Thank you for applying to Alva!
In this Privacy Policy, we (“Alva Labs AB” or “Alva”) describe what personal data we collect and process from you, being someone applying for a job at Alva or sourced or referred to us. This privacy policy will detail:
- How our recruitment process works, from start to finish
- Where, when, and how we collect data from you in the recruitment process
- Why we process your personal data and the legal grounds for processing it
- The use of AI and third party tools in our recruitment process
Questions so far? Do not hesitate to contact us at Alva if you have any questions regarding this Privacy Policy, our processing of your personal data, or if you want to exercise your rights.
Complaints? Please take them up with us, or if you so wish, with our Supervisory Authority Integritetsskyddsmyndigheten. For other Supervisory authorities, visit this page.
| Alva Labs AB | Reg. no. 559103–8178 |
|---|---|
| Postal and visiting address: | Luntmakargatan 66, 113 51 Stockholm, Sweden |
| Email: | legal@alvalabs.io |
| Web page: | www.alvalabs.io |
Should I take your word for it? Our Data Protection Officer (DPO) is tasked with internally reviewing our compliance with GDPR. Our DPO is independent from Alva's management control in matters of data privacy and will make its own judgement, from your (the data subjects’) perspective. Feel free to reach out and direct any concerns or questions you have to: dpo.alvalabs@gdprhero.se
1. General
Under the General Data Protection Regulation (EU) 2016/679 (GDPR), Alva assumes the role of a “data controller” when we handle your application – which means we make decisions on what information to collect from you, how to process your information, and why we process it. As an applicant to Alva, you assume the role of a “data subject”, meaning you are the one providing the personal data that we process.
What does it mean to “process” data? The term “processing” under GDPR can refer to a wide range of activities, including collecting, storing, organizing, sharing, or erasing data (essentially any activity where you are doing something with or to data). Because Alva collects, stores, and uses your data to evaluate you as a candidate, we are “processing” it.
2. An overview of Alva’s hiring process
Alva’s hiring process starts when you apply for a job with us. In certain cases, we may receive referrals for candidates or use third parties to help us source candidates for roles that have a low pool of applicants. All third party tools are subjected to a rigorous supplier vetting process.
We run our recruitment in Alva’s own platform. Before a role opens, the hiring team defines the role criteria (the skills, experience, and traits that matter for the role) and an assessment plan, so that every candidate for the role is evaluated against the same criteria.
When you apply through our career page, or when we receive a referral or source you for a role, we register your application. If you upload a CV, the information extracted from it is shown to you for confirmation before it is used. Depending on the role, you may also be asked to answer a few screening questions.
Next, we invite you to complete logic and personality assessments through Alva. For technical roles, we also send candidates coding assessments. Your results from these assessments are collected and stored in Alva’s platform and are only accessible to you and the hiring team at Alva.
Your assessment results are compared against the role criteria to calculate a Role Fit score, which shows how well your profile matches the role. The hiring team reviews your results, and candidates who move forward are invited to structured interviews: an initial interview with HR to learn more about who you are as a person, followed by interviews with hiring managers and relevant colleagues to assess your potential and readiness to excel in the role. Case exercises (focusing on how you would do certain tasks) are also typically included in these interview stages. Interviews may be recorded and transcribed, and interviewers score your answers against the same role criteria.
Throughout the process, people at Alva review all information and make every decision about who moves forward and who is hired.
If you are offered a position at Alva, we conduct a background check before sending and signing an official employment agreement!
