Privacy notice for Candidates

The protection of your personal data is of great importance to Getinge, and we will process your personal data in accordance with applicable data protection laws and regulations.

Getinge is a global medical technology and device group with companies in around 40 countries, meaning different data protection laws apply dependent upon which group company you interact with. Since our parent company Getinge AB (publ) with reg. no 556408-5032 is based in Sweden, the General Data Protection Regulation (“GDPR”) is the basis for our global data privacy program and this notice.

We do our best to make the content of this notice easy to understand and navigate. Despite this, we know that some words are difficult to grasp. To facilitate your understanding, we have gathered explanations of such words used in this notice in the Privacy definitions page.

If you have any questions related to this notice, please contact our data protection officers by sending an e-mail to data.protection@getinge.com.

• All personal data that you provide, in written and orally, or that we collect from others, will be used to assess whether you are suitable for the role you have applied for, or other roles within Getinge (if you have given your consent). The Getinge company that would become your employer (stated in the job advertisement) is the data controller for the recruitment process.
• Your personal data will be shared with people in Getinge involved in the recruitment process, on a need-to-know basis, and with suppliers that provide services or systems used in the recruitment.
• We will store your personal data during the recruitment process, and for a time thereafter. The time depends on whether you become an employee, and whether you have given us your consent to view your profile and consider you for other roles within Getinge.
• You have the right to contact us to (i) request access to, information of, rectification of, deletion of, transfer of (data portability), and restriction of our processing of your personal data; (ii) withdraw or change any given consent(s); and (iii) object to a certain processing activity. An easy way to exercise any of the foregoing rights, is to fill in the Data Subject Request Form. In addition, you have the right to lodge a complaint to the supervisory authority.

This privacy notice is to inform you about the processing of your personal data in connection with Getinge’s recruitment process, i.e., how we collect, use, evaluate, store, and erase your personal data. 

The Getinge company that would be your employer (stated in the job advertisement) ("Getinge" or “we”) is the data controller for the processing of your personal data related to that recruitment process. Getinge AB (parent company) is joint controller together with group companies using the career portal, for personal data related to your account and personal data uploaded in your candidate profile. If you would like to know the exact group companies, please contact us.  

Please note that this privacy notice refers to the global recruitment process, meaning another notice applies if you become employed, and that local variations may apply. The recruitment privacy notice applicable for the country where you apply for a role, is accessible to you at registration of an account or after logging in to the Getinge Career Portal.

In this section we provide information about our different processing activities including explanations of the:

• Purpose – why we use your personal data in a certain way.
• Categories of personal data – if it includes your name, contact details, role or other.
• Legal basis – if we for example have asked for your consent, if we are required to collect and store your personal data based on a legal obligation or if we based on a legitimate interest, can use your personal data for a specific purpose.
• Retention period – how long do we keep the personal data for each purpose. 

Purpose
To assess whether you are suitable for the role you have applied for. 

Personal Data
Personal data included in the CV, personal letter, other documents you provide to us, as well as information provided by you during interviews and when performing tests. This includes for example (but may include more or less dependent upon what information you provide) full name, email, home address, phone number, gender, nationality, age, photo, educational history, employment history, your qualifications, language skills, how you found out about the role, salary expectations and test results.

Legal Basis
This processing of your personal data is necessary to prepare the employment contract and based on Getinge’s legitimate interest to perform a recruitment process to fill a vacant role within Getinge.

Retention Period
Your personal data will be processed during the recruitment process and until the vacant role has been filled. Thereafter, if you succeed, only such personal data necessary for purposes related to your employment will be saved (further information is found in the employee privacy notice received during onboarding), other personal data will be deleted or anonymized. If you do not receive the role, we will delete or anonymize your personal data after a certain time after the role has been filled. 

Purpose
To assess whether you are suitable for future roles within Getinge (in your country/region of residence and/or worldwide based on your consent choice, at registration of the account or thereafter, in the Getinge Career Portal). 

Personal Data
Personal data included in the CV, personal letter, other documents you provide to us, as well as information provided by you during interviews and when performing tests. This includes for example (but may include more or less dependent upon what information you provide) full name, email, home address, phone number, gender, nationality, age, photo, educational history, employment history, your qualifications, language skills, how you found out about the role, salary expectations and test results.

Legal Basis
This processing of your personal data is based on your consent.

Retention Period
Your personal data will be accessed by us for assessing your profile for roles from the time the consent is provided until the consent has been withdrawn. If such information is stored in your profile, and you have not logged into the Getinge Career Portal for a certain time, and you do not show any interest to be available for future career opportunities after having been contacted by us, your personal data will be deleted or anonymized.

For some roles, you will be offered to perform an assessment through an assessment tool, for Getinge to use the result as a support in assessing your suitability for the role and discuss the results with you as part of the recruitment process. We have gathered information in a separate privacy notice here.

In some cases, we perform background checks. Such check is performed with assistance of a supplier. 

This processing of your personal data is based on a legal obligation, or on our legitimate interest, to make sure you have a background and profile that align with our code of conduct, that you are suitable for the role you have applied for, and to confirm and validate your history. 

If a background check is going to be performed, the Getinge company responsible for the recruitment will share your name, contact details and CV with the background check supplier. If a background check is going to be performed, we, as well as the supplier, will provide you with additional information.

