Privacy Notice for Job Applicants and Candidates Last updated: [2.9.2026] This privacy notice explains how BIT ODD Oy (“BIT ODD”, “we” or “us”) collects and processes personal data about people who apply for jobs with us or whom we contact regarding potential employment opportunities. This notice applies to personal data processed in connection with recruitment at BIT ODD. 1. Data Controller
The data controller is: BIT ODD Oy Business ID: 3093224-7 Address: Ludviginkatu 3-5, 00130 Helsinki, Finland For questions about recruitment or the processing of your personal data, please contact: careers@bit-odd.com
2. What Personal Data We Process
We process personal data that is necessary and relevant for managing our recruitment activities and assessing candidates for employment. Depending on the recruitment process, this may include:
your name and contact details;
information contained in your CV, cover letter, application form and other documents you provide;
education, qualifications, skills and employment history;
professional profiles or portfolios you provide, such as LinkedIn, GitHub or a personal portfolio;
communications between you and BIT ODD regarding recruitment;
notes and information generated by recruiters and interviewers during the recruitment process;
salary expectations, work permit status, availability and other information relevant to potential employment;
references and information provided by referees, where applicable;
information and results relating to recruitment assignments or assessments, where applicable. Such assessments may include profiling and scoring relating to, for example, personality traits, analytical skills and other characteristics relevant to the role applied for;
information provided by recruitment agencies or other recruitment service providers, including, where applicable, assessment results; and
other information necessary for evaluating your suitability for a position or preparing an employment offer.
We only process personal data that is necessary for recruitment and employment-related purposes (please see Section 4 below). Please do not provide special categories of personal data, such as information concerning your health, racial or ethnic origin, political opinions, religious beliefs, trade union membership or sexual orientation, unless such information is specifically requested and its processing is permitted by applicable law. 3. Where We Obtain Your Personal Data
We primarily collect personal data directly from you, for example when you submit an application, communicate with us or participate in interviews. BIT ODD may identify and contact potential candidates through recruitment agencies, professional networks and publicly available professional information. During the recruitment process, we may also receive information relating to you from recruitment agencies, referees or other sources, including, for example, your online professional profiles and portfolios, where you have consented to such processing or where this is otherwise permitted under applicable law. Candidates whom BIT ODD has proactively identified and added to our recruitment process without initial consent are subject to a short initial retention period as described in Section 8 below.
4. Why We Process Your Personal Data
We process candidate personal data in order to:
receive and manage job applications;
identify potential candidates for open positions;
communicate with candidates;
arrange and conduct interviews and recruitment assessments;
evaluate candidates' qualifications, skills and suitability for a position;
make recruitment decisions;
prepare employment offers and take steps necessary to enter into an employment relationship;
administer and improve our recruitment processes;
maintain appropriate records of recruitment activities;
comply with legal obligations; and
establish, exercise or defend legal claims where necessary.
With your consent, we may also retain your information after a recruitment process has ended in order to contact you about suitable future employment opportunities at BIT ODD.
5. Legal Basis for Processing
BIT ODD processes your personal data on one or more of the following legal bases: Recruitment and pre-contractual steps. We process information necessary to evaluate your application and take steps at your request prior to potentially entering into an employment contract. Legitimate interests. We may process personal data where necessary for our legitimate interests in managing recruitment, communicating with candidates, administering our recruitment activities, improving our recruitment processes and establishing or defending legal claims, provided that these interests are not overridden by your rights and interests. Consent. We rely on your consent where required by applicable law or where we ask to retain your information for future employment opportunities after the recruitment process has ended. You may withdraw your consent at any time by contacting us (please see our contact details in Section 1 above). Legal obligations. We process personal data where necessary to comply with obligations imposed on us by applicable law. These obligations may relate, for example, to the preparation of the employment agreement. Finnish legislation concerning privacy in working life imposes additional requirements on the collection and processing of job applicant data, which we follow in our recruitment activities.
6. Who Has Access to Your Personal Data
Access to candidate information within BIT ODD is limited to people who need the information for our recruitment purposes, such as members of our recruitment team, relevant hiring managers and employees participating in interviews or recruitment decisions. We may also share or make personal data available to:
service providers that operate systems used in our recruitment process;
recruitment agencies, assessment providers and other recruitment partners;
IT, hosting and other service providers supporting our recruitment activities;
professional advisers where necessary; and
public authorities, courts or other parties where disclosure is required by law or necessary to establish, exercise or defend our legal rights.
