Data Protection Statement – Employee Candidates

Last updated: 10 December 2025

1. Introduction 

Siili Solutions Plc and its group companies ("Siili") place the highest value on protecting the privacy of its employee candidates and are committed to processing personal data carefully and responsibly.  

This Data Protection Statement (“Statement”) explains how Siili processes your personal data in the context of recruitment processes. Personal data refers to any information related to an identified or identifiable person, a data subject. Data subjects under this Statement include Siili’s employee candidates. 

Siili is the data controller of your personal data. As the data controller, Siili is responsible for data processing and defines the purposes and means for the processing. Siili processes your personal data in accordance with all applicable laws, as well as Siili’s internal data protection and information security guidelines.  

Siili combines human expertise with the responsible use of modern, AI-assisted tools to make recruitment transparent, fair, and efficient. Tools such as Talendary and Co-pilot Meeting Insights may be used to support candidate evaluation and improve the quality and consistency of the process. We use these tools under human oversight, and all decisions are made by people.  

This Statement explains how AI-assisted tools are used, how human oversight is ensured, and how candidates’ privacy and rights are protected in accordance with the EU General Data Protection Regulation (GDPR) and the EU Artificial Intelligence Act (AI Act). 

2. Personal Data Collection Methods and Sources 

Siili primarily collects personal data directly from you. Participating in the recruitment process requires that you provide certain personal data to Siili. 

When personal data are to be collected from other sources (such as previous employers), Siili will seek your consent as required by law. 

If you provide a third party’s personal data to Siili (such as referee contact information), you must obtain consent from the third party. 

3. Personal Data Collected and Processed 

Siili may process following personal data: 

• Basic Data – First and last names, personal contact information (phone number, email address, mailing address), photos. 
• Education, Skills, and Experience Data – CV, education and degree information, professional experience, skills and competencies, certificates, interests. 
• Suitability Assessment Data – Interview notes, suitability assessment, potential internal and external referees, and their assessment of the candidate. 
• AI Scoring Data – When applicable, Siili uses an AI-assisted evaluation system (Talendary, integrated with Teamtailor) to analyze the content of applications. Talendary’s AI model evaluates candidate fit through the candidate suitability score, which reflects how well a profile matches a given role based on both structured and contextual information. The score is generated by comparing skills, experience, and career patterns against job requirements, while also considering broader contextual knowledge - for example, typical role expectations, company size, and industry benchmarks. Each score is accompanied by motivation and references indicating which parts of the candidate’s information contributed to the result and why. The model only uses job-related criteria and completely excludes gender, age, name etc. from its scoring. Only data provided by the candidate is utilized. AI Scoring Data is used by recruiters in the recruitment process in question, not for any other purposes. Scoring helps us ensure that applications are considered fairly against predefined job criteria. Siili guarantees that every AI-assisted evaluation is subject to human review, and all decisions are made by people. AI scoring is always role-specific and is not reused in later recruitment processes. 
• Meeting Insights / Summarization Data – In the context of interviews, Siili may use meeting insights / summarization features offered by Teamtailor or a Co-pilot tool to assist recruiters in summarizing interview content. This may involve transcription of spoken words (audio → text), generation of meeting summaries or highlights (key themes, candidate strengths/weaknesses), and use of these summaries to inform further recruitment decisions. Such data is processed only if you have consented to the use of the meeting insights feature, and summaries are used as supporting information only – recruiters always perform their own evaluation. Transcripts and summaries are stored in the candidate’s profile in Teamtailor in accordance with the general two-year retention period (see section 7 “Data Retention”) and may be visible in future recruitment processes involving the same candidate. This means that if you apply for another position at Siili, our recruiters may review previous interview notes and summaries before any possible new interviews take place. Each new recruitment process always includes a fresh evaluation based on the requirements of the new position. 
• Potential Employment Relationship Preparations Data – Employment contract proposal, job title and description, salary proposal, office/workplace, business unit, employment start date, other employment terms and agreed benefits. 
• Online Behavior Monitoring Data – Data collected via cookies such as the pages visited, the operating system of your computer, and browser type. 

You may also choose to provide Siili with other types of personal data beyond those described above. Siili will process all personal data in accordance with this Statement. 