3. Personal data we may collect from you
To facilitate the hiring process we describe above, we collect the following personal data from you:
| Purpose of Processing | Personal Data | Legal Basis | Retention Period |
|---|---|---|---|
| To source candidates for potential roles | Information that you have made publicly available through Linkedin | Legitimate interest to facilitate a recruitment process. | For the duration of the recruitment process, and up to two years after. |
| To assess your abilities for the roles you apply to. | Contact information, identification information, ability information | Legitimate interest, to facilitate a recruitment process. | For the duration of the recruitment process, and up to two years after. |
| To administer the recruitment process | Identification information, contact information, answers to screening questions, languages, and candidate communications. | Legitimate interest, to facilitate a recruitment process. | For the duration of the recruitment process, and up to two years after. |
| To verify the identity and conduct background checks on candidates selected for employment | Identification information, contact information, employment history. | Legitimate interest, to facilitate a recruitment process. | For the duration of the recruitment process, and up to two years after. |
| To execute an employment agreement | Full name, personal identity number, contact information, and compensation details. | Legitimate interest, to facilitate a recruitment process. | For the duration of the employment, and up to two years thereafter |
| To facilitate visa processes for candidates who have, or plan to immigrate to Sweden. | Identification information, contact information, details about your employment, | Legitimate interest, to facilitate a recruitment process. | For the duration of the recruitment process, and up to two years after. |
| To collect feedback from candidates on their experience in the recruitment process | Name, email address, and any personal details shared in your response. | Legitimate interest, to improve our recruitment processes. | For the duration of the recruitment process, and up to two years after. |
4. The use of AI in Alva’s hiring process
According to the European Union’s Regulation on Artificial Intelligence (the “AI Act”), AI used in recruitment processes to evaluate or filter candidates is classified as a “High-Risk” AI system. Anyone using or providing AI in recruitment processes will be required to comply with the AI Act’s requirements for high-risk AI systems from 2 December 2027, to ensure that AI is used responsibly and in a way that protects your interests.
Alva’s platform uses certain AI features to facilitate our hiring process, for example to extract information from your CV, to transcribe interviews, and to provide suggestions and summaries to the hiring team. Our use of AI is limited to automating tasks for humans, and we always make sure to review any output from AI before using it. In other words, we use AI to make the hiring process more efficient, but we do not use AI to make any hiring decisions.
You have the right to request a human review of any decision made about you in accordance with section 5.3.
5. Your rights as a candidate
Your data belongs to you. If at any time you would like to check, modify, erase, or learn more about the personal data we have from you, please submit a request to support@alvalabs.io.
Alva is responsible for responding to your request to exercise your rights within one month from our receipt of your request. We are entitled to extend this period by two additional months when necessary, taking into account the complexity of your request or if we have received a large number of requests from other candidates. We will inform you of any such extension within one month of receipt of your request, together with the reasons for the delay and information about your right to lodge a complaint with a supervisory authority.
Alva will take all reasonable and possible actions to notify any recipients of your personal data as regarding any rectification, erasure or restrictions carried out by us. At your request, we will also inform you of which third parties we have shared your personal data with.
All information and communication, and all actions we carry out, will not cost you anything. If the action you request is manifestly unfounded or excessive, we are entitled to charge you an administrative fee to provide you with the requested information or carry out the requested action or refuse to meet your request.
5.1 Access to your personal data
You have the right to request information on our use of your personal data. You also have the right to request a copy of the personal data being processed by us, at no cost. However, we may charge you a reasonable administrative fee to provide you with additional copies of such information. If you make your access request by electronic means such as email, we will provide you with the information in a commonly used electronic format.
5.2 Right to data portability
You have the right to receive the personal data that you have provided to us in a structured, commonly-used, and machine-readable format, where our processing is based on your consent or on a contract with you and is carried out by automated means.
5.3 Human intervention
We ensure that no decisions are made about you based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you. As described in sections 2 and 4, people at Alva review all information and make every decision in our recruitment process. If you nevertheless believe that such a decision has been made about you, you have the right to obtain human intervention, to express your point of view, to obtain an explanation of the decision, and to challenge it.
5.4 Rectification of your personal data
We will – at your request, or at our own initiative – rectify, anonymise, erase, or complement personal data that you or we discover is inaccurate, incomplete, or misleading. You also have the right to complete the personal data with additional data if relevant information is missing.
