Data and Privacy policy

When you use our website, we may ask for your personal information and process it, if necessary to identify you and to provide you with services and send messages to you.

Use of cookies
We use cookies in our services. Cookies are commonly used in online services. They are small files that identify visitors that are transferred from a server to the visitor’s computer. We use cookies to enable visitors to move from one service to another on our website during the same session. The visitor cannot see that cookies are being used and it does not affect the visitor’s computer.

We also use cookies to monitor visitor traffic so that we can improve our services. Monitoring visitor traffic in Stockmann’s online services includes the analysis of the pages visitors land on and the pages they leave from.

The use of cookie is safe and they do not harm visitors’ computers or files. If you want to, you can block cookies in the settings of the web browser that you use.

The website uses Google Analytics which is an analysis tool of Google Inc. Google Analytics uses cookies, which are text files, to enhance the analysis of the use of the site. You can block cookies in the settings of your web browser. Please note that all functions of the website will not work when cookies are blocked.

By using this website you accept that Google processes your data as explained on this page and in accordance with Google’s data protection policy. This is how Google uses collected data.


EU General Data Protection Regulation (2016/679), Articles 12, 13 and 14

1 Controller and contact in matters concerning the data file

Lindex Group plc (Business ID: 0114162-2)
Aleksanterinkatu 52 B / PO Box 220
FI-00101 Helsinki
Tel. +358 (0)9 1211

2 Purpose of and legal basis for processing personal data

The personal data contained in the register is mainly processed for the implementation and management of recruitment measures. Information received from the registrant is processed to assess the person’s suitability and to enable contacts related to the application and selection procedure. The data is processed with the data subject’s consent.


The personal data contained in the job applicant register can also be processed to demonstrate the legal obligations of the data controller related to the selection of employees and to prepare, present or defend a legal claim when the processing is in accordance with the data controller’s legitimate interest.


In the case the candidate is selected for the position, the data is transferred to Stockmann’s HR system for the necessary employment starting measures.

3 Personal data groups

Personal data categories

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

During the recruitment process we may collect and process following personal data from you:

  • Identity Data such as first name, last name, username or similar identifier.
  • Contact Data such as an address, email address and telephone numbers.
  • Job Data such as your CV, previous work history and other related information
  • Skills and Competencies Data such as your level of education, certificates, language skills, data from assessments and other related data.
  • Admission Test Data (if conducted during the process) such as results of written and oral test.
  • Physiological information such as photo (not mandatory), video (possible)
  • In addition, we collect and process personal data you provide to us via interviews and application.
  • (Security Positions in Finland only) Security Clearance; Information obtained from the security police in the security clearance. The information to be processed in a security clearance is regulated in the Security clearance act (726/2014)
  • (Security Positions in Finland only) Credit report: Information received from the service provider regarding candidate’s credit report and possible infringements.

4 Sources of data

Direct interactions. We mainly collect your personal data from you, for example when you provide us with your CV, fill out our application form and provide us with information about you in the employment interview


Third parties or publicly available sources. We may receive data about you from third parties such as

  • reference contacts you have given us
  • third parties such as talent acquisition or skill assessment companies
  • external websites if you have referred to such websites, for example LinkedIn
  • In case of possible credit check, a verified local partner

We will only collect such data if we have informed you about the collection and with your approval.

5 Profiling or automatic decision-making

In order to assess a person’s suitability in the recruitment process, the applicant’s suitability, abilities and competence are assessed in relation to the vacancy’s job description. The applicant profile is created from the information mentioned in this report. Profiling of applicants does not involve automatic decision-making.

6 Recipients of data

  • Recruitment system provider; TalentAdore Oy
  • Verified local credit check partner: For the purpose of checking credit information, the register keeper provides the necessary identification information.
  • Talent acquisition companies; The personal data included in the application process is shared with the talent acquisition company handling the assignment.
  • Security Intelligence Service; The registry keeper can submit the request and the identification information to the authority conducting the investigation.
  • Disclosures based on the law to the authorities, e.g. for the organization of statutory social security and in the investigation of crimes (police).

7 Transfer of data to non-EU or non-EEA countries

Data is not transferred outside the EU or EEA.

8 Storage times for personal data

Collected data will only be stored for 18 months and to the extent that is necessary for the original or compatible purposes for which the personal data was collected. The storage period is dependent and in accordance with local data retention laws.

Data processed on grounds of consent is removed when the consent is withdrawn.

Based on its legitimate interest, the controller may store the data for as long as it is necessary for safeguarding the legitimate interest. In such cases storage times will be based on limitation periods and expiry times.

9 Right of access and right of rectification

Right to receive information
The data subject is entitled to obtain information with regard to what data is collected and for what purposes, what the legal basis is for processing the data and to whom data is disclosed.

