://www.intercom.com/legal/privacy
• Heap, pursuant to the following data privacy provisions: https://heap.io/privacy
• Hotjar, pursuant to the following data privacy provisions: https://www.hotjar.com/legal/policies/privacy/
• CV Partner, pursuant to the following data privacy provisions: https://www.cvpartner.com/legal/privacy-and-gdpr
• SendGrid, provided by Twilio pursuant to the following data privacy provisions: https://www.twilio.com/legal/privacy
• LinkMobility, pursuant to the following data privacy provisions: https://linkmobility.com/privacy/

By registering for and using Poption, Poption AS may process the following categories of personal data:

• Name,
• Telephone number,
• Email address,
• City of residence,
• Birthdate,
• Personal ID number (sent from Vitnemålsportalen – used to extract gender, after that deleted)
• Gender,
• Picture,
• University affiliation,
• Applications,
• Academic results,
• Work experience,
• Work preferences,
• Extracurriculars,
• Hobbies,
• Projects,
• Behavioral information relating to your use of Poption,
• IP addresses
• Files submitted by the candidate

4. Purpose of the processing of personal data

Poption AS will process information as mentioned above for:

1. providing the Poption service;
2. improving or otherwise modifying the Poption service;
3. performing our statutory obligations towards you as a data subject.

5. Retention period

Poption AS retains personal data for no longer than one month after you have explicitly requested to have your Poption profile deleted. You may delete your Poption profile here: https://www.poption.com/user or by submitting a request to legal@poption.com. Personal data will be deleted or anonymized at the end of the retention period, unless statutory obligations prevent such deletion.

6. Where personal data is processed

Poption AS utilizes processors established in countries outside the EEA (“third country”). Any transfer of personal data to a third country is subjected to appropriate safeguards, such as a legally binding and enforceable instrument between public authorities or bodies (e.g., the EU-US Privacy Shield Framework), or standard data protection clauses adopted by the EU Commission.

Poption AS utilizes processors in the US which are certified under the EU-US Privacy Shield Framework. A copy of such safeguards may be obtained here https://www.privacyshield.gov/Privacy-Shield-Principles-Full-Text.

7. Disclosure of personal data

Notwithstanding the above, Poption will not disclose your personal data to any third party except when, to the extent, and to persons

1. we have obtained your freely given, specific, informed and unambiguous consent,
2. necessary to allow you to submit job applications and/or otherwise interact with participating companies operating on Poption, as described below,
3. required by law, or
4. necessary to perform Poption AS’s statutory obligations or to exercise its legal rights, or defend against claims or other procedures.

Regarding section ii), Poption AS will disclose personal data to participating companies solely upon your request. Participating companies are companies which use Poption for recruitment purposes and have concluded an agreement with Poption AS for access to Poption.

Upon creating a candidate profile, submitting a job application and/or otherwise interacting with participating companies on Poption, you are deemed to have requested such disclosure as a necessary processing of personal data for Poption AS to provide you with the full functionality of Poption according to the Terms of Use. The participating company will, upon your request, gain access to the disclosed personal data and act as a controller for that personal data for the participating company to perform its recruitment activities.

Poption AS ensures that it has implemented and will continue to employ appropriate measures to ensure that personal data are processed securely and in compliance with applicable law.

8. Your rights as a data subject

The right of access and right to rectification or erasure of personal data

Upon your request, Poption AS will grant you access to all personal data that Poption AS maintains about you unless such personal data is otherwise available to you or Poption AS is legally prohibited from disclosing such personal data.

If any personal data prove to be incorrect or misleading, you are entitled to request the data rectified or restricted. As a registered user, you can access, correct and erase your personal data through Poption.

Rights in connection with disclosure

In all cases where Poption is allowed to disclose personal data to third parties, it will ensure that the person to whom disclosure is made grants you the same rights as those set forth herein with respect to the processing of such Personal Data. This includes the right to access the personal data and the right to correct or have corrected incorrect or misleading personal data.

Right to data portability

You have the right to receive the personal data concerning you, which you have provided to Poption AS, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from Poption AS.

Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a supervisory authority if you consider that the processing of personal data relating to you infringes your rights.

Contact information

Please submit any request regarding the above data subject rights to legal@poption.com.

9. Change of policy

Poption AS may amend or repeal this privacy policy at any time by posting a revised privacy policy or a new policy document in its place. If such revised or new policy includes a significant change to the way that personal data may be processed, Poption AS will notify registered users of the fact that its privacy policy has changed by sending users an email to the address associated with their user account, and by posting a prominent notice on Poption.