NAWIA OY – PRIVACY POLICY

EU General Data Protection Regulation (2016/679) 

Last updated: May 28, 2026 

1. Introduction 

Nawia Oy (hereinafter “Nawia” or “we”) respects the privacy of your personal data and is committed to processing personal data with care, transparency, and in accordance with applicable data protection laws. This Privacy Policy explains how we process the personal data we collect in connection with our recruitment services. 

This privacy notice covers the processing of personal data for two groups of data subjects: 

• Customer database: contact persons and representatives of our client organizations  
• Candidate database: job seekers and candidates participating in recruitment processes

2. Data Controller and Contact Information 

Data controller: 

Nawia, Inc. 
Business ID: 3415857-8 
Peltokatu 26, 33100 Tampere 
Email:  
Phone: +358 400 449 961 

Data Protection Officer: 

Matias Ketola 
Chief Executive Officer 
Email:  
Phone: +358 400 449 961 

All inquiries regarding data protection, requests concerning the rights of data subjects, and other questions regarding the processing of personal data should be directed to the data protection officer listed above. 

PART I – CUSTOMER REGISTRY 

Personal information of contact persons at client organizations 

3. Group of data subjects 

This section of the policy applies to current and potential contacts and representatives of Nawia’s client organizations who interact with us regarding the procurement and provision of our services and the management of assignments. 

4. Personal data to be processed 

We process the following personal data regarding our customers’ contact persons: 

• Basic information and contact details: name , job title and position within the organization, work email address, phone number, name of employer organization, and industry 
• Customer relationship data: data related to orders and quotes, billing information, correspondence and communication, customer service interactions, feedback
• Marketing-related information: Consents and opt-outs regarding direct marketing  

In order to manage the customer relationship and the related agreements and assignments, it is necessary to provide certain basic information, such as your name, contact details, and employer information. Without this information, we cannot manage the customer relationship. 

5. Purposes and Legal Bases for the Processing of Personal Data 

We process personal data in our customer database for the following purposes:

Basis of legitimate interest: Nawia’s legitimate interest is based on the appropriate and relevant business relationship between the customer’s contact person and Nawia. We have assessed that the processing of personal data for these purposes does not unduly compromise the rights and freedoms of the data subject, taking into account the nature of the data being processed (professional contact information) and the context.

6. Sources of personal data 

We collect personal data for our customer database primarily directly from the data subject at the start of and during the customer relationship, as well as through the customer’s organization. Data may also be collected from publicly available sources, such as company websites, the trade register, or LinkedIn profiles. 

7. Recipients of personal data 

Personal data from the customer registry may be disclosed or transferred to the following parties: 

• Data processors: Nawia uses external service providers to deliver its services; these providers act as data processors on Nawia’s behalf and in accordance with Nawia’s instructions. These include, for example, IT and system providers, CRM system providers, and communication service providers. Appropriate personal data processing agreements have been entered into with these processors. 
• Authorities: Information may be disclosed to authorities if required by law or by an official decision. 
• Potential corporate transactions: If Nawia sells or otherwise reorganizes its business, information may be disclosed in connection with such a transaction. 

8. Retention period for personal data 

We retain personal data in our customer database for the duration of the customer relationship and, thereafter, for a maximum of:

• Information related to customer communications and orders: for as long as necessary for business purposes, unless a longer retention period is required to manage a legal claim. 
• Billing information: the retention period required by the Accounting Act (generally 6 years from the end of the fiscal year). 

Data may be retained for a longer period if necessary to comply with legal obligations or to establish, exercise, or defend legal claims. 

PART II – REGISTER OF CANDIDATES 

Information about the individuals involved in the recruitment process 

9. Group of Data Subjects 

This section of the privacy notice applies to individuals who participate in recruitment processes conducted by Nawia, including individuals who have applied for an open position, whom we have contacted for recruitment purposes, or whose data has otherwise been collected for the purpose of providing our recruitment services. 

