This policy explains how we collect, use and protect the personal data of candidates, temporary workers, clients, suppliers and other business contacts, referees, emergency contacts and dependants, website users, staff alumni and visitors to our premises.
References to the GDPR include the EU General Data Protection Regulation (2016/679), Swedish supplementary data protection legislation and, where relevant, the UK GDPR.
The data controller is Tessero Sweden AB ("Tessero", "we", "us"), c/o No18 Sveavägen 50 111 34, Stockholm. You can contact our data protection team at sweden@tesserogroup.com or by post at the address above (marked "c/o Data Protection Team").
Where Tessero group entities jointly determine why and how personal data is processed, they act as joint controllers under Article 26 GDPR. You can exercise your rights against any of them using the contact details above.
"Candidates" covers anyone we think may be interested in or benefit from our services, as well as applicants for roles we advertise, people who send us a speculative CV, and contractors, freelancers and supplier employees put forward for client roles. It includes people who want to become temporary workers.
If you switch on marketing cookies and we can recognise you as an existing candidate or contact (for example, because you clicked a link in one of our emails), we record which pages of our website you view and link this to your record in our recruitment system, so that we can suggest relevant roles and follow up with you. We rely on your consent for this.
Candidates are allocated to "talent pools" by a fully automated process, which may involve bots. We may also use filtering, algorithms and machine learning to shortlist and rank candidates, in support of our consultants' work. These activities rely on our legitimate interests.
Where shortlisting amounts to a decision based solely on automated processing (Art. 22 GDPR), we only do this where it is necessary for pre-contractual steps you have asked us to take (e.g. filtering a large number of applicants for a popular role).
Temporary workers employed or engaged directly by us (in addition to candidate data)
Personal data: Staff number, personal identity number; workplace; leave; travel; residence and work permits; performance, bonuses and promotions; grievances and disciplinary matters; sickness absence (health data)
Purposes: Running the employment relationship: payroll and invoicing, terms of work, performance and feedback, absence management, and meeting statutory duties
Legal basis (GDPR): Contract; legal obligation; legitimate interests. Health data: where required or permitted by employment law, otherwise consent
Clients and their employees
Personal data: Name, job title and contact details; engagement with our website, emails and candidate profiles; information you give us; call recordings and video footage (with consent); ID documents where verification is required
Purposes: Providing our services (candidates, RPO, MSP, consultancy, training for your employees); managing the relationship; B2B marketing; surveys and market research; candidate references; identity verification; investigations
Legal basis (GDPR): Legitimate interests; consent (recordings, cookies, marketing where required); legal obligation
Suppliers and other business contacts (e.g. investors)
Personal data: Name, job title and contact details; business bank details; identification number; information you or others give us; ID documents and video ID footage
Purposes: Managing the relationship and payments; statutory checks; identity verification; investigations; legal claims
Legal basis (GDPR): Contract; legal obligation; legitimate interests
Referees, emergency contacts and dependants
Personal data: Name, contact details, date of birth, marital status; references; limited health data or data from which other sensitive information can be inferred, where needed for benefits
Purposes: Obtaining references; contacting you in an emergency; administering employee benefits; marketing to referees only with opt-in consent
Legal basis (GDPR): Legitimate interests; employment law obligations; consent (marketing)
Website users
Personal data: Name and contact details (if provided); IP address, device, log, usage and location data; preferences
Purposes: Providing services you sign up for (e.g. newsletters); security and fraud prevention; improving and personalising our websites
Legal basis (GDPR): Legitimate interests; contract; consent (non-essential cookies and marketing); legal obligation
Staff alumni
Personal data: Name, contact details, date of birth, gender, photograph, marital status, nationality; education and employment history
Purposes: Running our alumni network and portal; newsletters, events, vacancies and opinion polls
Legal basis (GDPR): Legitimate interests; consent (marketing)
Visitors to our premises
Personal data: Name, date of birth, ID document, vehicle registration, email, job title, purpose of visit; CCTV images; guest Wi-Fi device data; health and travel information where needed for health and safety
Purposes: Visitor management; security of our premises; guest Wi-Fi; protecting staff and visitors from infectious diseases
Legal basis (GDPR): Legitimate interests; public interest in public health (Art. 9(2)(i)) for health data
Sources. We collect data from you directly. We also collect it from your organisation; our candidates, temporary workers and staff; referees; clients; job sites and social media; RPO/MSP providers; background check, pension and benefits providers; tax authorities; medical professionals (in limited cases); market research and event delegate lists; and automatically through our websites, emails, CCTV and Wi-Fi.
Required data. Some data is required by law (e.g. a personal identity number for tax purposes) or by contract. If you do not provide it, we may be unable to work with you.
Legitimate interests. We rely on our interests in running and developing our recruitment business: matching candidates with roles, maintaining relationships, providing relevant services, keeping our premises and systems secure, and handling claims. You can object at any time (see section 7).
Consent. Where we rely on consent, you can withdraw it at any time. This does not affect processing carried out before you withdraw it.
Some providers process data as independent controllers for their own purposes (e.g. security, legal compliance or anonymised product improvement) under their own privacy policies.
When we transfer data outside the EEA, we rely on an adequacy decision, the EU Standard Contractual Clauses, another approved mechanism, necessity for a contract in your interest, or your consent.
At the end of the retention period, data is put beyond use. It is permanently deleted from archives once all statutory retention periods have expired (currently expected to be seven years).
You have the right to:
Contact sweden@tesserogroup.com. We will respond within one month and may need to verify your identity. Access is free unless a request is manifestly unfounded or excessive. You can unsubscribe from job alerts and marketing via the link in any marketing email.
You can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), Box 8114, 104 20 Stockholm, tel. +46 (0)8 657 61 00, imy@imy.se.
Our website uses cookies and similar technologies. Strictly necessary cookies are always on. Analytics and marketing cookies are set only if you switch them on, and you can reject them as easily as accept them. You can change your choice at any time through the Cookie Preferences link on every page. The Cookies section of our group privacy page, Privacy at Tessero, explains each cookie we use, what it is for, who sets it and how long it lasts. If you use several devices, you may need to set your preferences on each one.
We use appropriate technical and organisational measures to protect your data, including procedures for handling suspected data breaches. Please tell us immediately if you suspect misuse. Please also keep us informed if your personal data changes.
We are not responsible for third-party websites or services linked from ours.
We may update this policy and will publish changes on this page.