Arlens — Privacy Notice for Job Applicants

This is a public document shown to people who apply for a job at Arlens. It explains how Arlens handles your personal data when you apply for a role and take part in our assessment and interview process.

Effective date: 11.2.2026

1. Introduction

At Arlens, we respect your privacy and are committed to protecting your personal data in accordance with the EU General Data Protection Regulation (GDPR) and Finnish data protection law. This notice explains how we collect, use, store, and protect the personal data you provide when you apply for a role with us or take part in our assessment and interview process.

2. Who we are (Data Controller)

Arlens Oy is the controller of your personal data.

• Address: Kavilannummentie 100, 24130 Salo, Finland
• Business ID: FI32416596
• Privacy contact: Casper Lönnqvist — cl@arlens.fi

3. Data we collect

When you apply or take part in our process, we collect:

• Full name, email address, and phone number
• The role you applied for and the source of your application (for example, LinkedIn)
• Your CV or résumé and any links you choose to provide (portfolio, LinkedIn, GitHub)
• Your written answers to application and assessment questions
• Your responses to our personality or aptitude assessment, including timing information — such as how long you spend on each question and when you open it — which we use as part of evaluating your answers
• Your work test submission — the work and any files you send us for the role's work test
• Assessment and interview results, scores, and our interviewers' notes
• Interview recordings, where you have consented (see Section 6)
• Contact details of any references you provide, and our notes from reference calls
• If you are hired, your signed employment contract and NDA
• A record of your consent choices and the timestamps of each step

4. Purpose of processing

We process your data only to:

• Assess your suitability for the role you applied for
• Run and coordinate the recruitment process (scheduling and communication)
• Communicate with you about your application and its status
• Prevent duplicate or fraudulent applications
• Improve our recruitment process

5. Legal basis

We rely on your consent (given when you submit your application and, separately, for interview recordings), on our legitimate interest in running a fair and effective recruitment process, and on taking steps at your request before entering an employment contract (GDPR Article 6(1)(a), (b) and (f)).

6. Interview recordings

Some interviews (phone screen, main interview, reference calls) may be recorded via Loom so the hiring team can review them for quality and to reduce bias. Recording is optional and based on your explicit consent, which you give as a separate Yes/No choice — you can take part fully without being recorded, and you can withdraw consent at any time by emailing cl@arlens.fi. Loom Inc. is based in the United States; this transfer is protected by EU Standard Contractual Clauses (see Section 8). Recordings are deleted as part of the retention schedule in Section 9.

7. Who has access, and our service providers

Access to your data is limited strictly to the Arlens personnel involved in your recruitment. We do not sell your data or share it for marketing. We use a small number of trusted service providers ("processors") who handle data only on our instructions:

• Google Workspace — stores application data, files, and scheduling, with data at rest in the EU
• Vercel — hosts our careers site, served from an EU region
• Loom — stores interview recordings where you consented (United States)

8. International transfers

Your data is primarily stored in the EU/EEA. Where a provider processes data outside the EEA (for example, Loom in the United States), that transfer is protected by EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

9. Data storage, protection, and retention

We protect your data with industry-standard technical and organizational measures and least-privilege access. We retain your personal data for up to 12 months after your application is closed or the role is filled, after which it is securely deleted or anonymized, unless a longer period is required by law or to establish, exercise, or defend a legal claim. The exact period is set per role and never exceeds this maximum without your separate consent. When your data is deleted or anonymized, residual copies may remain for a short period — generally up to 30 days — in our service providers’ backups and trash before they are permanently erased.

10. Your rights

Under the GDPR you have the right to: access your data; request correction of inaccurate data; request deletion; restrict or object to processing; data portability; and withdraw consent at any time (this does not affect processing carried out before withdrawal). You also have the right to lodge a complaint with the Finnish Data Protection Ombudsman (Tietosuojavaltuutetun toimisto, tietosuoja.fi). To exercise any right, contact cl@arlens.fi.

11. Assessments and reference checks

If you complete a personality or aptitude assessment, you are entitled to the result on request. We only carry out reference checks with your consent, and we collect information primarily from you, in line with the Finnish Act on the Protection of Privacy in Working Life.

12. Automated decision-making

We do not make decisions about you by solely automated means. Assessment scores support our review, but every decision is made by a human recruiter.

13. Changes to this notice

We may update this notice from time to time. Significant changes will be communicated to you or posted on our careers site.