Where service providers process personal data on our behalf, they are required to process it in accordance with our instructions and applicable data protection requirements. We have also entered into the necessary data processing agreements with our service providers. We do not sell candidate personal data. 7. International Data Transfers
We primarily process and store recruitment data within the European Economic Area (EEA). Some of our service providers may directly or indirectly through their sub-processors process or have access to personal data from countries outside the EEA, including Israel, the United Kingdom, the United States, Canada and Australia.
Where personal data is transferred outside the EEA, we ensure that the transfer is made in accordance with applicable data protection law, for example on the basis of an adequacy decision by the European Commission or appropriate safeguards such as the European Commission's Standard Contractual Clauses.
8. How Long We Keep Your Personal Data
We retain candidate personal data only for as long as necessary for the purposes described in this notice.
The following retention periods apply to our recruitment system:
Candidates added without initial consent — 45 days
Where BIT ODD identifies a potential candidate and adds limited candidate information to our recruitment system before the candidate has provided the required initial consent, the information may be retained for a maximum of 45 days.
We will contact the candidate within one month of adding their personal data to our recruitment system. The purpose of this contact is to establish whether the candidate wishes to participate in the recruitment process and, where required, to obtain their consent.If the necessary consent is not provided within this period, the candidate's personal data will be deleted from our recruitment system.
Applications after recruitment ends — 2 years
When a candidate is rejected, withdraws their application, or the relevant job opening is closed, the application and related recruitment information may be retained for 2 years.
We retain this information for purposes such as maintaining appropriate recruitment records and, where necessary, establishing, exercising or defending legal claims.
This retention does not mean that the candidate has been added to our talent pool or that we will use the information to contact the candidate about unrelated future positions.
After the retention period expires, the personal data will be deleted unless another lawful basis requires or permits us to retain specific information.
Future opportunities — 24 months with consent
After an application has been withdrawn or the relevant job opening has been closed, we may ask whether you would like BIT ODD to retain your information and consider you for future employment opportunities.
If you provide this extended consent, we may retain your candidate information for 24 months for this purpose.
Providing this consent is entirely voluntary and has no effect on the recruitment process for which you originally provided your information.
You may withdraw your extended consent at any time. If you withdraw it, we will stop processing your information for future recruitment opportunities and delete the information in accordance with applicable requirements, unless we have another lawful reason to retain specific information.
When applicable retention periods expire, personal data is deleted or anonymised. We may retain information that can no longer identify you for statistical and recruitment analytics purposes.
If your application results in employment with BIT ODD, information necessary for the employment relationship may be transferred to our employee records and retained in accordance with the retention requirements applicable to those records.
9. Profiling and Automated Decision-Making
Where we ask you to take part in a personality or aptitude assessment as part of the recruitment process, we will do so only with your consent and in accordance with applicable law. Such assessments may include profiling and scoring relating to, for example, personality traits and analytical skills and may, together with other elements of the recruitment process, affect the outcome of the recruitment process. We ensure that reliable assessment methods are used, that assessments are carried out by competent assessors and that the results are accurate. If your recruitment process includes such an assessment, we will provide you with a written statement of the assessment results. If the statement has been provided to us orally, we will provide you with an explanation of its contents. You will also have an opportunity to comment on the results. We do not make recruitment decisions that have legal or similarly significant effects on candidates solely through automated processing without meaningful human involvement. We may use software tools to support the administration of recruitment, but recruitment decisions are made with human involvement.
10. Your Data Protection Rights
Subject to the conditions and limitations provided by applicable law, you have the right to:
request access to the personal data we process about you;
request correction of inaccurate or incomplete personal data;
request deletion of your personal data;
request restriction of processing;
object to processing based on our legitimate interests;
receive certain personal data you have provided to us in a structured, commonly used and machine-readable format where the right to data portability applies; and
withdraw your consent at any time where processing is based on consent.
Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. To exercise your rights, please contact us at careers@bit-odd.com We may need to verify your identity before responding to a request. If you are not satisfied with our processing of your personal data, you also have the right to lodge a complaint with a data protection supervisory authority. In Finland, the competent supervisory authority is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto).
11. Changes to This Privacy Notice
We may update this privacy notice when our recruitment practices, systems or applicable legal requirements change.
The latest version will be made available on our website and/or recruitment portal. The date of the latest update is shown at the beginning of this notice.