10. Personal Data Processed 

We process the following personal data about candidates: 

• Basic information and contact details: name , email address, phone number, address, and other identifying information 
• Professional background: education , degrees, language skills, specialized expertise, work and educational history, current and previous employers 
• Job search-related information: resume (CV), application documents, details about the position you are applying for or offering, career goals and salary expectations, availability 
• Information generated during the recruitment process: information and notes related to interviews, conversations with the candidate stored in the Nawia system, results of any aptitude or personality assessments, information provided by references, evaluations made by Nawia recruiters, and feedback from the client 
• Publicly available information: LinkedIn profile or other public professional profile, provided the candidate has published the information themselves 
• Additional information provided by the candidate: such as information related to work and residence permits, driver’s license information, hobbies and other leisure activities, a photo, contact information for references, and other attachments and information voluntarily submitted by the candidate (e.g., portfolio, work samples, certificates, or diplomas) 

Participation in the recruitment process requires that you provide basic information relevant to the process. Without this information, we cannot evaluate your candidacy or present you to a client company. Some of the information is optional, and we will clearly mark the required fields during the application process.

11. Purposes and Legal Bases for the Processing of Personal Data

Basis for legitimate interest: Nawia’s legitimate interest in recruitment is based on the nature of its business as a provider of recruitment services and on the fact that providing recruitment services for the benefit of both the candidate and the client requires the processing of candidate data. We have assessed that, when viewed as a whole, the data subject’s interest does not override Nawia’s legitimate interest, taking into account that the processing concerns data in a professional context and the candidate has the opportunity to object to the processing.

12. Sources of Personal Data 

We collect candidates' personal data from the following sources: 

• From the candidate: when submitting an application , registering, or otherwise contacting us; during interviews and other direct communication 
• From public sources: professional networks (such as LinkedIn), public registries, and other publicly available sources of information; we collect public information solely for recruitment purposes 
• From third parties: from referrers or client companies in connection with a recruitment assignment; candidates are notified of the collection of information from third parties 

13. Recording discussions with candidates 

Nawia may save conversations with candidates in the recruitment system it uses. The purpose of saving these conversations is to document the recruitment process, ensure and improve service quality, and manage the process with the aim of achieving the best possible match between the candidate and the client. 

14. The Use of Artificial Intelligence in the Recruitment Process 

Nawia uses artificial intelligence to support its recruitment processes. Artificial intelligence can be used, for example, to analyze applications and candidate profiles, as well as to streamline the recruitment process. 

Nawia may use an automatic transcription tool during interviews to convert speech into text. The transcription is used solely to assist the recruiter in preparing a summary of the interview. Access to the transcription is restricted to the recruiter conducting the interview. Processing is based on the candidate’s explicit consent (GDPR Article 6(1)(a)), which is requested before the interview begins. Refusal to give consent has no effect on the processing of the candidate’s application. 

Nawia does not make automated decisions that would have legal effects on a candidate or that would significantly affect a candidate in a similar manner within the meaning of Article 22 of the GDPR. Artificial intelligence serves as a tool for Nawia’s recruiters, and all assessments, selections, and decisions regarding candidates are always made and confirmed by a human. 

15. Recipients of Personal Data 

Personal data from the candidate registry may be disclosed or transferred to the following parties: 

• Client Companies: With the candidate’s express consent, personal data necessary for recruitment purposes may be disclosed to the client company for which the candidate is applying. The candidate’s information is disclosed to the client to the extent necessary to fulfill the assignment. 
• Data processors: Nawia uses external service providers who act as data processors on Nawia’s behalf. These include, for example, recruitment system providers, video interview service providers, aptitude assessment providers, and other IT service providers. Appropriate personal data processing agreements have been entered into with these processors.
• Authorities: Information may be disclosed to authorities if required by law or by an official decision. 