At registration of your account in the Getinge Career Portal, you provide your name, country of residence, e-mail and a password. Based on our legitimate interest, the personal data is used to enabling log-in and usage of the Getinge Career Portal and must be provided to make it available to you. Country of residence is needed to, at registration as well as after registration, to provide you with the correct privacy notice and to decide appliable retention times. If you have not logged in for a certain period of time, and you do not show any interest after having been contacted by us, your account will be deleted. 

If you have given your consent to receive notifications of new career opportunities, you will receive notifications until (whichever occurs first) you withdraw your consent, or your account is deleted.

Based on a legal obligation, we need to request proof of that you are allowed to be and work in the country. Dependent on the country, this may require us to save a copy of such proof during your employment, as well as thereafter, and to share such document with relevant authorities. 

If necessary, Getinge will process personal data for the establishment, exercise and/or defense of legal claims. One example is if you do not become employed, and you initiate a discrimination process. In such case, the personal data will be kept as long as it is necessary for us to exercise and defend the legal claim. This processing, which dependent upon your claim may include all the personal data included in the recruitment process (as well as additional data), is based on Getinge’s legitimate interest to establish, exercise and defend legal claims in the field of employment.

Your personal data is mainly collected from you, through the information you upload to the Getinge Career Portal or otherwise provide to us in written or oral form. We may also collect information from other sources such as publicly available profiles (LinkedIn or similar social media platforms), from your references, and if applicable, people who have worked with you within Getinge. If we use a recruitment firm to perform part of the recruitment process, that firm will provide us with personal data concerning you. 

We have implemented appropriate technical and organizational measures to protect your personal data against loss, accidental and unlawful access and unauthorized disclosure. The number of persons with access to your personal data is limited, and only individuals within Getinge that need to process your personal data in accordance with the purposes above have access to your personal data.

Personal data shared internally within the Getinge group

• Departments authorized to process your data within the Getinge group (for example, people in Getinge involved in the recruitment process who is employed or engaged by another Getinge company than the one stated in the job advertisement).

Personal data shared externally with a processor or separate data controller

• Suppliers and providers of IT-systems, including the provider of the Getinge Career Portal, recruitment firms supporting us in the process, the provider of the communication systems used in contact with you, and with any advisor (legal, financial or tax) to assist us in matters related to your recruitment process.

The companies which we share your personal data with described above are located in the EU/EEA as well as outside the EU/EEA – also called third countries. For example, if you apply for a position in Europe, the manager may be located in the US, meaning your personal data will be shared with him/her during the recruitment process.  

Third countries legislation may differ from the rules of data protection within the EU/EEA, which means that when such transfers occur, we will either make sure the country has an adequate level of protection or enter into standard contractual clauses with the party which we share or give access to your personal data. 

Adequate level of protection

The European Commission has decided that certain countries outside the EU/EEA have a sufficiently high level of security. This means that personal data can be transferred there without any further action having to be taken regarding the transfer itself (beyond what applies under the GDPR in general). A list of which countries are included can be found here. 

If any Getinge company in the EU, shares or give access to your personal data to a Getinge company in the UK, Japan, Canada, Switzerland, New Zealand or Republic of Korea, such sharing or access is made to a country with an adequate level of protection. 

EU Standard Contractual Clauses

Since only a few countries are considered to have an adequate level of protection, the most common measure to ensure sufficient protection in the event of a transfer outside the EU/EEA is to apply the EU Commission's Standard Contractual Clauses pursuant to Commission Implementing Decision (EU) 2021/914, without any changes or amendments in conflict with the clauses. If you want to read them in their entirety, you can download them via the European Commission's website under the heading Standard contractual clauses for international transfers. 

Right to obtain a copy – If you would like more information about transfers to third countries, and a copy of the safeguard we have used, please contact us. 

An Intra-group Data Processing Agreement, including the EU Standard Contractual Clauses, has been signed between all Getinge companies worldwide.

Your personal data will be retained for as long as necessary to achieve the purposes set out in this notice, but no longer than required or permitted by applicable data protection legislation and internal Getinge policies. To receive information of the certain time retention periods applicable for a country, please see the candidate privacy notice accessible to you in the Getinge Career Portal. 

We dispose the personal data we collect in accordance with Getinge's directive and retention procedures.

You are entitled to exercise certain rights when we process your personal data. Below we list each of these rights and provide a short explanation of what they mean. 

• Access – right to request and receive information.  
• Rectification – right to request correction of incorrect or incomplete data.  
• Erasure (right to be forgotten) – right to request deletion of personal data.
• Data Portability – right to request transfer of your personal data.
• Object – right to object to certain processing, such as direct marketing and when our legal basis is legitimate interest.  
• Restriction – right to request restriction of how we use certain personal data.
• Withdraw consent – right to request us to cease processing based on your consent.
• Lodge a complaint – right to submit a complaint to a data protection authority.

More detailed information regarding the above rights is found on the page called Your Rights.

If you already know that you would like to exercise any of the above rights, please fill in our Data Subject Request Form. Please note that Getinge will assess on a case-by-case basis whether a request to exercise your rights is valid, since the rights are not absolute, and exceptions may apply.

If any changes are made concerning the processing of your personal data, we will inform you of such changes by publishing an updated version of this privacy notice in the Getinge Privacy Center.