4. Legal Bases and Purposes of Data Processing 

Siili processes your personal data for predefined purposes based on contract, legal obligation, consent, or Siili’s legitimate interests. Siili ensures that its interests can be considered legitimate and conducts an evaluation of the lawfulness of its interests. 

Siili processes your personal data to conduct its recruitment processes and prepare the potential employment relationship and introduction process. 

The table below provides more information on the legal bases and purposes of processing.  

Siili may use meeting insights / summarization AI feature offered by Teamtailor or a Co-pilot tool to assist recruiters in summarizing interview content only when you consent to using this feature. You may decline this feature. Refusal will not disqualify you from candidacy nor have any other negative consequences on you. All transcripts and summaries generated will be retained for the duration defined in Section 7 “Data Retention” and will be used as supporting material only – recruiters will still perform their own independent evaluation. Consent may be withdrawn at any time by contacting the recruiter or dataprotection@siili.com, and upon withdrawal all extracted summaries / transcripts will be deleted. 

Your personal data may also be processed on Siili's legitimate interest to prevent and investigate misuse and issues, as well as to comply with legal requirements. Siili may process your personal data also for defending its legal rights, carrying out a trial or authority process and the execution of an authority order. 

In addition, your personal data may be processed for reporting and analytics based on Siili’s legitimate interest. In these cases, Siili ensures that personal data is processed in such a form that you are not identifiable from the report or other result.   

If Siili collects feedback from you about the recruitment process, such feedback is provided anonymously unless otherwise informed. 

Siili may consider you for other positions that are open at the time of application or for future openings, with the purpose of collecting and maintaining a pool of candidates for potential vacancies. For this purpose, separate consent will be requested from you. 

5. Disclosures of Personal Data 

Siili may disclose your personal data to the following recipients: 

• Siili Group Companies: Personal data may be shared with companies within the Siili Group, based on Siili’s legitimate interest. These companies process personal data in accordance with this Statement or their own statement, substantially similar to this one. 

• Service Providers and Subcontractors: Personal data may be disclosed to Siili’s service providers (including AI solution providers) and subcontractors who process personal data on behalf of Siili. Through appropriate contractual arrangements, Siili ensures that personal data is processed in accordance with this Statement and applicable laws. 

• Business Partners: Personal data may be disclosed to trusted third parties, such as external advisors and auditors, based on Siili’s legitimate interest. 

• Authorities, Legal Processes, and Legislation: Siili discloses personal data to competent authorities as required by mandatory legislation. Personal data may also be disclosed in connection with legal processes or as a response to the requests by authorities based on law, court order, court proceedings, or authority process, in compliance with applicable laws. 

• Mergers and Acquisitions: In the event that Siili decides to sell, merge, or rearrange its business, such actions may include disclosing personal data to potential or actual purchasers and their advisors. If the disclosure of personal data is necessary in such a situation, Siili will share only the necessary personal data and only as permitted by applicable legislation. 

6. Data Transfers Outside of the European Economic Area 

Siili may transfer your personal data to Siili Group companies located outside of the European Economic Area (EEA) for arranging Siili Group operations. Siili may transfer personal data also to its cooperation partners, service providers and subcontractors located outside of the EEA for the purposes described in this Statement.  

When personal data is transferred outside of the EEA, Siili uses an appropriate transfer basis (such as standard contractual clauses approved by the European Commission and possible supplementary measures) to ensure an adequate level of data protection. 

7. Data Retention 

Siili retains your personal data for as long as it’s necessary for the initial or compatible purposes for which the personal data have been collected. Retention periods are determined based on mandatory legislation and common industry practices.  

In general, Siili retains your personal data for no longer than 2 years from the earlier of the following: the first recruitment process decision in which your data were processed (whether positive or negative), or the date the data were collected in case no recruitment decision is made. 

AI Scoring Data and related outputs (such as score explanations or feature weightings) are retained only as long as necessary for validation, audit, or complaint handling — typically aligned with the general candidate data retention period. After this time, the data are anonymized or permanently deleted.  

Meeting Insights Data and summaries / transcripts are stored only for as long as necessary for recruitment review or audit – by default no longer than the same retention period (2 years). After the retention period or upon consent withdrawal, these items are deleted. 