16. Retention period for personal data 

We retain personal data in the candidate registry as follows: 

• Data related to the active recruitment process: For up to 2 years after the end of the recruitment process , unless the candidate has given consent for longer retention. The retention period is based on any applicable legal statutes of limitations related to recruitment (e.g., the statute of limitations under the Equality Act). 
• Candidate profile data for future recruitment: With the candidate’s consent, for up to 2 years, after which we will ask the candidate if they wish to have their data retained. If the candidate objects to further retention or withdraws their consent, the data will be deleted. 
• Conversations stored in the recruitment system: Data is retained for a maximum of 2 years, after which it is permanently deleted. 
• Retention related to legal claims: If a dispute arises in connection with the recruitment process, the data may be retained until the dispute is finally resolved. 

After the retention period has expired, Nawia will delete or anonymize personal data in accordance with applicable regulations.

PART III – INFORMATION COMMON TO ALL REGISTERED ENTITIES 

17. Data transfers outside the EU/EEA 

As a general rule, personal data is processed within the European Union and the European Economic Area. If the service providers we use transfer personal data outside the EU/EEA, we ensure that such transfers comply with data protection legislation, such as the Standard Contractual Clauses (SCC) or other appropriate safeguards in accordance with Article 46 of the GDPR. Data is transferred outside the EU/EEA only if it is necessary for the technical implementation of the services. 

18. Protection of Personal Data 

Nawia has implemented appropriate technical and organizational security measures to protect personal data against unauthorized or unlawful processing, accidental loss, alteration, or disclosure. These security measures include, among others: 

• Encryption of data communications and stored data 
• Role-based access control: Only those Nawia employees whose job duties require it have access to personal data 
• Individuals who process personal data are bound by a duty of confidentiality ● Regular maintenance of technical systems and ensuring their security ● Data processing agreements with all subcontractors and processors

19. Rights of the Data Subject 

Under the General Data Protection Regulation, data subjects have the following rights: 

• Right of access to data (right to access): You have the right to obtain confirmation as to whether Nawia is processing personal data concerning you and to request a copy of the data being processed. 
• Right to rectification: You have the right to request that your inaccurate or incomplete personal data be corrected or supplemented. 
• Right to erasure (“right to be forgotten”): In certain situations, you have the right to request the erasure of your personal data, for example, when the data is no longer necessary for the purpose for which it was collected, or when you withdraw your consent and there is no other legal basis for processing. This right may be limited, for example, by a legal obligation to retain the data.
• Right to restriction of processing: You have the right to request that the processing of your personal data be restricted in certain situations, such as when you contest the accuracy of the data or object to the processing. 
• Right to object: You have the right to object at any time to the processing of your personal data when such processing is based on Nawia’s legitimate interest. Nawia will cease processing the data following your objection, unless there are compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the data subject. 

You always have the right to object to the processing of your personal data for direct marketing purposes, including profiling related to such purposes. 

• Right to data portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller, provided that the processing is based on consent or a contract and is carried out by automated means. 
• Right to withdraw consent: If the processing of your personal data is based on your consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal. However, withdrawing your consent may mean that Nawia cannot continue to provide services to the same extent as before. 
• Right to lodge a complaint with a supervisory authority: You have the right to lodge a complaint with the competent data protection authority if you believe that the processing of your personal data violates applicable data protection laws. In Finland, the competent supervisory authority is: 

Office of the Data Protection Ombudsman 

P.O. Box 800, 00531 Helsinki 
Phone: 029 566 6700 
Email:  
Website: www.tietosuoja.fi 

20. Exercising the Data Subject’s Rights 

Requests regarding any of the above rights may be submitted by sending a written request to Nawia’s data protection officer at the address provided in Section 2 of this Privacy Policy. The request must include sufficient information to identify the person making the request. Nawia will respond to requests without undue delay and, as a rule, within one month of receiving the request. 

21. Changes to the Privacy Policy 

Nawia is constantly developing its operations and reserves the right to amend this Privacy Policy. If the Policy is amended, an updated version will be published on Nawia’s website. We review the Privacy Policy regularly and recommend that you review its contents from time to time.