5.5 Erasure of your personal data
You have the right to request that we erase your personal data and we must erase it if: the personal data is no longer necessary for the purposes for which it was collected, we use your personal data with your consent, you withdraw your consent and there is no other legal ground for the processing, you object to the processing of your personal data based on our legitimate interest and there is no overriding legitimate ground for the processing, the personal data has not been lawfully processed, or we are required to erase the personal data due to a legal obligation. However, there might be requirements under applicable law, or other compelling reasons, that prevent us from immediately erasing your personal data. In such a case, we will stop using your personal data for any other reasons than to comply with the applicable law, or the relevant compelling reason.
5.6 Right to restrict processing
You have the right to request restriction of the processing when: you have requested rectification of your personal data, during the period of time we are verifying the accuracy of the data, the processing is unlawful, but you do not want the personal data to be erased, Alva, as the data controller, no longer needs the personal data for the purposes for which it was collected, but you require us to retain the information for the establishment, exercise, or defence of a legal claim, or you have objected to a processing activity we base on our legitimate interests, during the time we determine whether our legitimate interests override your privacy rights.
5.7 Your right to object the processing
You have the right to object to the processing of your personal data that we base on our legitimate interests. If you object to such processing, we will only continue with the processing if we have a compelling legitimate reason for the processing that outweighs your interests, rights or freedoms, or if continued processing is necessary for the establishment, exercise or defence of a legal claim. You can always contact us for more information on the balance test that has been made.
6. Security
We prioritize personal integrity and therefore work actively to ensure that your personal data is processed with utmost care. We take measures that can be reasonably expected to make sure personal data is processed safely and in accordance with this Privacy Policy and the GDPR.
7. Transfer of personal data to third party
We share your personal data with carefully-selected suppliers who provide services and functionalities to Alva, which includes data centres and other vendors that facilitate our recruitment process. We will not sell your personal data to any third party.
There are a few steps in our recruitment process where we rely on other companies (*third parties*) to provide certain services. Third parties may be used in our recruitment process to:
- Source candidates
- Host our recruitment platform and its AI features in data centres within the EU
- Schedule, record, and transcribe interviews
- Host the coding assessments used for technical roles
- Draft and sign employment agreements
- Verify your identity and perform background checks (*if you are hired*)
- Collect feedback from you after the recruitment process
- Help candidates apply for (or renew) their residence permits, if needed
Transfers outside the EU/EEA. Some suppliers may process your personal data outside the EU/EEA. For example, the coding assessments for technical roles are hosted by GitHub in the United States. GitHub is certified under the EU–U.S. Data Privacy Framework, and we have also put additional safeguards in place, such as the European Commission’s Standard Contractual Clauses (SCCs). Whenever your personal data is transferred outside the EU/EEA, we make sure the transfer is protected by an adequacy decision or other appropriate safeguards under the GDPR.
For additional details on what personal data we collect, please refer to the table in section 3.
8. Cookies
When you use our website, information about your usage may be stored as “Cookies”. Cookies are passive text files that are stored in the internet browser on your device, such as computers, mobile phones or tablets. We use cookies to improve your experience using our services and to gather information about, for example, statistics about your usage of the service. This is done to secure, maintain and improve our services. The information that is collected through cookies can, in some instances, be personal data and is, in such instances, regulated by our Cookie Policy.
You can disable the use of cookies at any time by changing the local settings in your devices. Disabling cookies can affect your experiences with our services, for example disabling some functions in the Alva service.
9. Changes
This Privacy Policy may be updated periodically to reflect changes in our collection and use of your personal data. Any material changes will be communicated to you when accessing the platform, such as through a notification prior to continued use of the service. Changes will only apply moving forward and will not affect how your personal data was processed under a previous version of this Privacy Policy.
We are committed to making any updates clear and concise, while ensuring that important information is not lost in excessive detail. Therefore, we encourage you to review this Privacy Policy from time to time to stay informed about any changes or additional details that may be of interest to you.