Data Controller

The entity controlling the applicant data contained in the Supercell Applicant database is:

Supercell Oy (business ID 2336509-6)

Jätkäsaarenlaituri 1, FI-00180 Helsinki

Person responsible for Applicant Data

The person responsible for the processing of applicant data is Malla Saarinen, malla.saarinen@supercell.com

Collected Data

· Identity data including full name, address, email, phone number, links to website profiles and other contact details

· Material submitted by the applicant, such as educational information, application letter, work history, references, position applied for, salary requests;

· Skills and competencies data such as certificates and ratings, qualifications and skills, test or evaluation results conducted during the recruitment process.

· Other information that the candidate has provided of themselves in connection with the application process, such as a picture, language skills, other special skills, description of personal features and other possible information that the candidates themselves have provided voluntarily in connection with the recruitment process or information that the controller has collected based on a separate consent of the data subject.

· Information regarding the recruitment process of the candidate such as information of upcoming further interviews or of the interruption of the recruitment process.

· Gender identity that the data subject themselves have provided voluntarily when applying through our website, as part of gathering statistical information to improve diversity outreach projects.

· Other data relating to the applying process, such as assessment results, amount of applications sent, and source of application.

We only collect and store information that is either relevant for the ongoing recruitment process or necessary for your or our rights and obligations in the context of establishing an employment relationship.

We may also engage in candidate sourcing and headhunting in order to fill certain positions or receive references from Supercell employees about a potential candidate for a job position at Supercell. In this context we may collect and process personal data available from public sources, such as the information available on potential candidate’s LinkedIn profile or similar profile. We may also receive contact information about the potential candidate directly from the Supercell employee making the referral.

We might use third party platforms such as LinkedIn or Stackoverflow to find potential candidates, and get in touch through these platforms. If a potential candidate is interested in continuing with the hiring process, Supercell will ask for permission to add the potential candidate into Supercell’s internal recruitment system. In case the potential candidate declines Supercell’s outreach and offer to keep in touch in case other relevant positions open, then Supercell will not add the person’s contact details to the recruitment tool.

Purpose of Use and Legal Grounds of Processing

The applicant data is used for handling the relationship between the applicant and Supercell, including candidate sourcing, recruitment processes, candidate evaluation and communication and making a decision on recruitment. The purpose of the processing of personal data is actions related to the recruitment process and management of the recruitment process and enabling contacts regarding application and selection processes from persons (data subjects) who have applied for the positions.

The data may also be used to analyse and develop Supercell’s activities based on Supercell’s legitimate interests, in which case we weigh our own interests against your right to privacy. When engaging in headhunting we also process personal data based on our legitimate interests. We store personal data under this privacy policy for a certain period based on our legitimate interest for the purpose of possible litigation, claims or regulatory investigations.

For candidates making it to onsite interviews we gather and process information relating to travel arrangements, as well as any personal information relating to immigration and relocation for successful applicants (employees).

Applicant data is processed on the basis of contractual obligations and legitimate interests of Supercell or of the applicant in connection to the recruitment process in order for Supercell to assess the potential grounds for entering into an employment contract with the applicant. Supercell may also send marketing-related communications to the applicant, subject to the right to opt out.

Supercell may hire contractors and consultants to process applicant data on Supercell’s behalf.

Sources of Data

The applicant may send an application to Supercell via Supercell’s website or social media (such as LinkedIn). The data is collected directly from the applicant or, if the applicant has given permission, from third parties.

Disclosure of Data

Applicant data may be shared with third parties outside Supercell’s organization if access to the personal data is reasonably necessary to: (i) meet any applicable law, regulation, and/or court order; (ii) detect, prevent or otherwise address crime and/or security issues.

We may also share personal data to authorized service providers who perform services for us such as our recruitment management platform and other IT service providers. Our agreements with our service providers include commitments that the service providers agree to limit their use of personal data and to comply with privacy and security standards at least as stringent as the terms of this privacy policy.

We may share personal data with third parties outside of our organization for other reasons than the ones mentioned before, when we have your explicit consent to do so. You have a right to withdraw such consent at any time.

Applicant data may however be transferred to other Supercell entities within the Supercell group or to Supercell’s contractors for the purposes of this Privacy Policy and such entities may reside in non-EU countries.

Data Retention

With your consent, applicant data is stored for five years for future opportunities, after which it is deleted from Supercell’s systems.

We also store personal data under this privacy policy for a certain period based on our legitimate interest for the purpose of possible litigation, claims or regulatory investigations.

Protection of Applicant Data

Access to applicant data is limited within Supercell and its contractors to those with a need to access it based on their job functions. The information is collected into databases that are protected by firewalls, passwords and other technical measures.

Applicant data in manual form (such as prints) is stored behind locks with access only by those who need to access the data based on their job functions.

Applicant data in digital form is stored in password-protected environments and protected by industry standard security measures.

The databases and backup copies are in locked premises and can be accessed only by certain pre-designated persons.

Supercell regularly assesses the need for data retention in light of the applicable legislation. In addition, Supercell takes reasonable measures to ensure that the personal data is not incompatible, obsolete or inaccurate considering the purpose of the processing.

Your Rights

Right to access

You have a right to access the personal data processed by us. You may contact us, and we will inform what personal data we have collected and processed regarding you and the purposes such data are used for.

Right to withdraw consent

If processing is based on a consent granted by you, you may withdraw the consent at any time.

Right to correct

You have the right to have incorrect, imprecise, incomplete, outdated, or unnecessary personal data we have stored corrected or completed.

Right to deletion

You may also ask us to delete your personal data from our systems. We will comply with such request unless we have a legitimate ground to not delete the data.

Right to restriction of processing

You can request restriction of processing of personal data when your data erasure, rectification or objection requests are pending and/or when we do not have legitimate grounds to process your data.

Right to object

You have the right to object to the processing of your personal on grounds relating to your particular situation. We will comply with such objection unless we have a legitimate ground not to.

Lodging a complaint

In case you consider our processing of personal data to be inconsistent with the applicable data protection laws, you have a right to lodge a complaint with the local supervisory authority for data protection.

How to use your rights

If you want to use your rights, please send us e-mail at the contact details indicated above. We may reject requests that are unreasonably repetitive, excessive or manifestly unfounded by giving you a justified notice of such decision.