This is the privacy notice of YES-EU Ltd in accordance with the EU General Data Protection Regulation (EU) 2016/679 regarding the processing of personal data.
This notice describes how YES-EU Ltd processes personal data of job applicants (“data subjects”) in connection with the recruitment process.
YES-EU Ltd operates in the import, sales, installation, and maintenance of electric buses, commercial vehicles, and related electrification equipment.
Prepared: 10 May 2023. Last updated: 25 June 2026.
1. Controller
YES-EU Oy
Address: Perintötie 8 C, 01510 Vantaa
Business ID: FI31985228
2. Contact details for data protection matters
Contact: Tietosuoja@YES-EU.com
3. Purpose of processing and legal basis
Personal data is processed for the purpose of carrying out the recruitment process, including:
– receiving and processing applications
– assessing the suitability of applicants
– communicating with applicants during the recruitment process
– making recruitment decisions
In addition, data may be processed for potential future recruitment processes if the applicant has given their consent.
The legal basis for processing is:
– the legitimate interest of the controller (Art. 6(1)(f)) for carrying out recruitment
– the consent of the applicant (Art. 6(1)(a)) where data is retained for future recruitment purposes
4. Legitimate interest of the controller
The controller has a legitimate interest in processing personal data in order to carry out recruitment and select suitable employees.
Processing is limited to recruitment-related data and is restricted in scope. Special categories of personal data are not processed unless provided by the applicant.
In the overall assessment, the legitimate interest of the controller does not override the rights and freedoms of the data subject.
5. Categories of personal data
The personal data processed may include:
– name and contact details (phone number, email address)
– application, curriculum vitae (CV), and other information provided by the applicant
– education and employment history
– information on skills and qualifications
– reference information
– notes and assessments made during the recruitment process
6. Sources of personal data
Personal data is primarily obtained directly from the applicant, for example via:
– application forms
– email
– recruitment systems
– interviews
Reference information may be obtained from persons named by the applicant.
7. Disclosure and transfer of data
Personal data is not regularly disclosed to external parties.
Data may be processed by the controller’s service providers (e.g. recruitment systems), with whom appropriate data processing agreements have been concluded.
As a rule, data is not transferred outside the EU/EEA. Any transfers are carried out in accordance with applicable legislation.
8. Principles of data protection
Personal data is processed with due care, and data processed via information systems is adequately protected.
When personal data is stored on internet servers, appropriate physical and digital security measures are implemented.
The controller ensures that stored data and access rights are handled confidentially and only by employees whose duties require it.
9. Retention periods
Personal data is stored only as long as necessary for the purpose of processing.
Contract-related data is generally retained for 6 years after the end of the contractual relationship due to accounting requirements.
Stakeholder and partner contact details are retained as long as the relationship is active or the data is necessary, with necessity reviewed every two years.
Data used for direct marketing is retained for a maximum of two years from the last active contact or consent.
Data collected via website cookies is generally processed only for the duration of the session.
10. Data subject rights
You have the following rights regarding the processing of your personal data:
– Right of access
– Right to rectification
– Right to erasure
– Right to restriction of processing
– Right to object to processing
– Right to withdraw consent
– Right to data portability
Requests should be submitted in writing to the e-mail address mentioned in section 2. We will respond to requests within one month in principle. Additional information may be requested to verify identity.
Data subjects also have the right to lodge a complaint with the supervisory authority if they believe their rights have been violated. The contact details of the Data Protection Ombudsman can be found here: Contact information | Data Protection Ombudsman’s Office