Siili may also delete personal data that are no longer needed during the recruitment process. Information that becomes unnecessary, outdated, or for which there is no longer a valid reason for processing, will be anonymized or securely destroyed. 

If you accept an offer of employment by Siili, any relevant personal data collected during recruitment process may become part of your personnel records. 

Detailed information on the retention of personal data collected with cookies is included in Siili's Cookie Statement available on Siili’s website. 

8. Data Security 

Siili applies appropriate technical and organizational measures to guard against accidental and/or unlawful access, alteration, and destruction, or other processing, including unauthorized disclosure and transfer of personal data. These measures encompass (without limitation) proper firewall arrangements, malware detection, appropriate encryption of telecommunication and messages, as well as the use of secure and monitored equipment and server rooms.  

Data security requirements are diligently observed in IT system access management and monitoring of access to IT systems. Siili personnel, processing personal data as part of their tasks, are trained and properly instructed in matters of data protection and data security. 

When processing candidate data, Siili may employ third-party service providers (e.g. recruitment platforms, AI-assisted tools). Siili only partners with providers whose information security practices are demonstrably strong and aligned with recognized standards. AI-assisted tools are subject to regular audits and internal reviews to ensure fairness, reliability, and non-discrimination. Bias and fairness are managed through continuous testing and strict controls. 

9. Automated Decision-Making and Profiling 

Siili does not make hiring or rejection decisions based solely on automated processing. While Siili uses AI-assisted tools to support candidate evaluation, every decision is made by human recruiters or hiring managers.  

AI-assisted tools used during recruitment involve profiling — meaning that personal data is analyzed automatically to evaluate certain personal aspects such as experience or skills. These tools are used only to assist human decision-making, never to replace it. 

You have the right to understand how AI-assisted tools supported your evaluation and to request clarification if you believe the assessment does not fully reflect the information you provided. All AI-assisted evaluations at Siili are subject to human oversight. 

10. Data Subject Rights 

You have the following rights according to applicable legislation:  

• Right to obtain information on the processing: You have the right to be informed of the collection and processing of their personal data. 

• Right of access to data: You have the right to receive confirmation from Siili on whether or not Siili is processing personal data that concerns you. If your data is processed, Siili must provide you with a copy of the personal data processed. 

• Right to rectification of data: You have the right to demand the rectification of inaccurate personal data concerning you and to have incomplete personal data completed. 

• Right to the erasure of data: In certain cases, you have the right to have Siili erase data concerning you without undue delay. 

• Right to restriction of processing: You can request Siili to restrict the processing of personal data concerning you. 

• Right to object to the processing: You have the right to object to the processing of your personal data on grounds relating to your particular situation when a processing is based on legitimate interests pursued by Siili. 

• Right to data portability: You have the right to receive the personal data that you have provided to Siili in a structured, commonly used, and machine-readable format and, if desired, transmit that data to another controller. 

• Right not to be subject to a decision based solely on automated processing, including profiling: You have the right not to be subject to a decision based solely on automated processing, including profiling. Siili does not make recruitment decisions based solely on automated processing. All evaluations are reviewed by human recruiters or hiring managers, and all decisions are made by people. 

• Right to understand and to obtain clarification on AI-assisted scoring: You have the right to understand how AI-assisted scoring was used to support your evaluation and to access the related score and its rationale. If you believe the score and related assessment does not fully reflect the information you provided, you can ask for additional clarification. 
• Right to file a complaint to the data protection authority: You have the right to file a complaint with the national data protection authority (in Finland, the Data Protection Ombudsman) or other data protection authority within the EEA if you have experienced that your data have not been processed lawfully. 

If Siili processes certain personal data based on your consent, you have a right to withdraw your consent at any time. 

You can exercise your rights by contacting dataprotection@siili.com. 

11. Changes 

Siili may change or amend this Statement as necessary. Substantial changes – including those related to the introduction or modification of AI-assisted processes – are announced on Siili’s website and/or data subjects are informed personally. 

12. Contact Information 

For questions regarding the processing of your personal data, please contact Siili's data protection team at dataprotection@siili.com.