Privacy Policy
Last updated: 7 August 2026
This Privacy Policy explains how eStaff Fabrik Oy processes personal data when you visit the ESFABRIK website, contact us or participate in our recruitment. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable Finnish legislation.
1. Controller
eStaff Fabrik Oy
Business ID: 3355278-4
Address: Karaportti 5, 02610 Espoo, Finland
Email: privacy@esfabrik.fi
2. Personal Data We Process
A. Website operation and security
When you visit our website, limited technical information may be processed to deliver the site, maintain its security and prevent spam or abuse. This information may include:
IP address
Browser and device information
Request timestamps and network information
Security, spam-prevention and diagnostic information
B. Contact and enquiries
When you submit a form or contact us directly, we may process:
Your name
Email address
Telephone number, if provided
Company and professional information
The topic and content of your enquiry
Subsequent communications relating to your enquiry
Please do not submit sensitive personal data through our contact forms.
C. Recruitment
When you apply for a position, respond to a recruitment message or otherwise participate in our recruitment, we may process:
Name and contact details
LinkedIn profile information or profile URL
CV, application and supporting documents
Employment history, education, skills and qualifications
Role preferences and availability
Interview notes and assessment information
Reference details
Communications relating to the recruitment process
Information concerning the progress and outcome of the recruitment process
We process only information that is relevant and necessary for the position or recruitment activity concerned.
Please do not provide health information or other special-category personal data unless it has been specifically requested and is necessary. If we receive unnecessary special-category data, we do not use it in recruitment and delete it where reasonably possible.
3. Sources of Personal Data
We collect personal data primarily:
Directly from you
Through our website and contact forms
Through email, telephone and other direct communications
Through LinkedIn when you apply, respond to us or make relevant professional information available
From referees or other third parties with your permission, or where collection is otherwise permitted by law
We may use limited professional information made available on LinkedIn to identify and contact potential candidates about a relevant position. If you engage with us, subsequent recruitment information is collected primarily from you.
We ask for your permission before contacting referees or collecting additional information about you from other sources, unless applicable law specifically permits collection without your consent.
4. Purposes and Legal Bases for Processing
A. Website operation and security
We process technical information to deliver, maintain and protect our website, prevent misuse and resolve technical problems.
Legal basis: Our legitimate interest in maintaining a secure and functional website under GDPR Article 6(1)(f).
B. Communication and enquiries
We process contact information and communications to respond to enquiries, arrange discussions and provide requested information.
Legal basis: Our legitimate interest in managing business communications under GDPR Article 6(1)(f). Where your enquiry relates to potential services or an agreement, processing may also be necessary to take steps at your request before entering into a contract under GDPR Article 6(1)(b).
C. Recruitment
We process candidate information to:
Identify and contact potential candidates
Receive and manage applications
Assess qualifications and suitability
Communicate with candidates
Arrange interviews and assessments
Contact authorised referees
Make and document recruitment decisions
Prepare an employment relationship where applicable
Establish, exercise or defend legal claims
Legal basis: Taking steps at the candidate’s request before entering into an employment contract under GDPR Article 6(1)(b), our legitimate interest in managing recruitment under GDPR Article 6(1)(f), and compliance with legal obligations under GDPR Article 6(1)(c), where applicable.
Our initial use of limited professional LinkedIn information to identify and contact potential candidates is based on our legitimate interest in recruiting for relevant positions.
If we would like to retain your information for future opportunities beyond the original recruitment process, we will request your separate consent under GDPR Article 6(1)(a). You may withdraw that consent at any time.
D. Legal obligations and claims
We may process personal data where necessary to comply with legal obligations or to establish, exercise or defend legal claims.
Legal basis: GDPR Article 6(1)(c) or Article 6(1)(f), depending on the circumstances.
Where we rely on legitimate interests, we consider the nature of the information, the context of processing and the possible impact on your rights.
Providing personal data is voluntary, but we may be unable to respond to an enquiry or consider an application without the information needed for that purpose.
5. Website Analytics and Cookies
We use Framer’s built-in analytics to understand website activity at an aggregate level. According to Framer, this analytics service does not use cookies, generate persistent identifiers or identify individual visitors.
Technical processing necessary for website delivery, security, spam prevention and form operation may still occur.
If we introduce non-essential cookies or tracking technologies in the future, we will update this Privacy Policy and request consent where required before activating them.
6. Service Providers and Other Recipients
We may disclose personal data to trusted providers where necessary for the purposes described in this Privacy Policy, including:
Framer B.V. for website hosting, infrastructure, forms, security and aggregate analytics
LinkedIn Ireland Unlimited Company when recruitment is conducted through LinkedIn
Business email and IT service providers
Professional advisers where necessary
Courts, authorities or other parties where disclosure is required by law
LinkedIn also processes information through its platform in accordance with its own privacy policy.
Our service providers may process personal data only for the agreed purposes and in accordance with applicable data-protection requirements.
We do not sell personal data or disclose it to third parties for their own marketing purposes.
7. International Data Transfers
Some service providers or their subprocessors may process personal data outside the European Union or European Economic Area.
Where personal data is transferred internationally, we use safeguards required by data-protection law, such as an adequacy decision, the European Commission’s Standard Contractual Clauses or another lawful transfer mechanism.
8. Retention
We retain personal data only for as long as necessary for the purpose for which it was collected:
Technical and security information is retained only as long as necessary for website delivery, security and troubleshooting.
Contact and enquiry information is generally retained for up to 24 months after the last communication.
Information relating to a specific recruitment process is generally retained for up to 24 months after that process has ended.
Information retained for future recruitment opportunities with your consent is kept for up to 24 months from the date of consent, unless you withdraw your consent earlier.
If a candidate is employed, relevant information may become part of the employee records and be retained according to the applicable employee-data retention requirements.
Information may be retained for a longer period where required by law, an ongoing contractual relationship or the establishment, exercise or defence of legal claims.
When personal data is no longer needed, it is deleted or anonymised.
9. Your Rights
Depending on the circumstances, you have the right to:
Request access to your personal data
Request correction of inaccurate or incomplete data
Request deletion of your data
Request restriction of processing
Object to processing based on legitimate interests
Withdraw consent at any time where processing is based on consent
Receive personal data you provided in a portable format where applicable
These rights may be subject to limitations under applicable law.
To exercise your rights, contact us at privacy@esfabrik.fi. We may need to verify your identity before completing your request.
You also have the right to lodge a complaint with a data-protection authority. In Finland, the competent authority is the Office of the Data Protection Ombudsman: https://tietosuoja.fi/en/
10. Information Security
We apply appropriate technical and organisational measures to protect personal data. These measures include secure hosting, encrypted connections, access controls and limiting access to people who require the information for their work.
No method of electronic storage or transmission is completely secure, but we review and improve our safeguards where necessary.
11. Automated Decision-Making
We do not make recruitment or other decisions that produce legal or similarly significant effects based solely on automated processing.
12. Changes to This Privacy Policy
We may update this Privacy Policy when our services, processing activities or legal obligations change. The latest version and its revision date will always be available on this page.