Right of access
The data subject is entitled to review what data has been stored about them in the data file, how the data is used and for what purposes. If requested, the controller must provide a copy of the personal data undergoing processing. The provision of a copy must not adversely affect the rights and freedoms of others.

Right of rectification
The data subject has the right to demand that the controller rectify, without undue delay, any inaccurate and erroneous personal data concerning them. If the data subject contests the accuracy of the personal data, they are entitled to demand that the controller restrict their processing of the data for a period enabling the controller to verify the accuracy of the personal data.

Taking the purpose of use of the data into account, the data subject has the right to have incomplete personal data completed. The data subject is primarily responsible for notifying the controller of any changes or deficiencies related to their personal data. The controller is responsible for immediately rectifying any errors it detects.

The will inform each recipient to whom personal data has been disclosed of any rectifications of and additions to personal data, unless this proves impossible or requires unreasonable effort.

10 Right of erasure

The data subject has the right to have the controller erase, without undue delay, their personal data, provided that one of the following applies:


– The personal data is no longer needed for the purposes for which it was collected or otherwise processed

– The data subject withdraws their consent and there is no other legal basis for the processing

– The personal data has been processed unlawfully

– The personal data must be erased to meet a statutory obligation arising from EU or national legislation.


The data does not need to be erased, even when requested to do so, if the controller has the right to process the data to establish, exercise or defend a legal claim. The controller must inform each recipient to whom personal data has been disclosed of the erasure of the personal data, unless this proves impossible or requires unreasonable effort.

11 Right to restriction of processing

The data subject has the right to restrict the controller’s processing of personal data under the following circumstances:

  • The processing is unlawful, in which case the controller is generally obligated to erase the data, but the data subject opposes the erasure of the personal data and requests the restriction of its use (erasure) instead
  • The controller no longer needs the personal data for the purposes of the processing, but the data subject needs it for the establishment, exercise or defence of a legal claim

If the data subject has demanded that the processing be restricted, the personal data may only be processed with consent from the data subject (excluding data storage); to establish, exercise or defend a legal claim or protect the rights of another natural or legal person; or for reasons of important public interest of the EU or of a Member State.

The controller must inform each recipient to whom personal data has been disclosed of the restriction of processing personal data, unless this proves impossible or requires unreasonable effort.

In the recruitment system, TalentAdore, within Talent Community feature, personal data is kept for 24 months (retention period) after joining or adding to the Talent Community. At the end of this storage period, the person is actively asked about their willingness to continue as a member of the community. With active approval, a person can continue as a member of the community for a longer period of time, otherwise the personal data will be deleted automatically after this retention period.

12 Right to withdraw consent and right to object

The data subject has the right to withdraw their consent to the processing of personal data at any time. A withdrawal of consent will not affect the lawfulness of the processing carried out based on the consent before its withdrawal.

The right to object does not exist to the extent that the processing of personal data is based on an agreement and is necessary for its execution or that the processing is necessary to meet a statutory obligation.

The data subject has the right to object to the processing of their personal data when the processing is based on the controller’s legitimate interest.

13 Right to data portability

In cases where the processing is based on consent or an agreement:

  • The data subject has the right to receive the personal data concerning them, which they have provided to the controller, in a structured, commonly used and machine-readable format, and the right to transfer the data to another controller.
  • The data subject has the right to have the data transferred directly to another controller when this is technically possible and is not unreasonable for the controller. The implementation of this right must not adversely affect the rights and freedoms of others.

14 Instructions for exercising data subjects’ rights

Requests to exercise data subjects’ rights may be sent to

If the response includes personal data, the data will be submitted encrypted in electronic format or by means of a registered letter. The letter can only be signed as having been received by its intended recipient. This is to ensure the confidentiality of the data of the actual recipient.

In matters concerning the processing of personal data or the exercising of rights based on the EU General Data Protection Regulation in relation to Stockmann’s functions, please contact Stockmann’s data protection officer. The data protection officer can be reached via email at or by calling +358 (0)9 1221 and requesting the operator to connect to the data protection officer.

15 Right to lodge a complaint with supervisory authority

The data subject has the right to file a complaint with the supervisory authorities if they deem that the processing of the personal data concerning them is in violation of the applicable data protection regulations. In Finland, the Office of the Data Protection Ombudsman serves as the nationalsupervisory authority.

Office of the Data Protection Ombudsman
Visiting address: Ratapihantie 9, 6th floor
FI-00520 Helsinki

Postal address: PO Box 800
FI-00521 Helsinki

Tel. (switchboard): +358 29 56 66700
Fax: + 358 9 56 66735