INFORMATION REGARDING WISE GROUP’S PROCESSING OF PERSONAL DATA
Wise Group with subsidiaries safeguards individuals’ right to personal integrity and therefore strives to work with customers and suppliers who comply with the applicable regulations on personal data processing. Wise Group processes a large variety of personal data within our respective operations. Personal data is for instance processed during recruitment, hiring of consultants and provision of digital HR services. Depending on the service provided, the responsibility for the personal data processing may be divided differently between the contracting parties. We want to clarify how our companies within Wise Group, with regard to applicable personal data regulations, perceive the division of responsibility for personal data processing. If any questions, please reach out to your nearest contact person or to our Data Protection Officer dpo@wisegroup.se.
Personal data processing during recruitment
The Wise companies who collect and process personal data as part of a recruitment process in order to present suitable candidates to the customer do so as a personal data controller.
This is because the companies, based on experience and profession, have developed and decided on the specific methods for the collection of data, the sources of the data and the kind of data that is to be processed for recruitment purposes, thereby taking on an independent position vis-à-vis customers. The companies also decide the purpose of the treatment as the objective is to establish long-term and relationship-building contacts with the candidates. As the companies are data controllers, they must always ensure that they have a lawful basis for the processing and that the processing is in accordance with the applicable personal data regulations. This includes the provision of necessary information regarding the processing to the candidates and obtaining necessary consent. The companies also have an obligation to ensure that the candidates are informed of that their personal data may be transferred to the customer.
The customer is in turn controller for the processing of personal data that has been transferred, for instance by a submitted candidate profile, during the recruitment process.
Personal data processing during assignment of consultants
When a Wise company assigns a consultant to a customer (regardless of whether it is an employee or a contracted consultant), the consultant will work under the management and responsibility of the customer. The Wise company will ensure that the assigned consultant has given his or her consent that any personal data deemed necessary in connection with the assignment is transferred to the customer. The customer is controller of any personal data received from the Wise company.
If an assigned consultant processes any personal data when working under the customer’s direct management, e.g. through the use of the customer’s systems etc., and a non-disclosure agreement (“NDA”) has been entered between the costumer and the consultant, preventing any personal data to be shared with the Wise company, the Wise company shall not be regarded as a personal data processor. The customer is responsible for entering a NDA with the consultant before the assignment is commenced. Therefore, the Wise company always enclose a draft NDA with the cooperation agreement for the convenience of the customer. This will also ensure that the customer can feel comfort in that no personal data that the consultant might process during the assignment will be transferred to the Wise company.
The Wise company is thus prevented from processing any personal data that the customer or the assigned consultant might process. Since no personal data is transferred between the customer and the Wise company, there is no need for the parties to enter a data processing agreement.
Personal data processing during counseling and educational services
A Wise company that offers outplacement services or other career counseling services to customers does so most of the time in the capacity of a personal data controller. The reason for this is that the Wise company does not store or process the personal data on behalf of the customer but rather provides a service through which the company uses its own system and its own developed methods, routines and outplacement processes to coach existing and former employees of the customer. The processing of personal data is thus more extensive than, for instance, a simple storage service.
In such instances where a Wise company process personal data for the provision of educational services, the Wise company does so in the capacity of personal data controller. This is because the instructors do not work under the customer’s direct management and control. The instructors are provided in order to educate the customer, not to process the customer’s personal data. The purpose of the processing is for the Wise company to be able to provide the educational services.
In light of the assessments above, there is no relationship between the Wise companies and the costumers that necessitate the entering of a data processing agreement (“DPA”). The provisions on data processing agreements are not applicable in these situations. Therefore, no such agreements will be concluded in the provision of these services. Issues relating to the processing of personal data, intellectual property rights and confidentiality will instead be governed by provisions in the cooperation agreement.
Personal data processing during information services
In such instances where a Wise company offers information services, such as providing digital checklists, manuals and process descriptions etc., the Wise company does not process any personal data on behalf of the customer. The customer will neither be able to transfer any personal data to the Wise company during the contractual relationship. The Wise company will instead be regarded as personal data controller of the limited amount of personal data it will receive at the entering of the customer agreement. Any transferred personal data will only be processed by the Wise company in order to provide the service to the customer.
Personal data processing during digital HR services
When Wise companies provide other digital HR services, such as talent management systems, customer and employee surveys, the companies will be regarded personal data processors in relation to the customer who will be regarded as personal data controller. This is because the customer, when using such services, will provide Wise companies with personal data and determine the purposes and means of the processing. In order to ensure that the processing will adhere to the applicable personal data regulations, the Wise companies will always enclose a data processing agreement (“DPA”) with the customer agreement to be entered between the parties.
Other processing of personal data that necessitates the entering of a data processing agreement “DPA”
In addition to the processing of personal data when providing digital HR services, Wise companies provides a few other services where the customer will be regarded as personal data controller. An example of such a service is when a Wise company verifies the qualifications of a candidate (so called second opinions). In order to ensure that the processing will adhere to the applicable personal data regulations, the Wise companies will always, upon the provision of such services, enclose a data processing agreement with the customer agreement to be entered between the parties.
In light of the assessments above, in those instances where the customer transfers all personal data and with its own stated method determines the purposes and means of the processing, the relationship between the Wise companies and the customer will be of such a nature that a data processing agreement has to be entered.
It is here, on this page that Wise Group with subsidiaries publishes the latest information on the processing of personal data, please visit us again.
With best regards,
Christian Rossi (DPO), Ingrid Höög (CEO), Nathalie Berthelius (Chief People & Culture Officer)